Key takeaways
- HIPAA protects PHI (Protected Health Information) — all information that can help identify the patient, such as a name, date of birth, SSN number, and phone.
- HIPAA-compliant app development services will cost you $55 250 and will take approximately 5 months.
- HIPAA-compliant mobile apps require commitment, regular maintenance, and support, to make sure your safeguards stay up-to-date and patient information is protected.
What is HIPAA
HIPAA stands for Health Insurance Portability and Accountability Act. It was passed by the U.S. Congress in 1996 to protect the medical records and the personal health information of patients.
HIPAA is a federal law in America, which means it is applied in all 50 states. Regardless of where your company is registered or what state you operate in, you must consider both federal and local regulations.
The main goal of HIPAA is to make sure the details about one’s health are confidential. Therefore HIPAA apply to PHI (Protected Health Information) — all information that can help identify the patient, such as a name, date of birth, SSN number, and phone.
HIPAA–compliant mobile apps promise users that their sensitive data is under reliable protection. HIPAA-covered entities must have a business associate agreement with every partner to maintain PHI data security and be HIPAA compliant.
HIPAA basics
All you need to know about HIPAA and compliant software development in this article. But if we had to summarize it in 2 quick points, that’s what it would be:
- HIPAA rules protect patient confidentiality;
- HIPAA rules are American law, so all entities working in that jurisdiction should comply.
HIPAA glossary
It might sound obvious, but HIPAA-compliant software development includes a lot of new terms and definitions. Even if you come from a medical background or have other projects in the healthcare industry, some of these expressions might be totally unfamiliar. Here are the 5 most HIPAA important terms + definitions.
| Term | Definition |
| Authorization | Signed permission that allows covered entities, such as doctors and hospitals, to disclose patient information. |
| Covered entity | Business associates and partners who collect personal patient information and fall under the regulations. |
| Non-covered entity | An individual, business, or agency that is NOT a health care provider. |
| EHR, electronic health records | Electronic version of patient’s medical history. |
| PHI, protected healthcare information | Personal and health data of a patient that is protected under HIPAA. |
Protected health information (PHI) under HIPAA
Protected health information includes all data that can identify the patient. So, long story short, anything unique to a patient — name, personal number, SSN, and other pieces of information. We’ll dive deeper later in this article.
Covered entities
This term might need extra explanation too — covered entities are defined as:
- health plans,
- healthcare clearinghouses,
- health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards.
In short, covered entities include hospitals, doctors, dentists, chiropractors, insurance companies, and others. The HIPAA privacy rule applies to all covered entities.
For startup and product owners, it’s important to understand that most health apps are not covered entities under the HIPAA security rule. But they still have to comply.
Why is HIPAA compliance vital for medical apps
HIPAA privacy rules are important not just because the law says so. They are important because they actually protect parties, and benefit both patients and hospitals. Let’s look at it closer.
For patients
For patients, HIPAA is a synonym of trust. If a doctor is compliant with HIPAA, it guarantees data integrity and security of all personal data.
For healthcare providers
Standards like HIPAA rules help healthcare providers standardize their services, and data integrity, improve efficiency of the processes, eliminate fraud, and prevent risks of data breaches. On top of that, HIPAA develops trust between a doctor and a patient. Would you rather go to a clinic with a HIPAA certificate or to a place that has no guarantees your data won’t be stolen?
For startup owners
Fines for noncompliance can destroy early-stage startups. If you ignore HIPAA regulations, you will have to pay from $100 to $50,000 per violation with a maximum fine of $1.5 million per year. Some violations can even result in jail time.
If you don’t want to have trouble with the law — and no one does — it is crucial to know about HIPAA requirements.
What does HIPAA compliance for health applications mean for developers
There are 3 types of requirements for developing a HIPAA-compliant app: administrative, physical, and technical safeguards. All of them regulate access control and data sharing. Let’s review all HIPAA requirements in detail and discuss possible safety measures for the app.
