09:06 AM
Jason Wang
Jason Wang
Connect Directly

HIPAA Compliance: What Every Developer Should Know

Apple Health and Google Fit have spurred a surge of interest in health apps. Here's what developers need to understand about HIPAA compliance.

9 Mobile Apps To Get You Fit
9 Mobile Apps To Get You Fit
(Click image for larger view and slideshow.)

The recent launches of Apple Health and Google Fit have stirred a lot of interest in health app development. If you're developing a healthcare-focused mobile application or software for wearable devices, it's important that you understand the laws around protected health information (PHI) and HIPAA compliance. While not all healthcare applications fall under HIPAA rules, those that collect, store, or share personally identifiable health information with covered entities (such as doctors and hospitals) must be HIPAA-compliant.

HIPAA was written nearly 20 years ago, before mobile health applications were ever envisioned. Because of this, some areas of the law make it hard to determine which apps must be HIPAA-compliant and which are exempt. Below are some considerations developers must address to determine whether their healthcare apps must be HIPAA-compliant or not.

Mobile devices and data security
Considering the numerous ways security breaches can occur with a mobile device, it's no wonder government entities like the US Department of Health and Human Services are leery about how PHI is handled on smartphones and wearables.

[Privacy violations are on the rise throughout the healthcare industry. Read HIPAA Complaints Vex Healthcare Organizations.]

If your application is going to send or share health data to a doctor, hospital, or other covered entity, it must be HIPAA-compliant. Adhering to the Privacy and Security Rules of HIPAA is essential, especially considering the dangers that come with handling protected health data on a device:

  • Phones, tablets, and wearables are all easily stolen and lost, meaning PHI could be compromised.
  • Social media and email are easily accessible by the device, making it easy for users to post something that breaches HIPAA privacy laws.
  • Push notifications and other user communications can violate HIPAA laws if they contain PHI.
  • Users may intentionally or unintentionally share personally identifiable information, even if your app's intended use doesn't account for it.
  • Not all users take advantage of the password-protected screen-lock feature, making data visible and accessible to anyone who comes in contact with the device.
  • Devices like the iPhone do not include physical keyboards, so users are more likely to use basic passwords that are not as safe as complex options.

While not all of these factors are under your control as a developer, it's important to take all the steps possible to comply with HIPAA guidelines.

Determining if an app must be HIPAA-compliant
Not all health-related apps must be HIPAA-compliant. In fact, most apps in the market today are not. Fortunately, it's easy to determine whether or not your app must be compliant.

The information that does need to be compliant is personal information that directly identifies an individual and that is -- or can be -- transmitted to a covered entity. This protected health information can include everything from medical records and images to scheduled appointment dates.

If your app is used to record and share patient information with a covered entity in any way, it must be HIPAA-compliant.

On the other hand, your app probably does not need to be HIPAA-compliant if it performs tasks such as the following:

  • Allows users to record their weight and exercise routines
  • Gives users access to medical reference information
  • Lets average users look up illness information
  • Defines various illnesses or diseases
  • Lets users keep up with their daily diets

If the app is to be used by average people (as opposed to medical personnel or staff and contractors of covered entities), then it likely does not need to be HIPAA-compliant.

But not all apps used by medical personnel need to be compliant. For example, applications that let doctors or other professionals

look up disease information do not need to be HIPAA-compliant. However, if the app allows the doctor to record disease information about a specific patient, it must be compliant.

What does a mobile app need to be HIPAA-compliant?
If you determine that your app must be compliant, you need to learn the HIPAA requirements for developers. Here are some of the basic things your app will need to include:

  • Secure access to PHI via unique user authentication
  • Encryption of data that will be stored
  • Regular safety updates to protect from any breaches
  • A system to audit the data and ensure that it hasn't been accessed or modified in any unauthorized way
  • A mobile wipe option that allows PHI to be wiped if the device is lost
  • Data backup in case of a device loss, failure, or other disaster

For more information, see the complete list of requirements for HIPAA-compliant mobile applications.

Keeping PHI out of your application is the easiest way to avoid potential breaches of that information while reducing the technical debt required to build and maintain compliant systems.

Developers should never use third-party file storage and hosting platforms unless the providers explicitly state they are HIPAA-compliant and agree to sign a Business Associate Agreement. However, it is very important to research these carefully if you plan to use one for any data stored for a HIPAA-covered app. HIPAA-compliant hosting providers such as Amazon and Firehost take care of the Physical Safeguard requirements of HIPAA, but simply using HIPAA hosting does not make your app compliant. Any service providers that you use for any part of your app must also be HIPAA-compliant themselves and willing to sign a Business Associate Agreement.

No Safe Harbor for protected health information
Many developers don't realize that, unlike the DMCA, there is no Safe Harbor clause for HIPAA. Even if your application is not intended to store or transmit protected health information, it can still be in violation of HIPAA. PHI breaches are major violations that carry hefty fines. Simply refusing to sign a Business Associate Agreement, or ignoring the data flowing through your application, won't absolve you from the requirements of the law.

If you are unsure about whether your app needs to be compliant, consider implementing HIPAA compliance practices to protect your business. Also, check out the US Department of Health and Human Services website, which provides some great resources for developers.

Medical data breaches seem to show up on the 6 o'clock news almost every week. If you think it couldn't happen to you -- or the financial impact would be minor -- think again. Download the Healthcare Data Breaches Cost More Than You Think report today. (Free registration required.)

Jason Wang is the founder and CEO of TrueVault, a data security company that is transforming how companies handle personal data. Businesses use personal data to shape customer experience, but security risks mount as more sensitive data is collected. TrueVault tackles this ... View Full Bio
We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Email This  | 
Print  | 
More Insights
Copyright © 2019 UBM Electronics, A UBM company, All rights reserved. Privacy Policy | Terms of Service