Key takeaways
-
- HIPAA protects PHI (Protected Health Information) — all information that can help identify the patient, such as a name, date of birth, SSN number, and contact info.
- HIPAA-compliant app development services will cost you $55 250 and will take approximately 5 months.
- HIPAA-compliant mobile apps require commitment, regular maintenance, and support, to make sure your safeguards stay up-to-date and patient information is protected.
What is HIPAA
HIPAA stands for Health Insurance Portability and Accountability Act. It was passed by the U.S. Congress in 1996 to protect the medical records and the personal health information of patients.
HIPAA is a federal law in America, which means it is applied in all 50 states. Regardless of where your company is registered or what state you operate in, you must consider both federal and local regulations.
The main goal of HIPAA is to make sure the details about one’s health are confidential. Therefore HIPAA apply to PHI — all information that can help identify the patient, such as a name, date of birth, SSN number, and phone.
HIPAA–compliant mobile apps promise users that their sensitive data is under reliable protection. HIPAA-covered entities must have a business associate agreement with every partner to maintain PHI data security and be HIPAA compliant.
HIPAA basics
All you need to know about HIPAA and compliant software development in this article. But if we had to summarize it in 2 quick points, that’s what it would be:
-
- HIPAA rules protect patient confidentiality;
- HIPAA rules are American law, so all entities working in that jurisdiction should comply.
HIPAA glossary
It might sound obvious, but HIPAA-compliant software development includes a lot of new terms and definitions. Even if you come from a medical background or have other projects in the healthcare industry, some of these expressions might be totally unfamiliar. Here are the 5 most HIPAA important terms + definitions.
| Term | Definition |
| Authorization | Signed permission that allows covered entities, such as doctors and hospitals, to disclose patient data. |
| Covered entity | Business associates and partners who collect personal patient information and fall under the regulations. |
| Non-covered entity | An individual, business, or agency that is NOT a health care provider. |
| EHR, electronic health records | Electronic version of patient’s medical history. |
| PHI, protected healthcare information | Personal and health data of a patient that is protected under HIPAA. |
Protected health information (PHI) under HIPAA
PHI includes all data that can identify the patient. So, long story short, anything unique to a patient — name, personal number, SSN, and other pieces of information. We’ll dive deeper into this, later in this article.
Covered entities
This term might need extra explanation too — covered entities are defined as:
-
- health plans,
- healthcare clearinghouses,
- health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards.
In short, covered entities include hospitals, doctors, dentists, chiropractors, insurance companies, among others. The HIPAA privacy rule applies to all covered entities.
For startup and product owners, it’s important to understand that most health apps are not covered entities under the HIPAA security rule. But they still have to comply.
Why is HIPAA compliance vital for medical apps
HIPAA privacy rules are important not just because the law says so. They are important because they actually protect parties, and benefit both patients and hospitals. Let’s look at it closer.
For patients
For patients, HIPAA is a synonym of trust. If a doctor is compliant with HIPAA, it guarantees data integrity and security of all personal data.
For healthcare providers
Standards like HIPAA rules help healthcare workers standardize their services, data integrity, improve efficiency of the processes, eliminate fraud, and prevent risks of data breaches. On top of that, HIPAA develops trust between a doctor and a patient. Would you rather go to a clinic with a HIPAA certificate or to a place that has no guarantees your data will be safe?
For startup owners
Fines for noncompliance can destroy early-stage startups. If you ignore HIPAA regulations, you could be fined anywhere from $100 to $25,000 per violation with a maximum fine of $1.5 million per year. Some violations can even result in jail time.
If you don’t want to have trouble with the law — and no one does — it is crucial to know about HIPAA requirements.
What does HIPAA compliance for health applications mean for developers
There are 3 types of requirements for developing a HIPAA-compliant app: administrative, physical, and technical safeguards. All of them regulate access control and data sharing. Let’s review all HIPAA requirements in detail and discuss possible safety measures for the app.
Administrative requirements
These refer to internal regulations that can be implemented by startup owners, hospitals, and healthcare providers during app development to ensure data privacy and security. For example, regular employee training and risk assessments. Administrative security measures can include:
-
- Regular system audits;
- Penalties for employees who fail to comply with HIPAA regulations;
- Periodical security reminders;
- Designated HIPAA supervisors on a team.
