[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-hipaa::en":3,"gloss-cluster-hipaa::en":23,"gloss-next-hipaa::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"hipaa","saas","HIPAA","HIPAA - the U.S. Health Insurance Portability and Accountability Act of 1996 - is the federal law governing how protected health information (PHI) is handled in the United States. For SaaS builders it becomes relevant the moment your product touches identifiable health data on behalf of a healthcare provider, insurer, or their vendors. If you do, you're likely a business associate and must sign a Business Associate Agreement (BAA) with your customer, contractually committing to safeguard PHI. Compliance spans administrative, physical, and technical safeguards: access controls, encryption, audit logging, breach notification, and workforce training, among others. Practically, HIPAA shapes architecture and vendor choices early - you need infrastructure providers that will themselves sign BAAs (major clouds do), you must restrict and log who can see PHI, and you have to design breach response before you need it. Getting this wrong carries real regulatory and financial penalties. If you're selling into healthcare, treat HIPAA readiness - including BAAs down your whole sub-processor chain - as a prerequisite, not a later add-on.","HIPAA is the U.S. law governing protected health information — it binds your SaaS the moment you touch identifiable health data for a covered entity.",null,[11,14,17,20],{"slug":12,"name":13},"data-residency","Data Residency",{"slug":15,"name":16},"gdpr","GDPR (General Data Protection Regulation)",{"slug":18,"name":19},"sla","Service-Level Agreement (SLA)",{"slug":21,"name":22},"soc-2","SOC 2",[24,28,32,35,38,41,44,48,51,54,57,60],{"slug":25,"category":5,"name":26,"updated_at":27},"activation","Activation","2026-08-24T02:46:36+00:00",{"slug":29,"category":5,"name":30,"updated_at":31},"aha-moment","Aha Moment","2026-08-24T02:46:37+00:00",{"slug":33,"category":5,"name":34,"updated_at":31},"annual-contract-value","Annual Contract Value (ACV)",{"slug":36,"category":5,"name":37,"updated_at":27},"api-first","API-First",{"slug":39,"category":5,"name":40,"updated_at":27},"arpa","Average Revenue Per Account (ARPA)",{"slug":42,"category":5,"name":43,"updated_at":27},"arr","Annual Recurring Revenue (ARR)",{"slug":45,"category":5,"name":46,"updated_at":47},"auto-renewal-clause","Auto-Renewal Clause","2026-08-24T02:46:38+00:00",{"slug":49,"category":5,"name":50,"updated_at":47},"build-vs-buy","Build vs. Buy",{"slug":52,"category":5,"name":53,"updated_at":31},"burn-multiple","Burn Multiple",{"slug":55,"category":5,"name":56,"updated_at":47},"burn-rate","Burn Rate",{"slug":58,"category":5,"name":59,"updated_at":27},"cac","Customer Acquisition Cost (CAC)",{"slug":61,"category":5,"name":62,"updated_at":27},"cdn","Content Delivery Network (CDN)"]