Administrative requirements
These refer to internal regulations that can be implemented by startup owners, hospitals, and healthcare providers during app development to ensure data privacy and security. For example, regular employee training and risk assessments. Administrative security measures can include:
- Regular system audits;
- Penalties for employees who fail to comply with HIPAA regulations;
- Periodical security reminders;
- Designated HIPAA supervisors on a team.
Physical safeguards
Physical safeguards refer to real-world policies that protect physical access to buildings, workstations, computer servers, and networks. Their main goal is to monitor who accesses the data in a HIPAA–compliant app to prevent potential violations and unauthorized users. Such security measures for HIPAA compliance software development include:
- Building security;
- Access control (for example, door passes and visitor log-in);
- Emergency protocols if something goes south;
- Procedures for data and device disposal.
Technical safeguards
The main problem for HIPAA violation is device theft — when your phone gets stolen, all information on it gets into the hands of scammers. Technical requirements ensure that personal information in the HIPAA–compliant software is secured on the backend and will remain confidential even if someone takes your device.
Technical safeguards in the HIPAA–compliant app development help to reduce data misuse and identity thefts or fraud. They include:
- Unique user identification (for example, a unique name or an account number);
- Automatic logout due to inactivity;
- Emergency access procedures;
- Encryption of electronic protected health information;
- Protected data transfer networks;
- Regular audit of information systems;
- Password management;
- Two-factor authentication to verify who opens the app.
Babylon asks users to set up a PIN code in order to use the app. Face ID is optional
What happens if you fail HIPAA compliance
If you fail to secure HIPAA privacy for consumer health information, it will have major consequences.
First, the law requires you to notify users about the breach, specify what information leaked, and explain potential risks. If it influences more than 500 people, the startup must also notify media outlets. Just imagine all the bad PR that can come out of this and to what extent it can damage your business.
Secondly, the HIPAA application owner can be liable for fines and penalties that can put a burden on financial management, especially for startups at early stages.
To prevent this, proper planning and knowledge of HIPAA compliance are required.
What data is subject to HIPAA regulations
The law references PHI — Protected Health Information. All data that can identify a particular user is protected under HIPAA requirements. It includes:
💁♂️ Names
Full, first or last name, and initials would be protected by HIPAA regulations if it is accompanied by consumer health information.
🌎 All geographical identifiers
Everything smaller than a state, for example, your city, county or neighborhood. But there is one exception: the first three digits of a zip code. So, the user’s address or place of birth would be covered.
📅 Dates
All dates, other than the year, are directly related to a user. For example, date of birth (if a patient is over 89 years old), as well as death date, and admission or discharge date.
📞 Phone numbers
Have you ever gotten a spam call and wondered where they got your number? Definitely not from your healthcare provider, because it would be a serious HIPAA violation. Also, if someone is too old-school to use fax these days, its number is considered to be a part of the PHI–covered entities.
💌 Email addresses
It is self-explanatory — email can also identify a patient, so it is protected under HIPAA.
🔒 Social Security number
Breached Social Security numbers can lead to identity theft and other serious consequences.
🩺 Medical record numbers
The number consists of six digits and appears on most healthcare documents: bills, visit summaries, or referrals. It helps healthcare providers access patients’ electronic records.
🏥 Health insurance information
Name of the provider, patient ID, and group number — all are confidential and should be protected under HIPAA.
😎 Account number
This number is assigned by healthcare organizations during a medical visit and is also subject to HIPAA protection.
👩🏻⚕️Certificate or license numbers
HIPAA protects doctors as well — their educational and professional documents fall under the HIPAA compliance rules.
🚗 Vehicle information
Covered entities include a driver’s license number, license plate number, or the serial number of a car.
🦾 Device identifiers and serial numbers
If a user wears medical devices, for example, insulin pumps or health rate monitors, their serial numbers would be also considered confidential patient data.
