HIPAA-Compliant App Development in 2026: Checklist, Architecture and Cost Drivers

A HIPAA-compliant app protects patient data with documented safeguards. It also has a signed agreement with every vendor that touches that data. There is no certificate that makes an app HIPAA compliant. Compliance is something you build, document and maintain.

This guide covers when HIPAA applies and how to turn the Security Rule into engineering controls. It also covers hosting, mobile and AI features, and what drives cost. It is engineering guidance, not legal advice.

Does HIPAA Apply to Your App?

HIPAA applies to covered entities and their business associates.

• Covered entities are healthcare providers that bill electronically, health plans and healthcare clearinghouses.
• Business associates are companies that create, receive, maintain or transmit protected health information (PHI) on behalf of a covered entity.

If you build an app for a clinic, hospital or health plan, and it handles PHI, you are almost certainly a business associate. You need a business associate agreement (BAA) with that customer.

Consumer health apps

Some people download a fitness or symptom app on their own. If it has no link to a provider or plan, it is usually outside HIPAA. It may still fall under the FTC Health Breach Notification Rule. The FTC updated that rule in 2024 to make clear it covers health apps and similar technologies. It requires notice to users and the FTC after a breach of unsecured health data.

Your situation	Main rules to consider
App built for a provider, plan or clearinghouse	HIPAA Privacy, Security and Breach Notification Rules
Vendor processing PHI for a covered entity	HIPAA as a business associate, plus your BAA terms
Direct-to-consumer health or wellness app	FTC Health Breach Notification Rule, state privacy laws

Step 1: Run a Risk Analysis

The Security Rule requires a risk analysis. This is a thorough review of risks to the confidentiality (privacy), integrity (accuracy) and availability of electronic PHI. Do it before you design, and update it when the system changes.

List where PHI is created, stored, sent and displayed. Then list what could go wrong at each point and how you will reduce the risk. This document drives every decision that follows.

Step 2: Map the Security Rule to Engineering Controls

The Security Rule's technical safeguards in 45 CFR 164.312 translate directly into features.

Safeguard	Requirement	Engineering control
Access control	Only authorised people and software can access ePHI	Unique user IDs, role-based access, automatic logoff, emergency access procedure
Audit controls	Record and examine activity in systems with ePHI	Immutable audit logs of reads, writes and exports, with regular review
Integrity	Protect ePHI from improper change or destruction	Checksums, versioning, database constraints, backups
Person or entity authentication	Verify that a person is who they claim to be	Strong passwords plus multi-factor authentication, session management
Transmission security	Protect ePHI sent over networks	TLS for every connection, no PHI in URLs

Encryption appears in the rule as an "addressable" specification. That means you must implement it where reasonable or document an equivalent measure. For a modern app, encrypt PHI in transit and at rest.

Administrative safeguards, such as security officer roles, workforce training and incident response, and physical safeguards, such as device and facility controls, apply too. Your hosting provider covers part of the physical side.

Step 3: Sign BAAs With Every Vendor That Touches PHI

This is where many health apps fail. Any third party that creates, receives, stores or transmits PHI for you needs a BAA. Check each one:

• Cloud hosting and databases
• Email and SMS providers for appointment reminders and notifications
• Customer support tools where patients may share health details
• Analytics and crash reporting, which can capture PHI from screens and logs
• Video calling for telehealth
• AI and LLM APIs used for summaries, chat or transcription

HHS guidance on cloud computing is clear on one point: a cloud provider that stores ePHI is a business associate even if the data is encrypted and the provider cannot see it.

Step 4: Choose HIPAA-Eligible Hosting

The major clouds, including AWS, Microsoft Azure and Google Cloud, sign BAAs and publish lists of services eligible for PHI. AWS, for example, maintains a HIPAA Eligible Services Reference.

Two cautions:

1. Only use eligible services for PHI. A service outside the list is not covered by the BAA.
2. Configuration is your job. The provider secures the infrastructure; you secure your accounts, networks, storage and access.

Step 5: Avoid the Mobile-Specific Leaks

Mobile apps leak PHI in ways web apps do not.

• Push notifications: Never put PHI in the notification text. Use "You have a new message".
• Local storage: Encrypt any cached data and clear it on logout.
• Screenshots and app switcher: Hide sensitive screens in the app switcher preview.
• Logs: Strip PHI from client and server logs and crash reports.
• Lost devices: Support remote session revocation and short session lifetimes.

Step 6: Handle AI Features Carefully

AI features such as visit summaries, clinical note drafting and patient chat are now common in health apps. Treat them like any other vendor:

• Send PHI only to AI services covered by a BAA.
• Prefer providers and endpoints that do not retain prompts for training.
• Log prompts and outputs in your own audit trail.
• Keep a clinician in the loop for anything that affects care.

Our guide to healthcare AI compliance under HIPAA and the EU AI Act goes deeper on this.

Step 7: Plan for Breaches

HIPAA's Breach Notification Rule says you must tell affected people without unreasonable delay. The limit is 60 days after you discover a breach of unsecured PHI. Larger breaches also require notifying HHS and, in some cases, the media. Write and rehearse your incident response plan before launch.

HIPAA-Compliant App Checklist

• Confirmed whether HIPAA, the FTC rule or both apply
• Documented risk analysis, updated on major changes
• Unique user IDs, role-based access and MFA
• Audit logs for all access to PHI
• Encryption in transit (TLS) and at rest
• BAAs with every vendor that handles PHI
• HIPAA-eligible hosting, correctly configured
• No PHI in push notifications, URLs or logs
• Backups and a tested disaster recovery plan
• Incident response and breach notification plan
• Workforce security training and written policies
• Regular security testing, such as penetration tests

What Drives the Cost of HIPAA-Compliant Development

Compliance adds work in predictable places:

• Security architecture and threat modelling up front
• Audit logging and access control features
• Compliant hosting and the security tooling around it
• Vendor reviews and BAAs for every integration
• Risk analysis and documentation
• Security testing before launch and at regular intervals

The total depends on scope, so treat compliance as its own line in the estimate. For typical budgets, see our guides to healthcare app development cost and telehealth app development cost.

Working With a Development Partner

Choose a partner who will sign a BAA and has built HIPAA systems before. Ask them to show their security practices, not just claim them. Ortem builds HIPAA-aligned healthcare software and signs BAAs where we handle PHI. See our HIPAA-compliant development service.