Joy Foroughi
Executive Assistant
HIPAA: Founders Can Check If Their App Is Covered in 30 Minutes
HIPAA applies to your app only when two things are both true: your app is provided by or on behalf of a covered entity (a health plan, provider, or clearinghouse), and it creates, receives, maintains, or transmits protected health information for that entity. If neither applies, your app likely sits outside HIPAA but still faces FTC and state privacy rules, so "not HIPAA" never means "unregulated."
HIPAA coverage depends on your organization’s role and the work it performs with protected health information (PHI). An app operated by a covered entity, or by a business associate handling PHI on its behalf, can fall within HIPAA’s requirements. An independent consumer health app generally does not become HIPAA regulated simply because it collects health information.
For founders, a 30-minute review can identify likely coverage and unresolved questions. It cannot establish compliance or settle every legal edge case. Start with your business relationships, then map the data your product handles.
At a glance
Identify whether your organization is a covered entity, a business associate, or a business-associate subcontractor.
Receiving records through an EHR connection does not, by itself, establish HIPAA coverage.
Removing names alone does not necessarily de-identify health data.
BAAs, appropriate safeguards, and documented operating procedures work together; none establishes compliance on its own.
Apps outside HIPAA may still face FTC and state privacy obligations.
Who HIPAA applies to
HHS’s business-associate guidance explains the organizational roles behind HIPAA coverage. Covered entities include health plans, health care clearinghouses, and providers that transmit health information electronically in connection with HIPAA-standard transactions. Not every health care provider qualifies automatically.
A business associate performs qualifying functions or services involving PHI for a covered entity. Subcontractors handling PHI for business associates can also have HIPAA obligations.
The app itself is not the business associate; its operator or service provider may be. For example, a vendor operating a hospital’s patient portal and handling PHI for patient management is generally a business associate. A hospital operating its own portal handles that activity under its covered-entity obligations.
Two questions to ask before choosing your architecture
1. What role does your organization perform? Identify who deploys the app, who contracts with you, and whether your company provides a service for a covered entity or another business associate.
2. What information does that work involve? Describe whether your organization creates, receives, maintains, or transmits PHI in performing that service. Include hosting, support, integrations, and downstream processing.
Compare three product situations:
Independent consumer tracker: People choose the app themselves and log wellness information, with no service performed for a covered entity. HIPAA generally does not apply to that activity.
Clinic monitoring service: A clinic engages your company to collect and manage patient information for its care workflow. Business-associate obligations may apply.
Patient-selected records app: A patient directs records into an independent app. The transfer alone does not make its developer a business associate.
These distinctions are illustrated in HHS’s Health App Use Scenarios. An EHR or FHIR connection is a technical route; the relationship and purpose determine the HIPAA analysis.
What counts as PHI and ePHI?
PHI is individually identifiable health information protected under HIPAA, subject to the rule’s definitions and exclusions. It can concern a person’s condition, care, or payment for care. Its electronic form is ePHI, the information protected by the Security Rule.
In a regulated workflow, diagnoses, prescriptions, lab results, and appointment information may be PHI. Device identifiers, detailed dates, or location information can also matter when associated with health information.
Removing a patient’s name is not enough to assume a record is de-identified. HIPAA provides two methods: Expert Determination and Safe Harbor. HHS’s de-identification guidance explains both. Pseudonymous account IDs should not be treated as proof that health records are anonymous.
When a consumer app’s responsibilities change
A new partnership can change the work your company performs. Review scope before adding clinic messaging, patient monitoring, or a provider’s data-management workflow.
A BAA request is a useful signal to investigate, but neither the request nor a contract label settles your status. The actual services and PHI handling matter. Obligations can exist even when a required agreement has not been signed.
Record the purpose of each integration, the parties involved, and which datasets support each service. Revisit that record when contracts, features, or vendors change.
If HIPAA applies: contracts, safeguards, and operations
Put appropriate BAAs in place
Establish BAAs with business associates and qualifying subcontractors before the relevant PHI handling begins. Assess cloud hosting, support, analytics, messaging, and other services individually. Incidental contact does not automatically require a BAA, and signing one does not authorize every use of PHI.
HHS’s cloud-service guidance emphasizes both agreements and the customer’s own compliance responsibilities. A vendor’s eligibility label does not replace appropriate configuration and risk management.