Physical safeguards
Physical safeguards refer to real-world policies that protect physical access to buildings, workstations, computer servers, and networks. Their main goal is to monitor who accesses the data in a HIPAA–compliant app to prevent potential violations and unauthorized users. Such security measures for HIPAA compliance software development include:
-
- Building security;
- Access control (for example, door passes and visitor log-in);
- Emergency protocols if something goes wrong;
- Procedures for data and device disposal.
Technical safeguards
The main problem for HIPAA violation is device theft — when your phone gets stolen, all information on it falls into the hands of scammers. Technical requirements ensure that personal information in the HIPAA–compliant software is secured on the backend and will remain confidential even if someone gets a hold of your device.
Technical safeguards in the HIPAA–compliant app development help to reduce data misuse and identity thefts or fraud. They include:
-
- Unique user identification (for example, a unique name or an account number);
- Automatic logout due to inactivity;
- Emergency access procedures;
- Encryption of ePHI;
- Protected data transfer networks;
- Regular audit of information systems;
- Password management;
- Two-factor authentication to verify who opens the app.
Babylon asks users to set up a PIN code in order to use the app. Face ID is optional
What happens if you fail HIPAA compliance
Since 2003, there have been more than 350,000 privacy violation complaints. This is not a small number. If you fail to secure HIPAA privacy for consumer health information, it will have major consequences.
First, the law requires you to notify users of the breach, specify what information leaked, and explain potential risks. Just imagine all the bad PR that can come out of this and to what extent it can damage your business.
Secondly, the HIPAA application owner can be liable for fines and penalties that can put a burden on financial management, especially for startups at early stages.
To prevent this, proper planning and knowledge of HIPAA compliance are required.
What data is subject to HIPAA regulations
The law references PHI — Protected Health Information. All data that can identify a particular user is protected under HIPAA requirements. It includes:
💁♂️ Names. Full, first or last name, and initials would be protected by HIPAA regulations if it is accompanied by consumer health information.
🌎 All geographical identifiers. Everything smaller than a state, for example, your city, county or neighborhood. But there is one exception: the first three digits of a zip code. So, the user’s address or place of birth would be covered.
📅 Dates. All dates, other than the year, are directly related to a user. For example, date of birth, as well as death date, and admission or discharge date.
📞 Phone numbers. Have you ever gotten a spam call and wondered where they got your number? Definitely not from your healthcare provider, because it would be a serious HIPAA violation. Also (for those of you that remember this throwback) a fax number is considered to be a part of the PHI–covered entities too.
💌 Email addresses. It is self-explanatory — email can also identify a patient, so it is protected under HIPAA.
🔒 Social Security number. Breached Social Security numbers can lead to identity theft and other serious consequences.
🩺 Medical record numbers. The number consists of six digits and appears on most healthcare documents: bills, visit summaries, or referrals. It helps doctors access patients’ electronic records.
🏥 Health insurance information. Name of the provider, patient ID, and group number — all are confidential and should be protected under HIPAA.
😎 Account number. This number is assigned by healthcare organizations during a medical visit and is also subject to HIPAA protection.
👩🏻⚕️Certificate or license numbers. HIPAA protects doctors as well — their educational and professional documents fall under the HIPAA compliance rules.
🚗 Vehicle information. Covered entities include a driver’s license number, license plate number, or the serial number of a car.
🦾 Device identifiers and serial numbers. If a user wears medical devices, for example, insulin pumps or health rate monitors, their serial numbers would be also considered confidential patient data.
🧑🏻💻Web URLs. Any URL that can be associated with patients needs to be protected. Don’t overlook it during HIPAA–compliant app development.
💻 IP addresses. An IP address identifies a device that accesses your mHealth app and, in the wrong hands, it can be traced to someone’s smartphone or laptop.
✋Biometric data. Many healthcare organizations use biometric data scans to link an account to a specific user. Everyone has unique fingerprints, so if a patient adds them to their account, no one else can access the information. Covered entities here include a finger, retinal, voice prints, and other biometric identifiers.
📸 Photos or videos. This refers to any picture showing the full face of an individual, but also a photo with identifiable PHI — a name, initials, or a patient number.
🕵️♀️Any other identifying details. All other characteristics and unique codes can point out specific individuals and disclose their medical information.
Important note: Demographic data, for example, name, date of birth, or insurance information are only protected when they are used in combination with medical information
Should your mHealth app be HIPAA-compliant
Not all healthcare mobile and web solutions must be HIPAA compliant. For example, most yoga, meditation, or any other health app would not fall under the privacy act, because your identifiable information is for personal use. It is not intended to be shared with healthcare workers.
