How should a founder map health data and HIPAA responsibilities?

Follow the data through a sample journey

Begin with the public site, then trace account creation, intake, clinical review, payment, pharmacy handoff and support. Include spreadsheets, email, call recordings, logs, backups, exports and AI tools used by staff. For each step record the data fields, purpose, sending entity, recipient, system and retention owner. Use dummy information for the exercise. Do not create a sensitive-data collection project just to understand your process.

This is an educational operational framework. Qualified privacy counsel and the responsible security and clinical leads should validate the legal roles and safeguards. The map is an input to that assessment, not a certificate of compliance. A flow that remains poorly understood should be restricted until its purpose and permitted handling have been established.

Determine roles without blanket labels

HHS distinguishes covered entities from business associates and describes business associates by functions involving protected health information on behalf of regulated entities. Ask counsel to assess each entity and relationship. Do not assume all health-related information is HIPAA-protected in every context, or that information outside HIPAA lacks other protection.

FTC guidance explains that its Health Breach Notification Rule covers certain personal health record businesses and related entities outside HIPAA. Its application depends on the business and information involved. Record a separate assessment for public-facing services rather than treating 'not covered by HIPAA' as permission to disclose sensitive information freely.

Source context: HHS: Covered Entities and Business Associates, FTC: Complying with the Health Breach Notification Rule

Connect contracts to the permitted use

For each vendor, ask what service it provides, what information it needs, whether it uses that information for additional purposes, and which subcontractors receive it. HHS business-associate guidance addresses required contractual assurances and downstream relationships where applicable. Counsel should determine whether a BAA or another arrangement is appropriate; not every exchange between healthcare parties requires a BAA.

Match the reviewed contract to the configuration. A vendor agreement is less useful if staff paste patient details into an unapproved tool or enable a new integration without review. Use the ownership and access checklist to document administrators, permissions and removal procedures. For operational reports, consider whether counts or non-sensitive status fields can answer the question with less information.

Source context: HHS: Business Associates

Review tracking by page and payload

Inventory analytics, pixels, session replay, chat widgets and error tools. Record the fields and page context each receives, including URLs, query parameters, form values and account identifiers. Review authenticated portals and intake separately from public pages. Privacy and technical reviewers should inspect outgoing requests with dummy data; a tool's name alone does not show what the implementation sends.

HHS tracking guidance addresses disclosures of PHI and acknowledges a court's vacatur of part of its treatment of certain unauthenticated public-page visits. Avoid a blanket statement that every public health-page visit creates PHI. Equally, do not infer that the court decision permits all tracking. Get advice for the specific information, parties and purpose involved.

Source context: HHS: Use of Online Tracking Technologies

Use the map to prepare access and incident decisions

HHS's Security Rule summary describes risk analysis, appropriate access, incident procedures and contingency planning for regulated entities. Your data map helps identify the systems and people those processes need to address. Assign a security owner, backup contact and review trigger for each sensitive system. Record evidence of access reviews and approved changes rather than relying on a one-time onboarding statement.

Run a scenario in which a support export is sent to the wrong recipient. Identify who can contain access, preserve the evidence and convene counsel for the notification assessment. Do not have frontline staff make the legal determination. Connect the findings to the support escalation process and update the map after every new form, vendor or integration.

Source context: HHS: Summary of the HIPAA Security Rule

Before you move forward

• Include staff tools, exports, logs and backups.
• Review each entity's role and each data purpose.
• Match agreements to the configured service.
• Inspect tracking payloads with dummy information.
• Assign access, retention, incident and change-review owners.