HIPAA for software teams
What the HIPAA Privacy, Security and Breach Notification Rules ask of a product that handles US health data, and the engineering controls that make it possible to meet them.
What HIPAA is
Health Insurance Portability and Accountability Act of 1996 (45 CFR Parts 160 and 164)
HIPAA is a US federal law from 1996. For software teams, the parts that matter are the rules the Department of Health and Human Services (HHS) wrote under it, in 45 CFR Parts 160 and 164: the Privacy Rule, the Security Rule and the Breach Notification Rule.
Together they protect protected health information (PHI): health information that can be tied to a person and is held or sent by a covered entity or a business associate. The Security Rule applies to PHI in electronic form, often called ePHI.
HIPAA does not certify software. There is no official "HIPAA certified" badge. What the law regulates is the organisations that handle PHI. Software helps them comply by making access control, audit logs, encryption and breach response possible and easy.
Who it applies to
Covered entities
Health plans, health care clearinghouses, and health care providers who send health information electronically in standard transactions such as claims and eligibility checks.
Business associates
Vendors that create, receive, keep or send PHI for a covered entity: cloud hosts, billing companies, data platforms and software vendors with access to PHI. They sign a business associate agreement (BAA) and must meet the Security Rule themselves.
Subcontractors
A business associate's own vendors that touch PHI are business associates too. The BAA chain runs all the way down, so your hosting, email, SMS and support tools may all need one.
A consumer health app that collects data straight from users, and does not work for a covered entity, is often outside HIPAA. Other rules can still apply, such as the FTC Health Breach Notification Rule and state health privacy laws.
Key requirements, and what they mean for the build
Each row links the official text. Read the source for the exact wording before you rely on it.
Know what counts as PHI
Defines PHI, covered entity and business associate. Whether HIPAA applies starts here.
Map every data store, queue, log and third-party service that holds PHI before you design anything else.
Source: 45 CFR 160.103: definitions
Administrative safeguards
A risk analysis and risk management plan, workforce access rules, security incident procedures and a contingency plan.
Keep a written risk analysis for the system, run backups with a tested restore, and have a runbook for security incidents.
Physical safeguards
Controls on facilities, workstations and devices and media that hold ePHI.
Mostly covered by your cloud provider under its BAA. Your part: managed laptops with disk encryption, and no PHI on personal devices.
Technical safeguards
Access control (unique user IDs, emergency access, automatic logoff, encryption), audit controls, integrity, authentication and transmission security.
Unique logins with MFA, role-based access, session timeouts, an audit log of PHI access, and encryption at rest and in transit.
Business associate agreements
A covered entity may share PHI with a business associate only under a written contract with set safeguards.
Use only vendors that sign a BAA for the services you use, and keep PHI out of every tool that does not.
Policies and documentation
Written policies and procedures, kept for six years from when they were created or last in effect.
Keep security decisions, risk analyses and change records where they can be found again, not in chat threads.
Minimum necessary
Use, share and ask for only the minimum PHI needed for the purpose. Treatment between providers is an exception.
Role-based screens that show each user only the fields their job needs, and APIs that return only what the caller is allowed to see.
Source: 45 CFR 164.502: uses and disclosures, minimum necessary
De-identification
Data is no longer PHI once it is de-identified, by removing 18 listed identifiers (Safe Harbor) or by an expert's determination.
De-identify data before it goes to analytics, test environments or AI training, and keep the re-identification key apart.
Right of access
People can ask for a copy of their PHI, in the form they ask for when it can readily be produced.
Build a patient export, in electronic form, so access requests are a click and not a project.
Source: 45 CFR 164.524: right of access
Breach notification
Tell affected people without unreasonable delay and within 60 days of discovering a breach, tell HHS, and tell the media when more than 500 residents of a state are affected.
Audit logs good enough to tell who saw what, and an incident runbook with the notification clock built in.
Engineering controls for HIPAA
How the rules change the way the software is designed.
- 01
PHI data map
A list of every place PHI lives or passes through, kept up to date as the system changes. It drives every other control.
- 02
Encryption
TLS for all traffic and encryption at rest for databases, files and backups, with keys in a managed key service.
- 03
Access control
Unique logins, MFA, roles that follow job duties, automatic logoff, and a logged break-glass path for emergencies.
- 04
Audit log
Who read or changed which record and when, written to storage that application users cannot edit, and kept long enough to investigate.
- 05
PHI out of side channels
No PHI in logs, URLs, error reports, analytics events, push notifications or email subject lines. These are where leaks usually happen.
