HIPAA does not certify software. It governs how protected health information (PHI) is handled, and your app is one part of that. This checklist covers what engineering must get right. It is not legal advice, so involve your compliance counsel.
1. Know where PHI lives
Map every place PHI is stored, processed, or transmitted: databases, logs, backups, analytics tools, email, and support systems. Most compliance failures come from PHI leaking into places nobody mapped, usually logs and third-party tools.
2. Access control
- Role-based access with least privilege.
- Strong authentication, with MFA for staff and admin users.
- Automatic session timeouts.
- Break-glass access that is logged and reviewed.
3. Audit trails
Record every read, write, and export of PHI: who, what, when, and from where. Make logs tamper-evident and retain them per your policy. Design this into the data model early. It is far harder to retrofit.
4. Encryption
- TLS everywhere in transit.
- Encryption at rest for databases, object storage, and backups.
- Managed key storage with rotation.
5. Vendors and Business Associate Agreements
Any vendor that touches PHI, including hosting, email, analytics, and AI providers, needs a signed BAA. Check this before you integrate, not after.
6. Minimise and de-identify
Collect only what you need. Use de-identified data in development, staging, and analytics.
7. Integration with clinical systems
Plan early for EHR integrations and HL7 or FHIR formats. Each partner has its own onboarding and edge cases.
8. AI features
If you add LLM features, confirm the provider will sign a BAA, keep PHI out of prompts where you can, and log every model call. Our note on AI integration cost covers the guardrails.
Common mistakes that fail audits
- PHI in application logs or error trackers.
- Shared admin accounts.
- Production data copied into staging.
- No process for revoking access when staff leave.
- Backups that are unencrypted or never tested.
FAQ
Is there a HIPAA certification for apps? No. You demonstrate compliance through safeguards, policies, and documentation.
Can we use a public cloud? Yes, with a BAA and a configuration that follows the provider's HIPAA guidance.
We design the data model and access layer around these constraints from the first architecture doc. See our healthcare software development work, or talk to us.
