Recently on Lessons from the Leap, our Founder, Ghazenfer Mansoor, spoke with Larry Trotter II, Founder of Inherent Security, about HIPAA compliance for HealthTech.
The core message? HIPAA compliance is not a checkbox, it’s a cybersecurity program that includes policies tailored to your organization, risk assessments, technical controls across infrastructure and applications, and ongoing monitoring. Larry also emphasizes vendor security and the growing need to treat AI work with care, including using as little data as possible and keeping humans in the loop.
“Watch the full episode: How to Embed Security From Day One in Health Tech Products“
Below are six non-negotiables from the conversation.
HIPAA Compliant Isn’t One Rule, It’s Three
Too many teams treat HIPAA like a single rule. In reality, it includes:
-
- Security Rule: Technical and administrative safeguards
- Privacy Rule: PHI handling and access governance
- Breach Notification Rule: Reporting obligations
If you are building a healthtech software, you are evaluated against all three, not just the one your team happens to think about most.
Why Third-Party Vendors Drive Most Healthcare Breaches
In HIPAA compliance for HealthTech, breaches aren’t just “your fault.” They often happen through vendors.
Practical implication for health tech founders: You can be doing “everything right” internally, but if your vendors aren’t secure (cloud configs, AI providers, integrations, subcontractors), you inherit their risk.
So you need a repeatable vendor security process:
- BAAs where applicable
- Paid plans that protect data usage rights
- Clear documentation of security controls
- Due diligence on “extra security features” hidden behind enterprise tiers
Breaches aren’t just your fault. They often happen through vendors.
Risk Assessments vs. Gap Assessments: The Mistake Most Teams Make
One of the most common mistakes in HIPAA compliance for HealthTech has nothing to do with missing controls. Skipping the real risk assessment, or assuming a gap assessment covers it, is consistently one of the top OCR audit findings.
“Companies often think a gap assessment and a risk assessment are the same thing. They’re not.” — Larry Trotter II
A real risk assessment maps every place PHI moves, including every vendor in between, then scores the realistic chance and impact of each failure point. A gap assessment alone won’t catch that.
It’s a language problem: companies routinely confuse a gap assessment with a risk assessment.
AI Security Needs More Than AI Governance
AI governance gets most of the attention in HIPAA compliance for HealthTech, but AI security needs its own focus.
The practices Larry calls out are:
- De-identify data and use as little as possible to get the job done
- Keep humans in the loop when using AI
- Treat AI/LLM providers like vendors, including evaluating their risk and understanding what changes on paid vs. enterprise plans
For a closer look at how these safeguards hold up in practice, see our breakdown of AI agent safety metrics and governance in healthcare.
Larry frames AI security as an area he is “leaning into” and wants his brand recognized for in healthcare.
Why Template Security Policies Fail Review
One of the sharpest moments in the episode: Larry calls out “canned” policies as a trust-killer, especially as vendor due diligence gets stricter.
Health systems and security assessors can spot copy-paste compliance from a mile away. And when everything looks “perfect,” it triggers scrutiny, not confidence.
Larry makes the point that weak policies can cost you deals. If a buyer doesn’t trust your documentation, they’ll dig deeper, and your sales cycle slows or dies. He’s seen it happen firsthand: companies risking deals worth $40,000 or more because their policies read as copy-pasted rather than built for their actual operations.
Compliance Monitoring vs. Threat Monitoring: The Piece Most Teams Skip
Ongoing HIPAA compliance for HealthTech breaks monitoring into two categories:
Compliance monitoring (ongoing activities):
- User access reviews (remove stale accounts)
- Ensuring logs are enabled
- Ensuring logs are monitored and reviewed
Threat monitoring (proactive detection):
- Actively looking for threats in the network or app
- Using software or tools to detect attacks
- Treating security as a 24/7 job, because attackers don’t take time off
As he says organizations often miss threat monitoring entirely, and that manual monitoring isn’t sustainable at scale.
HIPAA Compliance for HealthTech: Best Time to Start
Larry gives a clear “best time” answer: early. Not after you’ve shipped three versions, hired 30 people, and built a culture that treats security as an interruption.
Because the truth is, retrofitting security later is harder, slower, and more expensive. It creates friction precisely when you’re trying to scale.
His simple operational recommendation was to bring security into the weekly rhythm:
- Devote time in dev/ops meetings
- Budget for security before the buyer forces the conversation
- Include your security posture in your go-to-market narrative
Stay ahead of compliance. Download our HIPAA Compliance Checklist now and make security a core part of your HealthTech journey.
“HIPAA compliant” is something you prove, continuously
This episode with Larry Trotter from Inherent Security is a reminder that compliance and security aren’t static. They mature as your company grows. Watch the full episode here.
If you’re building healthcare software, especially with AI features, your strongest move is to treat security as part of product strategy, not an afterthought.
And if you’re a founder building a health tech product and want to bake in security from day one without slowing delivery, connect with Ghazenfer Mansoor and the team at Technology Rivers. We build secure, scalable healthcare software and help teams avoid expensive rework later. See our portfolio of HIPAA-compliant solutions to explore how we’ve helped other HealthTech teams succeed.
FAQs
What HIPAA Compliance Actually Requires Beyond the Three Rules
Requirements shift depending on what you’re building. A mobile app, a web-only product, and an AI-enabled feature each trigger different technical controls under the same three rules. Teams that only define “HIPAA compliant” at the policy level, without mapping it to their specific format, tend to miss requirements at the development stage rather than catching them upfront.
Gap Assessment or Risk Assessment? Why the Difference Matters
Even a generic template sourced from a GRC compliance platform doesn’t substitute for a real risk assessment. Larry notes that these templates can be a reasonable starting point, but treating them as the finished product is exactly the mistake that shows up in OCR audit findings.
What Ongoing HIPAA Monitoring Actually Looks Like
Monitoring isn’t meant to look the same every year. Larry describes it as a maturity curve: the controls a company has in year one should expand in year two and beyond as the business scales, rather than staying frozen at whatever passed the first audit.
Why Reviewers Can Spot a Template Security Policy in Seconds
Once a reviewer spots one canned document, they stop trusting the rest of the submission and start digging deeper, which is exactly the scrutiny a real deal can’t afford to trigger.
Where AI Vendor Integrations Fit Into HIPAA Compliance
Beyond the LLM provider itself, Larry flags a newer risk: tools that connect AI systems to other applications and data sources (sometimes called MCP integrations, short for Model Context Protocol). Not every one of these integrations is secure or HIPAA compliant, so any AI integration needs to be vetted and approved before it touches PHI, the same way you’d vet any other vendor.