🧑🏻💻Web URLs
Any URL that can be associated with patients needs to be protected. Don’t overlook it during HIPAA–compliant app development.
💻 IP addresses
An IP address identifies a device that accesses your mHealth app and, in the wrong hands, it can be traced to someone’s smartphone or laptop.
✋Biometric data
Many healthcare organizations use biometric data scans to link an account to a specific user once and for all. Everyone has unique fingerprints, so if a patient adds them to their account, no one else can access the information. Covered entities here include a finger, retinal, voice prints, and other biometric identifiers.
📸 Photos or videos
This refers to any picture showing the full face of an individual, and he or she can be identified, but also a photo with identifiable PHI — a name, initials, or a patient number.
🕵️♀️Any other identifying details
All other characteristics and unique codes can point out specific individuals and disclose their medical information.
Important note: Demographic data, for example, name, date of birth, or insurance information are only protected when they are used in combination with medical information
Should your mHealth app be HIPAA-compliant
Not all healthcare mobile and web solutions must be HIPAA compliant. For example, most yoga, meditation, or any other health app do not fall under the privacy act, because your identifiable information is for personal use. It is not intended to be shared with healthcare providers.
The HIPAA Act only applies to the platforms that share your medical information with “covered entities” — other parties, for example, doctors, dentists, hospitals, and health insurance companies. They must use HIPAA-compliant software.
To check if the law applies to your startup, you need to answer three questions about your healthcare app:
If you answer “yes” to all questions, you need a HIPAA-compliant mobile app.
Other data protection laws in the U.S.
The United States does not have national privacy and data protection laws, like GDPR in the European Union. But there are many detailed regulations focused on specific data types. Let’s take a look at some of them that can apply to your mobile app.
FTC Act
The FTC (Federal Trade Commission Act) protects users from “anticompetitive, deceptive, and unfair business practices.” Essentially, it requires you to be honest and upfront with users about the way you manage their information, as well as to notify users when their data is breached.
State laws
Some states have their own laws about data privacy. For example, New York introduced the SHIELD Act. It applies to any app that owns the private information of a New York resident. In short, even if you don’t operate in New York, it is likely the SHIELD Act still applies to you if you have at least one user from the city. The act requires mobile apps to adopt certain administrative, technical, and physical safeguards for data protection.
California also has a data privacy law for the residents — the Consumer Privacy Act (CCPA). Under it, users have the right to know what information an app collects, the right to request information to be deleted and the right to opt-out of sharing data.
Important reminder: check data privacy laws in the states you operate in. California, Illinois, Colorado, Utah, Virginia, and Connecticut regulate the sensitive data of their residents.
How to apply HIPAA to your mobile app development
For startups in the healthcare industry, the knowledge of HIPAA regulation is a must to avoid huge fines and tough penalties. To ensure that the personal health data of your users is protected and to make your app HIPAA compliant, we recommend these 4 steps.
Do your research
First things first, make sure to educate yourself about all possible laws, HIPAA compliance, and other data privacy regulations your app can fall under the HIPAA law. If your contractor makes a mistake, your startup will have to pay for it with money and reputation. To prevent this from happening, do your own research beforehand and learn about the subject — all information is accessible online.
Evaluate patient health data
Together with your software development team, take a look at the types of personal data you use and decide what features and safeguards are needed for the solution to ensure HIPAA compliance. You can also use our checklist to make sure you include everything.
Use HIPAA-compliant consultants if needed
There are third-party companies that can help your startup be HIPAA compliant. For example, they help with collecting and storing patient data, as well as staff training and expert guidance. Such companies include HIPAA consultants and audit firms.
Work with experienced developers
The professional team is crucial for HIPAA–compliant app development because it helps to minimize the risk of mistakes. Choose wisely, read reviews from previous clients, and check the portfolio of your future developer. Make sure the team has had relevant experience before — the healthcare industry is a serious field and there is no room to experiment.
