HIPAA 101 for Software Development Teams
What I've learned over the last few years:<p>1) The requirements are theoretically tractable by an SMB but only just.<p>2) Non-compliance is ridiculously widespread.  Ridiculously.  This is partly because HIPAA prohibits people from doing things they really want to do (emailing about a patient, perhaps to that patient) and partially because the requirements are so vague.<p>3) Be prepared to use HIPAA as a pricing segmentation engine and for your providers to use it on you.  Getting a BAA with Rackspace, for example, quintupled our costs.<p>4) Get insured. Because literally everyone is exposed to this and investigations are infrequent, the industry treats them like acts of God.  You can insure, minimally, the cost of responding to an investigation (though my policy doesn't cover any fines assessed) and breach notification.