HIPAA compliant app development means building software that creates, receives, stores or transmits protected health information (PHI) for a covered entity or business associate in line with the HIPAA Privacy, Security and Breach Notification Rules. In practice that requires a business associate agreement with every vendor that touches PHI, administrative, physical and technical safeguards, a written risk analysis, and a breach response plan. No app or cloud is “HIPAA certified”; compliance is how you build and operate it.
This guide is for founders, product leaders and healthcare IT teams in the USA planning a patient-facing app, provider tool or health SaaS product. It explains when HIPAA applies, the requirements developers must implement, what is proposed but not yet law, where compliance adds cost, and how to choose a development partner. It is not legal advice; confirm your obligations with a healthcare privacy attorney.
Key Takeaways
- HIPAA applies to covered entities (providers, health plans, clearinghouses) and their business associates; many direct-to-consumer health apps fall outside HIPAA but may be covered by FTC rules.
- Every vendor that creates, receives, maintains, or transmits PHI on your behalf needs a business associate agreement, including cloud hosting, email, analytics, and AI model providers.
- The Security Rule requires access control, audit controls, integrity, authentication and transmission security, backed by a written risk analysis.
- HHS proposed stricter Security Rule requirements, including mandatory MFA and encryption, in January 2025; as of November 2026 they are not final, but building to them now is sensible.
- Compliance adds cost in hosting, security engineering, testing, documentation and legal review; budget for operating compliance, not just building it.
Talk to Our Team About Your Project ->
When Does HIPAA Apply to an App?
HIPAA applies to an app when it handles PHI for a covered entity or as a business associate of one. HHS defines covered entities as health plans, healthcare clearinghouses and providers who conduct certain electronic transactions. A company that builds or runs software holding PHI for those organizations is a business associate and is directly liable for complying with the Security Rule.
Many consumer health apps are outside HIPAA because the user, not a provider, chooses to share data with the app. Those apps can still be covered by the FTC’s Health Breach Notification Rule and by state privacy laws. The question is not whether data is about health, but who the app works for.
| Scenario | HIPAA applies? | Why |
|---|---|---|
| Patient portal built for a clinic | Yes | The clinic is a covered entity; the developer or host is a business associate |
| SaaS scheduling or billing tool sold to practices | Yes | It stores PHI on behalf of covered entities |
| AI scribe used by physicians | Yes | It processes PHI for providers; the AI vendor needs a BAA |
| Consumer fitness or sleep app | Usually no | No covered entity is involved; check FTC and state rules |
| Consumer app that imports a user’s medical records | Usually no, unless offered by or for a provider | FTC Health Breach Notification Rule may apply |
HIPAA Requirements Developers Must Implement
Developers must implement the Security Rule’s safeguards for electronic PHI and support the Privacy and Breach Notification Rules in the product. HHS summarizes the Security Rule as administrative, physical and technical safeguards that ensure the confidentiality, integrity and availability of electronic PHI.
Technical safeguards and how to build them
| Security Rule safeguard | What to build |
|---|---|
| Access control | Unique user IDs, role-based permissions, automatic logoff, emergency access procedure |
| Authentication | Strong authentication; MFA for staff and admin access (proposed as mandatory) |
| Audit controls | Tamper-resistant logs of who viewed, created, changed or exported PHI |
| Integrity | Controls that detect unauthorized change, such as checksums, versioning and restricted write paths |
| Transmission security | TLS for all traffic; no PHI in URLs, push notification text or email bodies |
| Encryption at rest | Encrypted databases, backups and device storage (addressable today; proposed as required) |
Requirements outside the code
- 1. Business associate agreements: Sign a BAA with every vendor that handles PHI for you. Choose cloud, email, logging, analytics and AI services that offer one, and configure only their BAA-covered services.
- 2. Risk analysis: HHS expects a documented risk analysis of where electronic PHI lives, the threats to it and how they are mitigated. Update it when the architecture changes.
- 3. Minimum necessary and de-identification: Collect and expose only the PHI each feature needs. For analytics and AI training, use data de-identified under HHS methods where possible.
- 4. Breach notification: The Breach Notification Rule requires notifying affected individuals without unreasonable delay and no later than 60 days after discovery, with HHS and sometimes media notice depending on size.
- 5. Policies, training and access reviews: The administrative safeguards cover the people operating the app, not only the software.
Common traps in health apps
- Tracking pixels and analytics: Sending identifiers and health-related page activity to analytics or ad tools without a BAA is a known risk. HHS issued guidance on online tracking technologies; parts were vacated by a federal court in 2024, but disclosing PHI to vendors without a BAA remains prohibited.
- AI features: Prompts containing PHI sent to a model API without a BAA, or logged by the AI provider, are disclosures. Use BAA-covered AI services and disable retention where offered.
- Logs and error tools: Application logs and crash reports often capture PHI. Scrub before logging and keep log tools under a BAA.