How much does it cost to develop a HIPAA-compliant app
Here comes the most burning question: how does all that impact the prices of your product and how much does developing HIPAA-compliant apps usually cost?
Let’s crunch the numbers for a similar HIPAA–compliant project we developed.
🚨Disclaimer: This is an estimation for app development with our team and we don’t guarantee other companies have the exact costs or timelines.
| Stage | What are we doing | Est. hours | Est. weeks | Est. cost |
| Initial meeting | Discuss the idea of your app | 1 day | – | No costs |
| UI/UX design | Map users’ journeys, create interface mock-ups | 125 hours | 5 weeks | $6 300 |
| Software development | Work on your healthcare app | 860 hours | 10 weeks | $38 700 |
| QA Testing | Find and fix bugs | 300 hours | In parallel with development | $6 000 |
| Project management | Manage software development project and solve administrative tasks | 16 (in weeks) | During the whole project | $4 250 |
Overall, building a HIPAA-compliant app will cost you $55 250 and will take approximately 5 months.
Curious about how much your specific idea will cost? Fill in the form to get a quote.
5 steps to make HIPAA compliant apps
Step 1: Start with a solid idea. A HIPAA–compliant mobile app starts with a creative and definite idea that will help you stand out in the marketplace. Before planning the platform, think about your target audience and how your solution will help them. Who is your user? What makes you different? How will your app make money? These questions are to start exploring the idea and turning it into a business plan.
Step 2: Select a team. The right choice of developer matters. An experienced and skillful team can strengthen your idea of a HIPAA–compliant app, assist in data privacy analysis, and help you achieve the desired results. Take your time when choosing a developer, check the portfolio with relevant cases, and verify the credentials from previous clients.
Step 3: Check if your idea falls under HIPAA-compliant applications. As we mentioned previously, not all applications with medical data fall under the HIPAA Act. It depends on what information you collect and how you treat it. Verify all the requirements before you build a HIPAA–compliant app.
If you fall under the HIPAA Act, don’t forget to ask users to accept the HIPAA Privacy Notice — just like Babylon does
Step 4: Develop an MVP. MVP is a helpful tool for startup founders. It stands for a minimum viable product and it helps to test an idea with real-world customers. Don’t confuse this stage with a prototype or a draft: MVP is a fully-functioning product, just the set of features is temporarily limited. However, they are enough for a user to complete a journey and provide you with feedback.
Step 5: Improve and launch the product. After you receive feedback from the customers and analyze data, it is time to improve and grow. The team will help you plan future healthcare software development and possible scale-up, provide post-launch support for your HIPAA–compliant app, release updates, and fix any issues.
Let’s wrap up
For startup owners, it is important to understand that HIPAA compliance is not a one-time thing, but an ongoing process.
HIPAA–compliant application requires commitment, regular maintenance, and support, to make sure your safeguards stay up-to-date and patient information is protected. Any breach of data can cost a lot of money and a big chunk of the reputation of a startup. Therefore, it is better to plan attentively, anticipate challenges, and stop them in the bud.
Our experience
At Purrweb, we specialize in mobile and web development with a focus on user-friendly UI/UX design and habit-forming interfaces. We have some experience with mHealth and data laws-compliant apps.
Online psychotherapy app design
One of our projects wasan online psychotherapy app, a telemedicine service for the UK market. Our team selected a reliable tech stack and encryption to make sure data protection met the requirements of both American HIPAA and European GDPR.
If you have been thinking about developing HIPAA-compliant healthcare apps, we will be happy to help and share our experience.
Bonus: HIPAA compliance checklist
We put together a checklist that will help you check if your app has the most of these technical safeguards:
✅ Unique username or account number
✅ Emergency access to information
✅ Automatic logout when the user is inactive
✅ Encryption and decryption of sensitive data
✅ Automatic check-ups of information systems
✅ ePHI integrity policies
✅ Passcode and two-factor authentication
✅ Transmission data security measures
