HIPAA compliance is not a checklist you bolt onto a finished product. It is an architectural decision — one that shapes how you store PHI, how you authenticate users, how you log access, and how you respond when something goes wrong. We build HIPAA-compliant software from the first commit, not retrofit it after the auditor shows up. Across more than 30 healthcare projects we have learned what real compliance looks like — and what passes for compliance theater.
What We Offer
Of Ash and Fire designs and builds HIPAA-compliant applications for healthcare startups, telehealth platforms, digital therapeutics, medical device SaaS, mental health apps, and any company whose product touches PHI. We handle the Security Rule, the Privacy Rule, the Breach Notification Rule, and the operational reality that lives between them — encryption keys, audit trails, BAAs, pen tests, and the runbooks your team will actually use.
Key Capabilities
- HIPAA security risk assessments: Comprehensive risk analyses mapped to the HIPAA Security Rule (45 CFR § 164.308) with prioritized remediation plans.
- BAA infrastructure: Vendor inventory, BAA chain mapping, subcontractor BAAs, and audit-ready documentation across your whole stack.
- Encryption at rest and in transit: AWS KMS, GCP KMS, or Azure Key Vault for data-at-rest, TLS 1.3 in transit, with key rotation policies and HSM-backed options for higher-risk PHI.
- RBAC and audit logging: Role-based access control, minimum-necessary enforcement, and tamper-evident audit trails that meet HIPAA’s 6-year retention requirement.
- Penetration testing and SAST: Annual third-party pen tests, continuous static analysis, and dependency scanning — integrated into your CI/CD pipeline.
- SOC 2 and HITRUST readiness: When customers start asking for SOC 2 Type II or HITRUST certification, we know exactly which controls already pass and which need work.
- HIPAA-eligible cloud architecture: AWS, GCP, and Azure HIPAA-eligible services, designed against the cloud provider’s shared responsibility model and validated against real-world PHI flows.
Our Process
1. Discovery & Architecture
We start by mapping every place PHI enters, lives, moves, and leaves your system. That data flow diagram drives every downstream decision — which services need to be HIPAA-eligible, where the trust boundaries are, what gets logged, and who can see what. We document the threat model, the security architecture, and the BAA chain before a line of production code is written.
2. Design & Prototyping
Security controls are part of the design, not a separate workstream. We prototype authentication flows, session handling, audit logging, and the operational dashboards your security team will need from day one. We also pressure-test cost — HIPAA-eligible services on AWS or GCP can be 20–40% more expensive than their non-eligible counterparts, and we make sure you are choosing services that earn their price tag.
3. Development & Integration
Engineering happens inside a hardened environment from the first commit: encrypted-by-default databases, audit-logged access, secrets management, dependency scanning, and PR-level security review. We integrate SAST, SCA, and DAST tools into CI/CD so vulnerabilities get caught early. Every PHI-handling code path gets explicit review and explicit tests.
4. Launch & Support
Before launch we run a final security review and coordinate third-party penetration testing. We deliver the documentation your security team needs — HIPAA risk analysis, security architecture, incident response runbooks, and BAA chain documentation. Ongoing support includes patch management, annual pen tests, and quarterly security reviews.
Industries We Serve
- Healthcare startups: Founder-led teams who need HIPAA architecture in place before the first enterprise customer asks for it.
- Telehealth platforms: Live video, async messaging, prescribing, and clinical documentation systems with full PHI handling.
- Digital therapeutics: Prescription digital therapeutics (PDTs), behavioral health apps, and condition-management platforms with FDA and HIPAA overlap.
- Medical device SaaS: Connected device platforms with bidirectional EHR integration, device telemetry, and clinician dashboards.
- Mental health apps: Apps handling especially sensitive PHI, with additional protections for substance use (42 CFR Part 2) and minor patients.
- Wellness and HIPAA-adjacent products: Companies on the edge of HIPAA who need an honest assessment of whether they are covered — and what to do if they are.