A HIPAA-compliant app is one that protects patients' protected health information (PHI) according to the HIPAA Privacy, Security and Breach Notification Rules. In engineering terms, that means strict access control, encryption in transit and at rest, detailed audit logs, secure infrastructure covered by business associate agreements (BAAs), and documented risk management. Compliance is not a feature you add at the end. It shapes the architecture, the vendors you choose and how your team works from day one.
This practical guide explains when HIPAA applies, which technical safeguards to build, the mistakes that most often cause violations, and what HIPAA compliance adds to the cost of an app. It is general guidance, not legal advice; involve a healthcare compliance professional for your specific situation.
Key takeaways
- HIPAA applies if you are a covered entity (provider, health plan or clearinghouse) or a business associate handling PHI on their behalf.
- Every vendor that stores, processes or transmits PHI, including cloud hosting, email and SMS providers, needs a signed BAA.
- Core controls: unique user IDs, MFA, automatic logoff, encryption, audit logs, integrity checks, backups and a documented risk analysis.
- Common violations come from PHI leaking into push notifications, analytics tools, logs and unsecured backups.
- HIPAA requirements typically add 15–30% to development cost.
Does your app need to be HIPAA compliant?
Ask two questions:
- Does the app create, receive, store or transmit PHI? PHI is individually identifiable health information, such as diagnoses, treatment details, test results or insurance data, linked to a person.
- Is it used by or for a covered entity? If your app serves hospitals, clinics, insurers or other covered entities, or you handle PHI on their behalf, you are almost certainly a business associate and HIPAA applies.
A consumer wellness app that users download for themselves and that is not provided by or for a covered entity may fall outside HIPAA. It can still be subject to other rules, such as the FTC's Health Breach Notification Rule and state privacy laws. When in doubt, design as if HIPAA applies; it is far cheaper than retrofitting later.
The HIPAA Security Rule, translated into engineering tasks
| Safeguard | What to build |
|---|---|
| Access control | Unique user accounts, role-based permissions, least-privilege access, emergency access procedures |
| Authentication | Strong passwords plus multi-factor authentication, especially for staff and admin users |
| Automatic logoff | Session timeouts and re-authentication after inactivity |
| Encryption | TLS for all data in transit; encryption at rest for databases, file storage, backups and mobile device storage |
| Audit controls | Tamper-resistant logs recording who accessed or changed which PHI, and when |
| Integrity | Controls that prevent improper alteration of PHI, such as validation, checksums and versioning |
| Transmission security | Secure APIs, certificate pinning on mobile, no PHI in URLs or query strings |
| Contingency planning | Encrypted backups, tested restore procedures and a disaster recovery plan |
| Risk analysis | A documented assessment of threats to PHI, updated as the system changes |
HHS has proposed updates to the Security Rule that would make several of these controls, including encryption and multi-factor authentication, explicitly mandatory. It is sensible to treat them as required today.
Business associate agreements: every vendor, no exceptions
If a third-party service touches PHI, you need a BAA with that vendor. This commonly includes:
- Cloud hosting (AWS, Microsoft Azure and Google Cloud all offer BAAs and HIPAA-eligible services).
- Databases, file storage and backup services.
- Email, SMS and notification providers.
- Video consultation and messaging services.
- Customer support and ticketing tools, if PHI could appear in tickets.
- Your development partner, if engineers can access production PHI.
Signing a BAA with a cloud provider does not make your app compliant by itself. Providers follow a shared-responsibility model: they secure the infrastructure, and you must configure and use only eligible services correctly.
Common HIPAA mistakes in apps
- PHI in push notifications: "Your HIV test results are ready" on a lock screen is a disclosure. Use neutral messages such as "You have a new message".
- Analytics and marketing SDKs: sending screen names, events or identifiers that reveal health information to analytics or advertising tools without a BAA.
- Logs and error reports: PHI captured in application logs, crash reports or monitoring tools.
- Unencrypted local storage: health data cached on phones without encryption.
- Shared accounts: staff sharing logins, which breaks audit trails.
- Using real patient data in development: use synthetic or properly de-identified data instead.
Breach notification basics
If unsecured PHI is breached, HIPAA requires notifying affected individuals without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more residents of a state also require notifying HHS and prominent media outlets; smaller breaches are reported to HHS annually. Encryption that meets HHS guidance can mean a lost device is not a reportable breach, one more reason to encrypt everything.
A HIPAA-ready development process
- Classify data early: what is PHI, where does it flow, who can see it?
- Run a risk analysis and threat model before writing code.
- Choose HIPAA-eligible services and sign BAAs before any PHI enters the system.
- Build security into the definition of done: code reviews, automated security testing and dependency scanning.
- Test independently with a penetration test before launch.
- Document policies, access reviews and incident response procedures. Auditors will ask for them.
How much does HIPAA compliance add to app cost?
For most projects, HIPAA requirements add roughly 15–30% to development cost, covering security architecture, audit logging, extra testing, documentation and a penetration test. A typical HIPAA-compliant patient app or portal costs $80,000–$250,000 to build, depending on features such as telehealth video, EHR integration (often via HL7 FHIR) and e-prescribing. Ongoing costs include compliant hosting, monitoring, periodic risk assessments and security testing. See our guide to custom software development cost for the wider picture.
Can offshore teams build HIPAA-compliant apps?
Yes, and many do. The key is controlling access to PHI: developers work with synthetic data, production access is restricted to a small number of authorized people under a BAA, and all access is logged. HIPAA does not prohibit offshore development, but your contracts, access controls and risk analysis must cover it explicitly.
Frequently asked questions
Is there an official HIPAA certification for apps?
No. HHS does not certify apps or vendors. Some companies use third-party assessments or frameworks such as HITRUST or SOC 2 to demonstrate their controls, but compliance is an ongoing responsibility, not a certificate.
Is AWS HIPAA compliant?
AWS offers a BAA and many HIPAA-eligible services, but compliance depends on how you configure and use them. The same applies to Microsoft Azure and Google Cloud.
Do patient portals and telehealth apps need HIPAA compliance?
If they are provided by or for a covered entity and handle PHI, yes. Telehealth video, messaging and scheduling features all need HIPAA-grade security and BAAs with the underlying providers.
Can I use Google Analytics in a healthcare app?
Be very careful. Standard analytics tools are not designed to receive PHI and generally will not sign a BAA. Many healthcare apps use privacy-focused or self-hosted analytics and strip any health-related identifiers from events.
How long does it take to build a HIPAA-compliant app?
Typically 4–9 months for a full patient-facing app, including security reviews and testing. A focused MVP can launch sooner if compliance is designed in from the start.
Build your healthcare app with Softxmind
Softxmind builds secure healthcare software, patient apps and portals for providers and health-tech startups, with security and compliance built in from the first sprint. Our team is ISO 27001 certified. Read our guide to healthcare software development or request a free estimate for your project.
