HIPAA-compliant app development: what you need to know
On this page
Health apps hold some of the most sensitive data there is. HIPAA, the US law that protects it, is a framework of rules and responsibilities, not a feature you switch on. This is a general overview, not legal advice. Talk to a qualified attorney or compliance professional about your situation.
Who has to comply
HIPAA applies to covered entities (healthcare providers, health plans, clearinghouses) and their business associates, which includes software companies that handle protected health information (PHI) for them. If you build an app for a clinic, hospital, or insurer, you are likely a business associate.
What counts as PHI
Health information that can identify a person: names, contact details, dates, medical record numbers, diagnoses, treatment and payment details, and similar identifiers.
The main safeguards
| Area | Examples |
|---|---|
| Access control | Unique user accounts, role-based permissions, automatic logout, multi-factor authentication |
| Encryption | In transit (TLS) and at rest for stored data and backups |
| Audit logging | Record who accessed or changed PHI, and when |
| Integrity and backups | Protect data from alteration and loss, with tested recovery |
| Risk assessment | Document risks and how you reduce them, and repeat it regularly |
| Policies and training | Written procedures and staff training |
| Breach response | A plan to detect, report, and notify as required |
Official guidance is available from HHS on HIPAA.
Vendors and BAAs
Every vendor that stores or processes PHI for you (cloud hosting, email, messaging, analytics, support tools) must sign a business associate agreement and be configured for compliant use. Avoid sending PHI to tools that will not sign one. Many major cloud providers offer BAAs for specific eligible services.
Design choices that reduce risk
- Collect the minimum. Data you never collect cannot be breached.
- Keep PHI off the device when possible, or encrypt it and protect it with the secure storage described in our mobile app security checklist.
- Never put PHI in notifications, logs, analytics, or crash reports.
- Separate environments: use fake data for development and testing.
Common mistakes
- Assuming a HIPAA-eligible cloud makes the app compliant.
- Sending PHI through standard email, SMS, or analytics tools.
- No audit logs, or logs that contain PHI.
- Skipping the written risk assessment.
- Treating compliance as a launch task instead of an ongoing process.
A practical HIPAA readiness checklist
Use this as a conversation starter with your compliance advisor. It is not legal advice.
| Area | Questions to answer |
|---|---|
| Scope | Which data is PHI? Where does it enter, move, and rest? Who can see it? |
| Roles | Are we a covered entity or a business associate? Who signs BAAs with whom? |
| Access | How are users verified? What roles exist? How is access removed when someone leaves? |
| Encryption | Is PHI encrypted in transit and at rest, including backups and logs? |
| Audit | Do we log access and changes, and review the logs? |
| Risk analysis | Is there a written assessment, reviewed at least yearly and after major changes? |
| Vendors | Does each vendor with PHI sign a BAA and configure services securely? |
| Incident response | Who investigates, who notifies, and how fast? |
| Training and policies | Is the team trained, and are policies written and followed? |
| Data lifecycle | How long is PHI retained and how is it securely deleted? |
Patient-facing app considerations
- Authentication. Strong login with options for biometrics and multi-factor authentication. Time out inactive sessions.
- Notifications. Keep messages generic (“You have a new message”) because notifications can appear on lock screens.
- Screenshots and app switcher. Consider hiding sensitive screens when the app moves to the background.
- Shared devices. Make logout simple and clear.
- Consent and access. Be clear about what data you collect and how patients can see or request it.
Staff and clinical tools
Clinical apps add requirements around audit trails, role-based access, and integration with the medical record. They often connect to electronic health record systems through standards like HL7 FHIR. Allow time for vendor onboarding, security reviews, and testing with real workflows.
When HIPAA may not apply
A consumer wellness or fitness app that collects information directly from people, without acting for a provider or health plan, is usually outside HIPAA. It may still be covered by FTC rules on health data and breach notification, state privacy laws, and platform requirements. Be careful when your app starts working with providers. The rules can change at that moment. For a related example, see fitness and wellness apps.
Budget impact
Compliance adds time for design, security work, documentation, testing, and audits. Plan for it explicitly in your app budget and review healthcare app development for features and scope.
Next steps
Read our healthcare app development guide for features and costs, then involve a compliance advisor early. Compliance adds scope to any app budget.
Frequently asked questions
Is there a HIPAA certification for apps?
No. HHS does not certify apps. Compliance means meeting the HIPAA Privacy, Security, and Breach Notification Rules through your policies, technical safeguards, and vendor agreements.
Does my health or fitness app need to be HIPAA compliant?
Only if it handles protected health information for a covered entity (such as a provider or insurer) or their business associate. A consumer wellness app that collects data directly from users may fall under other rules, such as FTC requirements.
What is a business associate agreement?
A contract in which a vendor agrees to protect protected health information and follow HIPAA rules. Cloud and software vendors that handle such data must sign one.
Can I use any cloud provider for a HIPAA app?
Use providers that will sign a BAA and offer HIPAA-eligible services, and configure those services correctly. Signing a BAA alone does not make an app compliant.
Need help with this? Tell us what you're building and we'll reply within one business day with a clear plan and price.