AppMatic Tech builds HIPAA-ready healthcare apps with PHI data mapping, encryption, role-based access control, audit logging, and BAA-covered infrastructure, in Flutter, Swift, Kotlin, Laravel, and Node.js, for US telemedicine and telehealth products. AppMatic Tech is based in Ahmedabad, India, with 330+ products shipped since 2017.
"HIPAA-compliant" is one of the most misused phrases in health app marketing. There is no government certificate an app can earn. HIPAA compliance is the result of decisions an organisation makes and documents: where protected health information (PHI) flows, which vendors touch it, who can see it, how access is recorded, and how a breach is detected and reported. Many of those decisions are architectural and expensive to retrofit. This guide explains what a HIPAA-ready app has to build in, which vendor agreements it needs, and what the Security Rule changes proposed in January 2025 would add if finalised.
Key takeaways
HIPAA readiness is designed in, documented, and contracted.
| Point | Detail |
|---|---|
| No HIPAA certificate exists | HHS does not certify apps; compliance is implemented and documented. |
| Scope comes first | HIPAA applies to covered entities and their business associates. |
| Every PHI vendor needs a BAA | Hosting, messaging, video, analytics, and AI services included |
| Map PHI before building | Every place PHI is stored, sent, logged, or displayed |
| Proposed rule raises the bar | MFA, encryption, scanning, pen testing, segmentation, and asset inventory |
| Final rule delayed | Reporting in 2026 points to July 2027; the current rule stays in force. |
When does HIPAA apply to an app?
| Situation | HIPAA applies? | Notes |
|---|---|---|
| App used by a clinic to manage its patients | Yes | The clinic is a covered entity, and the app vendor is a business associate. |
| Telemedicine platform delivering care for providers | Yes | PHI is created and exchanged in consultations. |
| Remote patient monitoring for a health system | Yes | Device readings become PHI in the clinical record. |
| Consumer fitness or wellness app used independently | Usually no | The FTC Health Breach Notification Rule and state laws can apply, as covered in when a wearable app becomes a medical device. |
| Consumer app that later sells to health plans or providers | Becomes yes | Architecture should anticipate the switch. |
What are the safeguards a HIPAA app must implement?
The HIPAA Security Rule organises requirements into three groups:
- Administrative safeguards
- A documented risk analysis and risk management plan, security responsibility, workforce training, access management procedures, incident procedures, and contingency planning.
- Physical safeguards
- Controls over facilities and devices that store ePHI, which for cloud apps largely means choosing BAA-covered hosting and managing staff devices.
- Technical safeguards
- Access control, audit controls, integrity protection, person or entity authentication, and transmission security.
For a development team, the technical safeguards turn into concrete features: unique user accounts, role-based permissions, automatic session timeouts, encryption, audit logs of every PHI access, and secure transport for every API call.
Where does PHI leak in mobile and web apps?
PHI rarely leaks through the main database. It leaks through the edges:
- Push notifications that show test results or appointment types on a lock screen.
- Analytics and crash SDKs that capture screen names, form fields, or URLs containing patient identifiers.
- Application logs that print request bodies with clinical data.
- Device storage where cached files, screenshots, or exports sit unencrypted.
- Email and SMS that include diagnoses or medication names.
- Support tools where agents paste patient details into tickets or chat systems without a BAA.
- AI services that receive PHI without a BAA covering the service.
AppMatic Tech starts every healthcare build with a PHI data map that lists every one of these paths and decides, for each, whether PHI is allowed, masked, or blocked.
Pro tip: Write push notifications that never contain PHI, such as "You have a new message in the app", and require sign-in to see the detail. A lock screen is the most common place a patient's health information is exposed to someone else.
Which vendors need a business associate agreement?
Every service that creates, receives, stores, or transmits PHI on the app's behalf needs a business associate agreement (BAA):
| Service | Typical approach |
|---|---|
| Cloud hosting and databases | Use services the cloud provider covers under its BAA, configured as the provider requires |
| Video and voice | Use a real-time provider that signs a BAA for the product used |
| Messaging, email, and SMS | Use BAA-covered services, or send content-free alerts |
| Analytics and crash reporting | Use BAA-covered tools, or strip PHI before data leaves the app |
| AI and LLM services | Use only services covered by a BAA, or send de-identified data |
| Support and ticketing | Use BAA-covered tools, or keep PHI out of tickets |
A BAA covers specific services, not the whole vendor, so the architecture must use only the covered services and configurations.
What would the proposed Security Rule update add?
HHS's Office for Civil Rights published proposed changes to the HIPAA Security Rule on January 6, 2025, with comments closing on March 7, 2025. The proposal would require:
- Multi-factor authentication for access to ePHI systems.
- Encryption of ePHI at rest and in transit.
