The recent launches of Apple Health and Google Fit have stirred a lot of interest in health app development. If you're developing a healthcare-focused mobile application or software for wearable devices, it's important that you understand the laws around protected health information (PHI) and HIPAA compliance. While not all healthcare applications fall under HIPAA rules, those that collect, store, or share personally identifiable health information with covered entities (such as doctors and hospitals) must be HIPAA-compliant.
HIPAA was written nearly 20 years ago, before mobile health applications were ever envisioned. Because of this, some areas of the law make it hard to determine which apps must be HIPAA-compliant and which are exempt. Below are some considerations developers must address to determine whether their healthcare apps must be HIPAA-compliant or not.
Mobile devices and data security
Considering the numerous ways security breaches can occur with a mobile device, it's no wonder government entities like the US Department of Health and Human Services are leery about how PHI is handled on smartphones and wearables.
[Privacy violations are on the rise throughout the healthcare industry. Read HIPAA Complaints Vex Healthcare Organizations.]
If your application is going to send or share health data to a doctor, hospital, or other covered entity, it must be HIPAA-compliant. Adhering to the Privacy and Security Rules of HIPAA is essential, especially considering the dangers that come with handling protected health data on a device:
While not all of these factors are under your control as a developer, it's important to take all the steps possible to comply with HIPAA guidelines.
Determining if an app must be HIPAA-compliant
Not all health-related apps must be HIPAA-compliant. In fact, most apps in the market today are not. Fortunately, it's easy to determine whether or not your app must be compliant.
The information that does need to be compliant is personal information that directly identifies an individual and that is -- or can be -- transmitted to a covered entity. This protected health information can include everything from medical records and images to scheduled appointment dates.
If your app is used to record and share patient information with a covered entity in any way, it must be HIPAA-compliant.
On the other hand, your app probably does not need to be HIPAA-compliant if it performs tasks such as the following:
If the app is to be used by average people (as opposed to medical personnel or staff and contractors of covered entities), then it likely does not need to be HIPAA-compliant.
But not all apps used by medical personnel need to be compliant. For example, applications that let doctors or other professionals
look up disease information do not need to be HIPAA-compliant. However, if the app allows the doctor to record disease information about a specific patient, it must be compliant.
What does a mobile app need to be HIPAA-compliant?
If you determine that your app must be compliant, you need to learn the HIPAA requirements for developers. Here are some of the basic things your app will need to include:
For more information, see the complete list of requirements for HIPAA-compliant mobile applications.
Keeping PHI out of your application is the easiest way to avoid potential breaches of that information while reducing the technical debt required to build and maintain compliant systems.
Developers should never use third-party file storage and hosting platforms unless the providers explicitly state they are HIPAA-compliant and agree to sign a Business Associate Agreement. However, it is very important to research these carefully if you plan to use one for any data stored for a HIPAA-covered app. HIPAA-compliant hosting providers such as Amazon and Firehost take care of the Physical Safeguard requirements of HIPAA, but simply using HIPAA hosting does not make your app compliant. Any service providers that you use for any part of your app must also be HIPAA-compliant themselves and willing to sign a Business Associate Agreement.
No Safe Harbor for protected health information
Many developers don't realize that, unlike the DMCA, there is no Safe Harbor clause for HIPAA. Even if your application is not intended to store or transmit protected health information, it can still be in violation of HIPAA. PHI breaches are major violations that carry hefty fines. Simply refusing to sign a Business Associate Agreement, or ignoring the data flowing through your application, won't absolve you from the requirements of the law.
If you are unsure about whether your app needs to be compliant, consider implementing HIPAA compliance practices to protect your business. Also, check out the US Department of Health and Human Services website, which provides some great resources for developers.
Medical data breaches seem to show up on the 6 o'clock news almost every week. If you think it couldn't happen to you -- or the financial impact would be minor -- think again. Download the Healthcare Data Breaches Cost More Than You Think report today. (Free registration required.)Jason Wang is the founder and CEO of TrueVault, a data security company that is transforming how companies handle personal data. Businesses use personal data to shape customer experience, but security risks mount as more sensitive data is collected. TrueVault tackles this ... View Full Bio