The HIPAA Act only applies to the platforms that share your medical information with “covered entities” — other parties, for example, doctors, dentists, hospitals, and health insurance companies. They must use HIPAA-compliant software.
To check if the law applies to your startup, you need to answer three questions about your healthcare app:
If you answer “yes” to all questions, you need a HIPAA-compliant mobile app.
Other data protection laws in the U.S.
The United States does not have national privacy and data protection laws, like GDPR in the European Union. But there are many detailed regulations focused on specific data types. Let’s take a look at some of them that can apply to your mobile app.
FTC Act
The FTC (Federal Trade Commission Act) protects users from “anticompetitive, deceptive, and unfair business practices.” Essentially, it requires you to be honest and upfront with users about the way you manage their information, as well as to notify users when their data is breached.
State laws
Some states have their own laws about data privacy. For example, New York introduced the SHIELD Act. It applies to any app that owns the private information of a New York resident. In short, even if you don’t operate in New York, it is likely the SHIELD Act still applies to you if you have at least one user from the city. The act requires mobile apps to adopt certain administrative, technical, and physical safeguards for data protection.
California also has a data privacy law for the residents — the Consumer Privacy Act (CCPA). Under it, users have the right to know what information an app collects, the right to request information to be deleted, as well as the right to opt-out of sharing data.
Important reminder: check data privacy laws in the states you operate in. California, Illinois, Colorado, Utah, Virginia, and Connecticut all regulate the sensitive data of their residents.
How to apply HIPAA to your mobile app development
For startups in the healthcare industry, the knowledge of HIPAA regulation is a must to avoid huge fines and penalties. To ensure that the personal health data of your users is protected and to make your app HIPAA compliant, we recommend these 4 steps.
-
Do your research
First things first, make sure to educate yourself about all possible laws, HIPAA compliance, and other data privacy regulations your app can fall under the HIPAA law. If your contractor makes a mistake, your startup will have to pay for it with money and reputation. To prevent this from happening, do your own research beforehand and learn about the subject — all information is accessible online.
-
Evaluate patient health data
Together with your software development team, take a look at the types of personal data you use and decide what features and safeguards are needed for the solution to ensure HIPAA compliance. You can also use our checklist to make sure you include everything.
-
Use HIPAA-compliant consultants if needed
There are third-party companies that can help your startup be HIPAA compliant. For example, they help with collecting and storing patient data, as well as staff training and expert guidance. These companies include HIPAA consultants and audit firms, for example.
-
Work with experienced developers
The professional team is crucial for HIPAA–compliant app development because it helps to minimize the risk of mistakes. Choose wisely, read reviews from previous clients, and check the portfolio of your future developer. Make sure the team has had relevant experience before — the healthcare industry is a serious field and there is no room to experiment.
How much does it cost to develop a HIPAA-compliant app
Here comes the burning question: how does all that impact the prices of your product and how much does developing HIPAA-compliant apps usually cost?
Let’s crunch the numbers for a similar HIPAA–compliant project we developed.
🚨Disclaimer: This is an estimation for app development with our team and we don’t guarantee other companies have the exact costs or timelines.
| Stage | What are we doing | Est. hours | Est. weeks | Est. cost |
| Initial meeting | Discuss the idea of your app | 1 day | – | No costs |
| UI/UX design | Map users’ journeys, create interface mock-ups | 125 hours | 5 weeks | $6 300 |
| Software development | Work on building your healthcare app | 860 hours | 10 weeks | $38 700 |
| QA Testing | Find and fix bugs | 300 hours | In parallel with development | $6 000 |
| Project management | Manage software development project and solve administrative tasks | 16 (in weeks) | During the whole project | $4 250 |
Overall, building a HIPAA-compliant app will cost you around $55 250 and will take approximately 5 months.
5 steps to make HIPAA-compliant apps
Building HIPAA-compliant apps is a complex process, especially if you’re not familiar with the regulations. So we recommend working with a reliable development partner who has experience creating healthcare applications. It will also be helpful to consult with medical professionals, as they have expertise in the healthcare industry.
Step 1. Start with a solid idea
Before you begin development, you need to study all the regulations and how they apply to medical applications. Find out what is considered a violation and what the penalties may be.