Implement and document safeguards
The Security Rule requires administrative, physical, and technical safeguards. Its technical-safeguard provisions address access controls, audit controls, integrity, authentication, and transmission security.
Under the current rule, encryption specifications are addressable. That does not mean they can be ignored: assess whether encryption is reasonable and appropriate, implement it where it is, and document a justified alternative where applicable. Encryption at rest and in transit remains a sensible engineering baseline for health apps.
Operational work also matters: conduct a documented risk analysis, manage identified risks, designate a security official, train staff, and establish incident-response and contingency procedures. Include physical protections for devices, backups, and recovery arrangements. The HHS Security Rule summary explains these categories.
Understand breach-notification deadlines
For reportable breaches of unsecured PHI:
Affected individuals must be notified without unreasonable delay, no later than 60 days after discovery.
HHS must receive notice for breaches affecting 500 or more individuals without unreasonable delay, within 60 days of discovery.
For fewer than 500 individuals, HHS reporting is due within 60 days after the calendar year in which the breach was discovered ends.
Business associates must notify the covered entity without unreasonable delay, within 60 days of their discovery. Contracts can require faster reporting.
The covered entity’s discovery analysis should not be described as automatically starting only when a business associate reports the incident. Media notification may also be required. See HHS’s Breach Notification Rule guidance.
For an engineering companion, read our HIPAA mobile app checklist.
If HIPAA does not apply: FTC and state obligations
The FTC Act prohibits unfair or deceptive practices, including misleading privacy promises. Separately, the FTC’s Health Breach Notification Rule applies to qualifying personal health record vendors, related entities, and service providers outside its HIPAA exclusions.
For personal health records, the test includes the technical capacity to draw identifiable health information from multiple sources—not just whether that capability is currently used. Unauthorized sharing, including disclosures to advertising platforms without authorization, can trigger breach-notification duties.
The 2024 amendments clarified and expanded an existing rule; consumer health breach obligations did not begin in 2024. Use the FTC’s compliance guidance to assess coverage. Evaluate state privacy and breach laws separately, including jurisdictions where your users live.
A 30-minute checklist for an initial assessment
Use this suggested time budget to create a reviewable record:
Minutes 0–5: Identify the parties. List your organization, customers, upstream vendors, and the services each provides.
Minutes 5–15: Map the data. Note collection, storage, integrations, support access, and disclosures. Distinguish patient-directed transfers from services performed for a provider.
Minutes 15–20: Review agreements. Identify relevant contracts, required BAAs, and gaps in vendor arrangements.
Minutes 20–25: Check safeguards. Record the status of encryption, access controls, logs, backups, device security, and incident response.
Minutes 25–30: Assign next steps. Mark your coverage assessment as likely covered, likely outside HIPAA, or unresolved. Assign an owner to each question and obtain qualified review where needed.
Keep this record current as your product evolves. A quick assessment helps organize the next decision; it does not replace a formal risk analysis or legal review.
How TouchZen helps founders plan healthcare apps
Early discovery helps translate product requirements into a practical development plan. Our developers and designers can work with your team and compliance advisers to map workflows, evaluate integration requirements, and plan security features before implementation.
Explore our approach to healthcare app discovery, or learn about TouchZen’s design and development services. A discovery conversation can identify engineering questions and dependencies for your project.
This article provides general information, not legal advice. A qualified legal professional should assess how the rules apply to your organization.
FAQ
Does HIPAA apply to every healthcare app?
No. Health-related functionality alone does not establish coverage. Examine your organization’s role, its relationships, and its handling of PHI. Independent consumer apps may instead face FTC and state obligations.
Does a BAA make an app HIPAA compliant?
No. A BAA addresses contractual responsibilities. Compliance also involves applicable privacy requirements, safeguards, operating procedures, and ongoing risk management.
Are proposed HIPAA Security Rule changes already in effect?
As of this article’s review on October 14, 2026, HHS’s Security Rule summary identifies the existing rule as current and links separately to proposed modifications. The proposal was published in January 2025. Proposed requirements should not be presented as effective law; monitor HHS’s rulemaking page for updates and any final-rule compliance dates.
Does receiving EHR records make my app a business associate?
Not automatically. Patient-directed transfers to an independent app differ from handling records as a service for a covered entity. Review the purpose of the connection and your organization’s relationship with the provider.
