{"head":{"title":"Does My App Need to Be HIPAA Compliant? | OceanLab","description":"Your app needs HIPAA compliance only if it handles PHI for a covered entity or as a business associate. A step-by-step check, and what applies if not.","canonical":"https://oceanlab.in/questions/does-my-app-need-hipaa"},"crumbs":[{"name":"Home","path":"/"},{"name":"Questions","path":"/questions"},{"name":"Does my app need to be HIPAA compliant?","path":"/questions/does-my-app-need-hipaa"}],"question":"Does my app need to be HIPAA compliant?","answer":["Only if it creates, receives, keeps or sends protected health information as a HIPAA covered entity or on behalf of one. If you build software that clinics, health plans or their vendors use to handle patient data, you are almost certainly a business associate and HIPAA applies. A consumer health app people sign up for on their own is often outside HIPAA, but other rules can still apply."],"sections":[{"heading":"Check these three questions in order","body":[],"bullets":[["Is your company a covered entity? That means a health plan, a healthcare clearinghouse, or a healthcare provider that sends standard electronic transactions such as insurance claims."],["If not, do you handle health data on behalf of a covered entity or another business associate? If yes, you are a business associate and need a ",{"href":"/glossary/baa","text":"BAA"},"."],["Is the data ",{"href":"/glossary/phi","text":"PHI"},"? It is if it is health information linked to an identifier and held for one of the organisations above. Properly de-identified data is not."]]},{"heading":"If HIPAA applies, what it means for the software","body":[["The Security Rule asks for administrative, physical and technical safeguards for electronic PHI, based on a risk analysis. In practice that shapes the build: access control with unique user IDs, audit logs, encryption, automatic logoff, backups, a breach response process and BAAs with every vendor in the data path, including hosting, email, logging and any AI API."]],"bullets":[]},{"heading":"If HIPAA does not apply","body":[["Health data outside HIPAA is not unregulated. In the US, the FTC Health Breach Notification Rule covers many health apps that are not covered by HIPAA, and several states have their own consumer health data laws. Outside the US, laws like the GDPR treat health data as a special category."]],"bullets":[]}],"faqs":[{"question":"Is there an official HIPAA certification for apps?","answer":"No. HHS does not certify software as HIPAA compliant. Vendors may have third-party assessments, but compliance depends on how the software is built and used."},{"question":"Can I use an AI API with PHI?","answer":"Only if the provider signs a BAA covering the service you use, and you apply the same safeguards as for any other vendor. Check which plans and endpoints the BAA covers."},{"question":"Does a wellness or fitness app need HIPAA?","answer":"Usually not, if consumers use it directly and it is not offered on behalf of a covered entity. If a health plan or provider offers it to their patients and data flows back to them, that can change."}],"terms":[{"href":"/glossary/phi","label":"PHI"},{"href":"/glossary/baa","label":"BAA"},{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II"},{"href":"/glossary/human-in-the-loop","label":"human-in-the-loop"}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/hipaa-risk-assessment","label":"HIPAA risk assessment","detail":"Free tool"},{"href":"/tools/telehealth-app-cost","label":"Telehealth app cost","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."},{"href":"/software/clinics","label":"Software for clinics","detail":"Clinic systems, the rules that apply and how they are built."}],"related":[{"href":"/questions/is-my-ai-system-high-risk","label":"Is my AI system high-risk under the EU AI Act?","detail":"Question"},{"href":"/questions/who-owns-the-code","label":"Who owns the code when you hire a software agency?","detail":"Question"},{"href":"/questions/how-to-reduce-llm-api-costs","label":"How do I reduce LLM API costs?","detail":"Question"},{"href":"/compare/ai-agent-vs-workflow-automation","label":"AI agent vs workflow automation","detail":"Comparison"},{"href":"/compare/rag-vs-fine-tuning","label":"RAG vs fine-tuning","detail":"Comparison"},{"href":"/glossary","label":"Glossary","detail":"Every term, in plain words."}],"sources":[{"title":"45 CFR 160.103, Definitions (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103","checkedAt":"2026-10-25"},{"title":"45 CFR Part 164 Subpart C, the HIPAA Security Rule (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C","checkedAt":"2026-10-25"},{"title":"45 CFR 164.504(e), Business associate contracts (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504","checkedAt":"2026-10-25"},{"title":"16 CFR Part 318, FTC Health Breach Notification Rule (eCFR)","url":"https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}