Thanks for the response. What I wonder then is when does a startup reach a point of hiring a dedicated compliance officer (so that argument becomes relevant)?

Thanks for the response. What I wonder then is when does a startup reach a point of hiring a dedicated compliance officer (so that argument becomes relevant)? Now we split the work and pull in 3rd parties as needed. Even for medical or health technology I wouldn't expect it would be in the first 10 employees or first few years of most bootstrapped (and cash-strapped) companies. That being said, I understand HIPAA compliance (or what it implies) is VERY important and shouldn't be taken lightly...