Then, you can check if your idea falls under HIPAA-compliant applications. As we mentioned previously, not all applications with medical data fall under HIPAA regulations. It depends on what information you collect and how you treat it. Verify all the requirements before you build a HIPAA-compliant app.
If you fall under the HIPAA Act, don’t forget to ask users to accept the HIPAA Privacy Notice — just like Babylon does.
Step 2. Identify security vulnerabilities
Identify security vulnerabilities in your software. These may include exposure to security breaches and unauthorized access to PHI. The risks should be eliminated before launching the app to avoid losing user trust.
You can implement the following security measures:
-
- Encrypt data both in transit and at rest.
- Implement authentication methods — multi-factor authentication, biometric verification, and strong password policies.
- Create tools for recording and monitoring access and other behavior in systems.
Step 3. Ensure secure user authentication
To further protect patient data, you can implement role-based access. This feature allows only authorized individuals to access PHI. Roles are defined according to their position in the healthcare organization. Each role has its own set of permissions that determine access to resources in the application.
For example, a doctor may have access to all data, while a nurse may only see specific things that are related to medication administration.
Step 4. User training
All personnel who will interact with your app must understand how to maintain HIPAA compliance. Conduct regular training on the latest HIPAA regulations, emerging cybersecurity threats, and data protection.
Step 5. Ongoing maintenance
Changes in your application, innovations in technology, and updates to rules, all require changes to your compliance strategy. Test your application regularly to ensure it is secure and complies with the latest regulations.
Features of HIPAA-compliant mobile apps
In addition to secure access to PHI, software with HIPAA compliance offers a variety of other useful features for patients and healthcare professionals.
Encryption
Encryption ensures that even if data is accessed by an unauthorized person, it cannot be read or used for malicious purposes. There are two types of encryption: in transit and at rest.
In transit encryption protects data as it travels between devices, servers, or apps. The TLS protocol is the most common choice for this purpose. To ensure that the protocol provides the best possible protection, remember to update it regularly.
Encrypting data at rest ensures that only those who have the key can access medical data. This can be data stored on devices, in databases, or in backups. For strong encryption, you can use AES with keys of sufficient length.
User identification
For high security, healthcare apps also use strong user identification. This means that only authorized users can access PHI. Examples of authentication methods are the following:
-
- MFA(Multi-Factor Authentication)
- Unique passwords
- Biometric verification
- Identity proofing
- Security questions
- QR codes
Emergency access
Every second matters in the healthcare industry. In emergency situations, doctors may need quick access to medical data to help a patient in a timely manner. Healthcare apps must provide this access while maintaining the security and confidentiality of the information.
Data breach monitoring
There is a special HIPAA Breach Notification Rule. When a data breach occurs, the affected individuals must be notified immediately, or no later than 60 days. If there are more than 500 affected individuals, organizations must also notify the Department of Health and Human Services and the media.
To comply with regulatory requirements and avoid penalties, it’s essential to track data breaches. Healthcare apps can assist in identifying the scope of the breach, the information compromised, and the individuals potentially affected. This feature simplifies the process of documenting the incident and helps organizations take steps to mitigate the negative effects.
Let’s wrap up
For startup owners, it is important to understand that HIPAA compliance is not a one-time thing, but an ongoing process.
HIPAA–compliant application requires commitment, regular maintenance, and support, to make sure your safeguards stay up-to-date and patient data is protected. Any breach of data can cost a lot of money and hurt the reputation of a startup. Therefore, it is better to plan attentively, anticipate challenges, and nip them in the bud.
Our experience
At Purrweb, we specialize in mobile and web development with a focus on user-friendly UI/UX design and habit-forming interfaces. We have experience of building mHealth and data laws-compliant apps.
Online psychotherapy app design
One of our projects was an online psychotherapy app, a telemedicine service for the UK market. Our team selected a reliable tech stack and encryption to make sure data protection met the requirements of both American HIPAA and European GDPR.
If you have been thinking about developing a HIPAA-compliant healthcare app, we will be happy to help and share our experience.
Bonus: HIPAA compliance checklist
We put together a checklist that will help you make sure your app has these vital technical safeguards:
✅ Unique username or account number
✅ Emergency access to information
✅ Automatic logout when the user is inactive
✅ Encryption and decryption of confidential data
✅ Automatic check-ups of information systems
✅ ePHI integrity policies
✅ Passcode and two-factor authentication
✅ Transmission data security measures
