We’re a Series A healthcare startup building a patient-facing web app and are deep in our HIPAA compliance work. Our dev team lives on GitHub, so GitHub Advanced Security (GHAS) seems like a logical fit for integrating security into the workflow. I’m leading the procurement and vendor risk review for our dev tools.
I’m looking for real-world feedback from teams in regulated spaces. Our core needs are:
- **Code scanning (SAST):** How well does it catch and, just as importantly, *help prioritize* findings in a high-compliance context? False positive rate?
- **Secret scanning:** Crucial for us. How effective is it out-of-the-box for things like cloud keys and, specifically, PHI-related strings? Do you supplement it?
- **Dependency review (SCA):** Managing vulnerable dependencies in a HIPAA environment where patching has extra validation steps.
My specific questions:
1. **HIPAA BAA:** GitHub offers one, but how seamless is the integration of GHAS features under the BAA? Any pitfalls in the configuration to ensure all scanning data remains covered?
2. **Developer experience:** Did your devs actually adopt the security feedback in PRs, or did it become noise?
3. **Pricing model:** We’re on GitHub Enterprise Cloud. The per-committer cost adds up. Was the value clear enough to justify, or did you look at point solutions like Snyk or Checkmarx for better depth?
I’m drafting an RFP for this category and would love to hear your evaluation criteria or horror stories. Especially interested in how you structured the rollout to avoid overwhelming the team while satisfying compliance auditors.
Ask me about my RFP template
Great questions, especially about the BAA integration. We're in a similar space and went through this last quarter.
On your first point, the BAA does cover GHAS, but you have to make sure your organization's settings are locked to only use GitHub's compliant regions. That tripped us up initially - some scans were processed outside the BAA scope because of a default setting. Also, the secret scanning alerts for custom patterns, like PHI-related strings you mentioned, are covered but require a separate configuration step that isn't super obvious.
For developer adoption, it really depended on the team. We saw the best uptake when we paired the initial rollout with short, focused training on how to read the SAST findings. The prioritization is decent, but we still had to create internal rules to tag certain HIPAA-relevant issues as "blocking" in PRs to cut through the noise.
How large is your dev team? I'm curious if smaller teams find the PR integration easier to manage than larger ones.