- Notifications and email: Lock-screen notifications and email subjects should not reveal health details.
What Is Proposed but Not Yet Law
In January 2025, HHS published a proposed update to the Security Rule that would remove the “addressable” category and require, among other things, MFA, encryption of electronic PHI at rest and in transit, asset inventories and network maps, and tested restoration plans. As of November 2026 no final rule has been issued; HIPAA Journal reports the final rule has been postponed until at least July 2027. The current Security Rule is what HHS enforces today.
Building new apps to the proposed controls is still the safer choice: MFA and encryption are inexpensive to design in and costly to retrofit, and enterprise healthcare buyers increasingly ask for them in security reviews.
What Does HIPAA Compliant App Development Cost?
A HIPAA compliant app costs more than the same app without PHI because compliance adds work in hosting, security engineering, testing, documentation and legal review, and continues after launch. There is no reliable public benchmark for the size of that premium, so AB Ark does not publish one; ask vendors to price these line items separately so you can compare quotes.
| Cost line | What drives it | One-time or ongoing |
|---|---|---|
| BAA-eligible hosting and services | Using only covered services; separate environments for PHI | Ongoing |
| Security engineering | Access control, MFA, encryption, audit logging, key management | Mostly one-time, plus maintenance |
| Security testing | Threat modeling, vulnerability scanning, penetration testing | Initial, then periodic |
| Risk analysis and documentation | Data-flow maps, policies, evidence for customers and auditors | Initial, then annual updates |
| Integrations | EHR and FHIR or HL7 interfaces, identity providers | One-time, plus changes |
| Compliance tooling and legal review | Monitoring, compliance platforms, counsel review of BAAs | Ongoing |
The biggest cost reducer is scope. Keeping PHI out of features that do not need it, using de-identified data for analytics, and choosing managed services that already support a BAA all reduce build and audit effort.
Get a Custom Project Cost & Timeline Estimate ->
How to Choose a HIPAA Compliant App Development Partner
Choose a partner that will sign a BAA, can show healthcare work with PHI, and can explain its security controls and evidence in writing. A partner that calls its platform “HIPAA certified” is a warning sign, because no official HIPAA certification exists.
| Question to ask | Good answer |
|---|---|
| Will you sign a BAA? | Yes, before any PHI is shared, with subcontractors covered |
| Which healthcare apps with PHI have you built? | Specific projects, integrations and the safeguards used |
| How do you handle PHI in development and testing? | Synthetic or de-identified test data; no PHI on laptops |
| What security certifications or audits do you hold? | Independent certifications such as ISO 27001 or SOC 2 reports, with scope explained |
| How do you produce the risk analysis and evidence? | A documented process and templates, updated with each release |
| What happens after launch? | Monitoring, patching, access reviews and incident response with named owners |
An AB Ark Implementation Lens
AB Ark lists healthcare software development among its focus industries and displays ISO 27001:2022 and ISO 9001:2015 certification badges on its website. Its case studies include healthcare-related products, and its blog covers AI voice agents for healthcare clinics and automation in healthcare, both of which raise the PHI questions in this guide. AB Ark’s product development services cover discovery, architecture consulting, design, development and QA, which is where HIPAA safeguards are designed in.
FAQs
What makes an app HIPAA compliant?
An app is HIPAA compliant when the organization operating it meets the Privacy, Security and Breach Notification Rules for the PHI it handles: BAAs with vendors, access control, audit logs, integrity and transmission security, encryption, a documented risk analysis, workforce policies and a breach response plan. Compliance covers operations as well as code.
Does every health app need to be HIPAA compliant?
No. HIPAA applies when an app handles PHI for a covered entity or as a business associate. Many direct-to-consumer health and wellness apps are outside HIPAA, but they may be subject to the FTC Health Breach Notification Rule and state privacy laws.
Is AWS, Azure or Google Cloud HIPAA compliant?
Major cloud providers offer BAAs and list services eligible for PHI, but using them does not make an app compliant. You must sign the BAA, use only covered services, and configure them correctly with access control, encryption, logging and backups.
Is encryption required under HIPAA?
Under the current Security Rule, encryption is an addressable specification: you must implement it or document an equivalent alternative. The January 2025 proposed rule would make encryption at rest and in transit required, but it is not final as of November 2026. In practice, encrypt.
Can I use ChatGPT or other AI APIs with PHI?
Only if the AI provider signs a BAA covering the service you use and the configuration meets your safeguards. Otherwise, remove identifiers before sending data, or use a model deployment that is covered by a BAA.
The Rule for HIPAA Compliant App Development
Decide first whether HIPAA applies, then sign BAAs, design the safeguards in, write the risk analysis, and plan how you will operate and prove compliance after launch. Build to the proposed MFA and encryption standards now, and keep PHI out of every feature that does not need it.
HIPAA compliance is not a feature you add at the end. It is the shape of the architecture from day one.
Schedule a Free Consultation Call ->
Head Of Product
