HIPAA Compliance: What Every Developer Should Know

Apple Health and Google Fit have spurred a surge of interest in health apps. Here's what developers need to understand about HIPAA compliance.

Jason Wang, Founder & CEO, TrueVault

July 11, 2014

2 Min Read

look up disease information do not need to be HIPAA-compliant. However, if the app allows the doctor to record disease information about a specific patient, it must be compliant.

What does a mobile app need to be HIPAA-compliant?
If you determine that your app must be compliant, you need to learn the HIPAA requirements for developers. Here are some of the basic things your app will need to include:

  • Secure access to PHI via unique user authentication

  • Encryption of data that will be stored

  • Regular safety updates to protect from any breaches

  • A system to audit the data and ensure that it hasn't been accessed or modified in any unauthorized way

  • A mobile wipe option that allows PHI to be wiped if the device is lost

  • Data backup in case of a device loss, failure, or other disaster

For more information, see the complete list of requirements for HIPAA-compliant mobile applications.

Keeping PHI out of your application is the easiest way to avoid potential breaches of that information while reducing the technical debt required to build and maintain compliant systems.

Developers should never use third-party file storage and hosting platforms unless the providers explicitly state they are HIPAA-compliant and agree to sign a Business Associate Agreement. However, it is very important to research these carefully if you plan to use one for any data stored for a HIPAA-covered app. HIPAA-compliant hosting providers such as Amazon and Firehost take care of the Physical Safeguard requirements of HIPAA, but simply using HIPAA hosting does not make your app compliant. Any service providers that you use for any part of your app must also be HIPAA-compliant themselves and willing to sign a Business Associate Agreement.

No Safe Harbor for protected health information
Many developers don't realize that, unlike the DMCA, there is no Safe Harbor clause for HIPAA. Even if your application is not intended to store or transmit protected health information, it can still be in violation of HIPAA. PHI breaches are major violations that carry hefty fines. Simply refusing to sign a Business Associate Agreement, or ignoring the data flowing through your application, won't absolve you from the requirements of the law.

If you are unsure about whether your app needs to be compliant, consider implementing HIPAA compliance practices to protect your business. Also, check out the US Department of Health and Human Services website, which provides some great resources for developers.

Medical data breaches seem to show up on the 6 o'clock news almost every week. If you think it couldn't happen to you -- or the financial impact would be minor -- think again. Download the Healthcare Data Breaches Cost More Than You Think report today. (Free registration required.)

About the Author(s)

Jason Wang

Founder & CEO, TrueVault

Jason Wang is the founder and CEO of TrueVault, a data security company that is transforming how companies handle personal data. Businesses use personal data to shape customer experience, but security risks mount as more sensitive data is collected. TrueVault tackles this problem by helping companies protect, manage, and de-risk customer data, so any company can provide a personalized experience while boosting data security and reducing liability.

Prior to TrueVault, Jason was employee No. 1 and vice president of technology at ScoreBig. He built ScoreBig.com from the ground up and was a part of the team that raised more than $30 million from Bain Capital Ventures and U.S. Venture Partners. He was also a Technology Director at Razorfish/Microsoft. He holds a BS from the University of California, Irvine, in information and computer science.

Never Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.

You May Also Like

More Insights