Does my app need to be HIPAA compliant?
Only if it creates, receives, keeps or sends protected health information as a HIPAA covered entity or on behalf of one. If you build software that clinics, health plans or their vendors use to handle patient data, you are almost certainly a business associate and HIPAA applies. A consumer health app people sign up for on their own is often outside HIPAA, but other rules can still apply.
Last updated
Check these three questions in order
- 1Is your company a covered entity? That means a health plan, a healthcare clearinghouse, or a healthcare provider that sends standard electronic transactions such as insurance claims.
- 2If not, do you handle health data on behalf of a covered entity or another business associate? If yes, you are a business associate and need a BAA.
- 3Is the data PHI? It is if it is health information linked to an identifier and held for one of the organisations above. Properly de-identified data is not.
If HIPAA applies, what it means for the software
The Security Rule asks for administrative, physical and technical safeguards for electronic PHI, based on a risk analysis. In practice that shapes the build: access control with unique user IDs, audit logs, encryption, automatic logoff, backups, a breach response process and BAAs with every vendor in the data path, including hosting, email, logging and any AI API.
If HIPAA does not apply
Health data outside HIPAA is not unregulated. In the US, the FTC Health Breach Notification Rule covers many health apps that are not covered by HIPAA, and several states have their own consumer health data laws. Outside the US, laws like the GDPR treat health data as a special category.
Check it for your case.
Read the official text.
- 45 CFR 160.103, Definitions (eCFR)checked 2026-10-25
- 45 CFR Part 164 Subpart C, the HIPAA Security Rule (eCFR)checked 2026-10-25
- 45 CFR 164.504(e), Business associate contracts (eCFR)checked 2026-10-25
- 16 CFR Part 318, FTC Health Breach Notification Rule (eCFR)checked 2026-10-25
Common follow-up questions.
Is there an official HIPAA certification for apps?
No. HHS does not certify software as HIPAA compliant. Vendors may have third-party assessments, but compliance depends on how the software is built and used.
Can I use an AI API with PHI?
Only if the provider signs a BAA covering the service you use, and you apply the same safeguards as for any other vendor. Check which plans and endpoints the BAA covers.
Does a wellness or fitness app need HIPAA?
Usually not, if consumers use it directly and it is not offered on behalf of a covered entity. If a health plan or provider offers it to their patients and data flows back to them, that can change.
Related questions and guides.
- Is my AI system high-risk under the EU AI Act?Question
- Who owns the code when you hire a software agency?Question
- How do I reduce LLM API costs?Question
- AI agent vs workflow automationComparison
- RAG vs fine-tuningComparison
- GlossaryEvery term, in plain words.
- HIPAA guideWho HIPAA applies to and what it asks of software.
- Compliance guidesWhat each rule means for the software you build.
- Software for clinicsClinic systems, the rules that apply and how they are built.