- Anti-malware protection.
- Vulnerability scanning at least every six months.
- Penetration testing at least once every 12 months.
- Network segmentation.
- A technology asset inventory and a network map showing how ePHI flows.
Reporting in 2026 indicates the final rule has been moved to July 2027 on the federal regulatory agenda, and more than 100 hospital systems and provider associations asked HHS to withdraw it. Until a final rule is published, the current Security Rule remains in force. AppMatic Tech builds new healthcare apps to the proposed controls anyway, because each is a sound security practice and retrofitting them later costs more.
What must happen when a breach occurs?
Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI, notify HHS, and, for breaches affecting more than 500 residents of a state or jurisdiction, notify prominent media outlets. Business associates must notify the covered entity.
An app supports these duties through audit logs that show exactly which records were accessed, alerting on unusual access patterns, and encryption that can make lost data "secured" and outside breach notification.
What does a HIPAA-ready architecture look like?
- PHI data map maintained as a living document.
- BAA-covered hosting with encrypted databases, encrypted object storage, and managed keys.
- Identity and access with multi-factor authentication, role-based access control, and least-privilege service accounts.
- Audit logging of every PHI read and write, stored immutably and reviewed.
- Secure mobile clients with encrypted local storage, no PHI in notifications or logs, and screenshot protection on sensitive screens.
- De-identification for analytics and AI where a BAA is not available, following HIPAA's de-identification standards.
- Monitoring and incident response with alerts, runbooks, and breach assessment steps.
- Documentation of risk analysis, policies, and vendor agreements for the covered entity.
The same foundation adapts to other regimes, such as Saudi Arabia's PDPL, as covered in building healthcare apps for the Saudi market, and EHR integration follows FHIR API integration for mobile health apps.
How AppMatic Tech builds healthcare apps
AppMatic Tech has shipped 330+ products since 2017, holds a 5.0 Clutch rating, and keeps an 83% client retention rate. AppMatic Tech's healthcare builds include audit logging, PHI handling, and compliance documentation. Healthcare work includes a pharmacy-first telemedicine platform for a US company, the Homecare2go US telehealth app, and the Capmedic asthma controller app built for deployment at Northwestern Medicine.
Related guides: telemedicine app development and remote patient monitoring app architecture. The service is described on the healthcare app development page. AppMatic Tech builds the engineering foundation and works alongside each client's compliance and legal advisers. Scoping starts at contact@appmatictech.com or the contact page.
Sources
| Claim used in this article | Source |
|---|---|
| No HHS certification of HIPAA compliance | HHS, HIPAA FAQ on certification |
| Security Rule safeguards | HHS, Summary of the HIPAA Security Rule |
| Business associate agreements | HHS, Business associate contracts |
| Proposed Security Rule requirements, dates, and delay to July 2027 | Fierce Healthcare, HIPAA security rule overhaul pushed to July 2027 and Paubox, final HIPAA Security Rule update pushed to 2027 |
| Breach notification timing and media notice threshold | HHS, Breach Notification Rule |
Frequently Asked Questions
- Is there an official HIPAA certification for apps?
- No. The US Department of Health and Human Services does not certify apps or vendors as HIPAA compliant. Compliance depends on how a covered entity or business associate implements the Privacy, Security, and Breach Notification Rules, including a documented risk analysis, safeguards, business associate agreements, and policies. Third-party audits can show readiness but are not government certification.
- When does a health app have to comply with HIPAA?
- A health app must comply with HIPAA when the app creates, receives, stores, or transmits protected health information for a covered entity, such as a healthcare provider or health plan, or acts as a business associate of one. A consumer health app used independently by individuals is usually outside HIPAA, but the FTC Health Breach Notification Rule and state health privacy laws can apply instead.
- What is a business associate agreement?
- A business associate agreement (BAA) is a contract required by HIPAA between a covered entity and a vendor that handles protected health information on the covered entity's behalf, or between a business associate and the business associate's subcontractors. A HIPAA app needs BAAs with every service that touches PHI, including cloud hosting, databases, messaging, video, analytics, and AI providers.
- What does the proposed HIPAA Security Rule update require?
- The HIPAA Security Rule changes proposed in January 2025 would require multi-factor authentication, encryption of electronic PHI at rest and in transit, vulnerability scanning at least every six months, penetration testing at least every 12 months, network segmentation, a technology asset inventory, and a network map of how ePHI flows. Reporting in 2026 indicates the final rule has been pushed back to July 2027.
- Can a HIPAA app use AI or LLM services?
- A HIPAA app can use AI or LLM services with protected health information only when the AI provider signs a business associate agreement covering the specific service, and the integration follows minimum necessary access, logging, and retention controls. Where no BAA is available, the app must send only de-identified data or keep PHI away from the AI service.