- 06
Vendors under a BAA
Hosting, email, SMS, support, error tracking and any AI model provider that sees PHI. If a vendor will not sign, it does not get PHI.
- 07
De-identified test data
Development and test environments use synthetic or de-identified data, never a copy of production.
- 08
Backups and recovery
Automated backups, a restore that has been tested, and a plan for running in emergency mode.
What to watch
In January 2025 HHS proposed changes to the Security Rule, such as making most "addressable" safeguards required. Check whether a final rule has been published before planning around it.
Checked against the official sources on 2026-10-25.
8 OceanLab product builds cite HIPAA
Counted from our published case studies: a build counts when HIPAA is in the list of rules it was built for.
Sutura - HIPAA-Compliant Patient Data Hub over HL7 and FHIR
Designed and built a clickable patient data hub for a US health system running Epic, Oracle Health, athenahealth and eClinicalWorks: a live monitor for every HL7 v2, FHIR and HIE feed, one matched enterprise patient with a provenance-tagged record, and a duplicates queue where a person decides every uncertain match.
Loupe - Ophthalmology EHR with Per-Eye Charting and Laterality-Aware Coding
Designed and built a clickable ophthalmology EHR for a US eye care group with seven clinics: a clinician's day at a glance, a live patient flow board with dilation timers, patient search with break-the-glass access, a chart summary with right-eye and left-eye findings side by side, and a structured exam workspace per eye.
Headgate - FHIR Interoperability API Platform for Claims, Clinical Data and Prior Authorization
Designed and built a clickable console for the FHIR APIs a US regional health plan must run under federal interoperability rules: API health across Patient Access, Provider Directory, Formulary, Provider Access, Payer-to-Payer and Prior Authorization, a security review queue for third-party apps, and one clock for every prior authorization request, however it arrived.
Waypost - Remote Patient Monitoring Platform with Risk-Sorted Alerts
Designed and built a clickable remote patient monitoring platform for a US cardiology and primary care group: home blood pressure, weight and SpO2 readings from cellular devices, a risk-sorted alert queue for nurses, triage with the practice's protocol on screen, and live progress toward each patient's Medicare RPM billing requirements.
Sidehill - Benefits Administration Platform for Enrollment, Life Events and Carrier Feeds
Designed and built a clickable benefits administration platform for a Colorado outdoor gear manufacturer with about 1,800 employees: open enrollment with completion by location and language, one queue for new hires and life events, event decisions checked against Section 125 rules, and an employee benefits record that ties elections to carrier files, ACA codes and payroll deductions.
Chaffline - E-Discovery Search and Document Review Platform
Designed and built a clickable e-discovery platform for a Chicago litigation support firm that hosts and reviews data for US law firms: a dashboard across every matter, each matter's path from collection to production, Boolean, proximity and concept search, and a review pane where contract reviewers code documents with the privilege basis recorded at the moment of the call.
Check your product
Other frameworks and industries
Build with HIPAA in mind from day one
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
HIPAA questions
Is there a HIPAA certification for software?
No. HHS does not certify software or vendors. Some companies get third-party audits or attestations that map to HIPAA, but compliance is about how the covered entity and its business associates handle PHI, not a badge on the product.
Does HIPAA require encryption?
Encryption is an "addressable" safeguard under 45 CFR 164.312. You must use it, or document why an equal measure is reasonable for you. In practice nearly every team encrypts, and breached data that was properly encrypted can fall outside the breach notification duty.
Can we send PHI to an AI model?
Only to a provider that signs a BAA covering that service, and only the minimum PHI the task needs. Otherwise de-identify the data first. Also check that prompts and outputs are not kept or used for training outside the agreement.
Do we need a BAA with our cloud provider?
Yes, if the provider stores or processes PHI for you. The large cloud providers offer BAAs, but they cover only listed services, so check each service you use against the list.
How does OceanLab approach HIPAA on a build?
We map where PHI goes first, then design access control, audit logs and encryption around that map, and keep PHI out of logs, analytics and test data. The builds below list HIPAA in the rules they were built for.
Official sources
- 45 CFR 160.103: definitions
- 45 CFR Part 164 Subpart C: Security Rule
- 45 CFR 164.308: administrative safeguards
- 45 CFR 164.310: physical safeguards
- 45 CFR 164.312: technical safeguards
- 45 CFR 164.314: business associate contracts
- 45 CFR 164.316: policies and documentation
- 45 CFR 164.502: uses and disclosures, minimum necessary
- 45 CFR 164.514: de-identification
- 45 CFR 164.524: right of access
- 45 CFR Part 164 Subpart D: Breach Notification Rule
