What Is HIPAA, in Plain Language
HIPAA — the Health Insurance Portability and Accountability Act of 1996 — is a U.S. federal law that protects how Protected Health Information (PHI) is created, stored, transmitted, and accessed. For app development purposes, the Security Rule is the most directly relevant — it shapes the engineering work by defining the administrative, physical, and technical safeguards required to protect PHI in electronic form (ePHI).
The law identifies two categories subject to HIPAA. Covered entities are healthcare providers, health plans, and healthcare clearinghouses. Business associates are organizations that perform services for covered entities involving PHI — including cloud hosting providers, analytics vendors, and app development agencies. Both categories are subject to HIPAA, with business associates becoming directly liable under the HITECH Act of 2009.
Does Your App Actually Need to Be HIPAA Compliant?
Many founders building consumer health apps assume HIPAA applies when it usually does not. Many founders building B2B healthcare apps assume it does not apply when it usually does. The determination depends on whether you handle PHI on behalf of a covered entity — not on whether your app feels "health-related."
HIPAA almost certainly applies if:
- Your app is used by doctors, nurses, hospitals, or clinics to view, manage, or transmit patient information
- Your app integrates with EHRs like Epic, Cerner, or Athenahealth
- Your app supports telehealth or remote patient monitoring on behalf of a healthcare provider
- Your app is sold to health insurance companies or health plans
HIPAA usually does not apply if:
- Your app is a direct-to-consumer wellness or fitness app where users voluntarily enter their own data that never reaches a covered entity
- Your app sells health-adjacent products without handling PHI from a covered entity
The Five HIPAA Technical Pillars for App Development
1. Encryption at rest and in transit. PHI must be encrypted when stored (AES-256) and when transmitted (TLS 1.2 minimum). At-rest encryption uses cloud-native key management services — AWS KMS, Google Cloud KMS, or Azure Key Vault.
2. Audit logging. Every access to PHI must be logged with a timestamp, user identity, action taken, and the specific PHI accessed. Logs must be retained for at least six years, protected from tampering, and queryable for compliance reviews. Audit logging is one of the most-underbuilt aspects of healthcare apps.
3. Role-based access controls. Users should only access PHI relevant to their role and specific care relationship with the patient. RBAC requires deliberate architecture from the start — retrofitting it is expensive and frequently fails compliance review.
4. Signed Business Associate Agreements with every vendor that touches PHI. Cloud provider, database, SMS platform, analytics, error tracking, push notifications — each needs a BAA. Missing BAAs are the single most common HIPAA compliance failure in audited cases.
5. Documented risk assessment. HIPAA requires a formal, auditable risk assessment identifying threats to PHI with likelihood, impact, and documented safeguards. This must exist before a HIPAA audit can find your organization compliant.
Business Associate Agreements: Who Needs Them and Why
A BAA is required between a covered entity and any vendor that creates, receives, maintains, or transmits PHI on its behalf. For a healthcare app build, BAAs are required with: the covered entity client, cloud hosting provider, database provider, communications platforms (Twilio, SendGrid, OneSignal — HIPAA-eligible products only), error tracking tools (Sentry, Datadog on HIPAA tiers), and any AI/LLM provider processing PHI.
The practical implication: a general-purpose consumer analytics setup using Mixpanel cannot be reused for a healthcare app. The architecture must be designed around HIPAA-eligible vendor selection from the start.
HIPAA Compliant Cloud Hosting Options
- AWS — BAA free via AWS Artifact, covers ~150 services. Most-used HIPAA cloud in 2026.
- Google Cloud Platform — BAA via Customer Care. Strong healthcare-specific services including Cloud Healthcare API.
- Microsoft Azure — BAA via Enterprise Agreement. Best for hospital systems on the Microsoft stack.
- Firebase — HIPAA-eligible under GCP's BAA for covered services (Firestore, Cloud Functions, Firebase Auth).
- Supabase — BAA on Enterprise plans only.
- Vercel — BAA on Enterprise plans only for frontend hosting.
Critical mistake: having a BAA with AWS does not cover all AWS services. Each specific service must be on the HIPAA-eligible list.
HIPAA Compliant Authentication and Access Controls
- Multi-factor authentication (MFA) for all users with PHI access
- Session timeout and automatic logoff after 10–30 minutes idle
- Account lockout after failed login attempts
- Audit logging of all authentication events
- Role-based access control with the principle of least privilege
- HIPAA-eligible identity providers: Auth0, AWS Cognito, Microsoft Entra ID, Okta, Firebase Authentication
Audit Logging Requirements
Every PHI event should log: who, what action, when, what PHI, and where (IP, device, app version). Practical implementation:
- Centralized aggregation via HIPAA-eligible service (AWS CloudWatch, Google Cloud Logging, Datadog HIPAA tier)
- Tamper-evident, append-only storage
- Six-year minimum retention
- Queryable structure for audit queries
- Regular review processes with anomaly detection and incident response
Encryption Requirements
At rest: AES-256 for databases, cloud-managed key management with documented rotation, storage-layer encryption for S3/GCS/Azure Blob, application-level encryption for especially sensitive fields.
In transit: TLS 1.2 minimum (TLS 1.3 preferred), HTTPS on all public endpoints with HSTS, certificate pinning in mobile apps, VPN or private networks for backend-to-backend traffic.
Cost of HIPAA Compliant App Development in 2026
HIPAA compliance typically adds 40–80% to baseline app development cost, covering: architectural overhead (RBAC, audit logging, encrypted data flows), compliance documentation, HIPAA-eligible infrastructure costs, BAA execution, formal QA and security review, and outside compliance counsel.
- Patient portal connected to EHR: $150K – $400K
- Telehealth / telemedicine app: $100K – $350K
- Remote patient monitoring app: $120K – $400K
- Clinical decision support / provider-facing app: $150K – $500K
- Healthcare administrative / billing app: $100K – $300K
- Patient-facing wellness app (no covered entity): $60K – $150K
Common Mistakes That Break HIPAA Compliance After Launch
- Sending PHI to non-HIPAA-eligible analytics tools. Google Analytics, Mixpanel, Amplitude without BAAs are not HIPAA-eligible.
- Logging PHI to non-HIPAA-eligible error tracking. Sentry and LogRocket need HIPAA configuration and a BAA.
- Push notifications with PHI in plain text. Medication reminders on a lock screen expose PHI.
- SMS via non-HIPAA-eligible Twilio configuration. HIPAA-eligible Twilio products must be explicitly enabled.
- Inadequate session timeout in mobile apps. Indefinite sessions expose PHI if the device is lost or stolen.
- Missing BAAs with subcontractors. Queue services, search indexes, CDNs each need their own BAA.
- Customer support tools without BAAs. Zendesk, Intercom, and HelpScout handle PHI-containing conversations.
- Backups not extended to HIPAA standards. Backups of PHI must be encrypted and access-controlled identically to production.
How Bolder Apps Approaches HIPAA Healthcare App Development
Bolder Apps is a Miami-headquartered mobile and web app development agency that builds healthcare apps using HIPAA-aware architectural patterns — BAA-eligible cloud services, encrypted data flows, audit logging infrastructure, role-based access controls, and documentation patterns that support the client's broader compliance posture.
HIPAA-regulated builds are scoped on a per-engagement basis. Bolder Apps does not provide HIPAA legal advice or determine whether HIPAA applies to a given project — that determination rests with the client and their outside healthcare compliance counsel.
Disclaimer: This guide provides general information about HIPAA-aware app development practices. It is not legal advice. Founders building apps that handle Protected Health Information should engage outside healthcare compliance counsel before launch.
