How to Make an App HIPAA Compliant: A Practical Guide for Product Teams

Does HIPAA apply to your app?

HIPAA applies to covered entities (healthcare providers that bill electronically, health plans and clearinghouses) and to their business associates, meaning any company that handles protected health information (PHI) on their behalf. If a clinic, hospital or insurer uses your app to manage its patients, or you build software under contract for one, you are a business associate and HIPAA applies to you directly.

A consumer app that people download to track their own health, with no relationship to a provider or plan, is usually not covered by HIPAA. It is not unregulated, though. The US Federal Trade Commission's Health Breach Notification Rule, updated in 2024, applies to health apps outside HIPAA and requires notifying users, the FTC and sometimes the media after a breach, including unauthorised sharing with advertisers. State laws such as Washington's My Health My Data Act add further obligations.

The three parts of HIPAA that shape your product

• The Privacy Rule: who may use and disclose PHI, the minimum-necessary standard, and patients' rights to access their records.
• The Security Rule: the administrative, physical and technical safeguards for electronic PHI. This is the part that turns into engineering work.
• The Breach Notification Rule: what you must do, and how fast, when unsecured PHI is exposed.

Security Rule technical safeguards, translated into features

Under the current rule, encryption is an "addressable" specification, which lets organisations document an alternative. In practice, encrypting PHI at rest and in transit is the expected baseline, and encrypted data that is lost is generally not a reportable breach. In January 2025 HHS proposed an update to the Security Rule that would make encryption and multi-factor authentication mandatory, require an asset inventory and network map, and remove the addressable category altogether. It had not been finalised at the time of writing, but building to it now avoids a second project later.

Business associate agreements: the contract layer

Every vendor that stores, processes or transmits PHI for you must sign a business associate agreement (BAA). That usually includes your cloud provider, database host, video provider, email and SMS provider, error tracker, backup service and any AI model API that sees patient data. AWS, Azure and Google Cloud all sign BAAs, but only for listed HIPAA-eligible services, so check each service you use against the list. Twilio, Vonage and several video SDKs sign BAAs for specific products.

• Keep a register of every vendor, what PHI it can see and the BAA's signature date.
• Configure analytics, logging and crash reporting so PHI never reaches vendors without a BAA. This is where most leaks happen.
• Check AI providers carefully: use enterprise offerings with a BAA and zero data retention, or run models inside your own cloud account.
• Sign the BAA your clients send you, and make sure your subcontractors' BAAs flow the same obligations down.

Administrative safeguards that engineering teams own

• A documented risk analysis before launch and whenever the architecture changes. HHS lists the risk analysis as a required specification and it is the first document investigators ask for.
• Access reviews: who can reach production data, reviewed at least quarterly, removed the day someone leaves.
• Change management: code review, tested deployments and a record of what changed and when.
• Contingency planning: backups, disaster recovery and an emergency mode for critical workflows, all tested.
• Workforce training on phishing, handling PHI and reporting incidents, with records kept.
• Policies and records retained for six years, as the rule requires.

Breach notification: the clock you need to plan for

If unsecured PHI is breached, affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within the same 60 days, and to prominent media when more than 500 residents of one state are affected. Smaller breaches go into an annual report to HHS. Business associates must notify the covered entity, so your client's clock starts with you. Build an incident runbook, an on-call rota and audit logs good enough to tell exactly which records were exposed.

What are the penalties for HIPAA violations?

HHS adjusts HIPAA civil money penalties for inflation each year. From 28 January 2026 they range from $145 per violation where the organisation did not know, up to $2,190,294 per violation for wilful neglect that is not corrected, with an annual cap of $2,190,294 for violations of the same provision. Most enforcement cases start with a breach and end with a finding that no risk analysis was done. Beyond fines, a breach usually ends the client relationship for a vendor, which is the bigger commercial risk for most app companies.

A HIPAA build checklist for your app

1. Map the data: every place PHI is collected, stored, processed, displayed and sent, including logs and backups.
2. Choose HIPAA-eligible services and sign BAAs before any real patient data exists.
3. Implement individual accounts, role-based access, MFA for staff and automatic logoff.
4. Encrypt data at rest (database, files, backups) and in transit (TLS everywhere, pinning on mobile).
5. Write an append-only audit log for access to patient records and review it.
6. Strip PHI from push notifications, emails, URLs, analytics events and error reports.
7. Keep mobile devices safe: no PHI in plain storage, biometric or PIN re-authentication, remote logout.
8. Run a documented risk analysis, a penetration test and a restore test before launch.
9. Write the incident response and breach notification runbook, with named owners.
10. Schedule quarterly access reviews and an annual review of the risk analysis and policies.

We work through this checklist on our healthcare builds, including the Zeuss telehealth platform on Azure. See HIPAA-compliant software development for how we run these projects, telemedicine app development for virtual care products, and the healthcare app development cost guide for budgets.

Sources

• HHS, the HIPAA Security Rule: https://www.hhs.gov/hipaa/for-professionals/security/index.html
• HHS, Breach Notification Rule: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
• Federal Register, proposed HIPAA Security Rule update (6 January 2025): https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
• FTC, Health Breach Notification Rule: https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule
• HIPAA Journal, HIPAA violation fines updated for 2026: https://www.hipaajournal.com/hipaa-violation-fines/
• AWS, HIPAA eligible services reference: https://aws.amazon.com/compliance/hipaa-eligible-services-reference/