Deciding how to make a mobile app when your business has HIPAA obligations can be tricky to navigate alone. Not everyone is considered a "covered entity" by HIPAA, but for those that are, keeping patient information secure is your number one priority when making an app. While you may think this limits your options, building a HIPAA-ready app isn't as hard as it used to be. In this post, we'll cover whether your app falls under HIPAA, what a HIPAA-ready app needs, and some best practices. This is general information, not legal advice.
Does your mobile app fall under HIPAA?
HIPAA was established to protect individuals' medical records and other identifiable health information, but it only applies to covered entities who are typically in the medical field and have privileged information about a patient's health. HHS defines three kinds of covered entities: health care providers, such as hospitals, doctor's offices, clinics, and pharmacies, that conduct certain transactions electronically; health plans, including health insurers and employer-sponsored group health plans; and health care clearinghouses.
However, just having an app and being in one of those industries doesn't automatically mean your app falls under HIPAA. It's the information your app processes that determines whether or not HIPAA applies to your app.
Ask yourself: Does your health app create, receive, maintain, or transmit identifiable medical information? If yes, HIPAA probably applies to your app.
Besides covered entities, any business associates who create, receive, maintain, or transmit protected health information on a covered entity's behalf are also bound by HIPAA. So if your business asks for personal health information but isn't a covered entity or business associate, HIPAA doesn't apply to your app. An example of this would be asking for someone's gender to sign them up for your app. Even though details like this can count as health information in a medical setting, HIPAA doesn't govern how you secure that information if you aren't a covered entity or business associate. However, if you are, the same detail becomes protected health information once it is tied to someone's care, and your app needs to handle it under HIPAA.
While HIPAA has a set of security requirements, they are not really applicable to people outside of covered entities and their business associates. If you want to secure your app but are not dealing with protected health information, there are other resources you can check out.
What does a HIPAA-ready mobile app need?
Once you've determined that the app you're making is covered by HIPAA, you need to know what it takes to build it HIPAA-ready. There are certain technical safeguards to put in place, and here's how we would approach them.
Information
Before you can set up protocols to protect your patients' health information, you need to know what information you are gathering. Determine what information you need to collect and protect in order to fulfill your core functions in the app.
For instance, while it can be good to have demographic information on your patients, you should consider why it is medically necessary for your app to do so. If you are running an app to help monitor people's heart health, it may not be necessary for you to collect information on their previous mental health diagnoses, or if your app helps patients track migraines, it may not be necessary to know their weight and gender. Knowing what information is necessary for you to complete the core functions of your app without overstepping and gathering more health information helps you meet HIPAA's minimum-necessary standard.
There is strict guidance from the government on what information is considered protected health information, so here's a quick, non-exhaustive list of the identifiable health information you need to protect:
- Demographic information
- Relates to past, present, or future physical or mental health conditions
- Involved in past, present, or future medical billing or payment for the provision of health services
- Provides information that can identify the customer, or there is a reasonable basis to believe it could be used to identify the customer
Security
Securing your app-user-protected health information involves both technical, operational, and relationship requirements for the security of that information.
HIPAA security requirements include:
- Encryption: Any app with protected health information
should provide both encryption at rest and encryption in transit. The
Security Rule has historically listed encryption as an "addressable"
safeguard rather than a fixed requirement, but in practice an app handling
this data should encrypt it. Note: This is different from end-to-end
encryption, which HIPAA does not require.
- Encryption at rest: This ensures health data that is stored either physically on your computer or digitally is protected from unauthorized access by converting the data to code.
- Encryption in transit: This secures health information as it is being transferred from the person inputting the data to you and back again. Data is converted before being transmitted from the app, the endpoint is authenticated, and the data is decrypted and verified on arrival, preventing decryption by any unauthorized parties who may attempt to intercept the data.
- Standard operating procedures: This includes telling people on your app how their health information is used and stored (HIPAA calls this a notice of privacy practices), getting their written authorization for uses HIPAA doesn't already allow, and only gathering the minimum necessary health information for your purpose.
- Sharing with third parties: Under HIPAA, protected health information must be accessible to the protected individual and authorized third parties in certain circumstances. If an individual wants to gain access to your record of their protected health information, your app is required to give them access to it on request. Additionally, if a third party submits a request in writing, signed by the individual whose health data they are seeking access to, your app must also give them that information with the individual's consent. This is largely used to distribute health information to the patient's other healthcare providers.
Assistance
If you are unsure whether HIPAA applies to you, ask a healthcare attorney or compliance specialist. They can tell you whether you are a covered entity or business associate. That is a legal question, and no app vendor, including us, can answer it for you.
Then ask every vendor that will touch protected health information two direct questions: how do you secure it, and will you sign a business associate agreement (BAA)? Covered entities generally need a BAA with vendors that handle their data. Ask every vendor up front whether they sign one, and build that answer into your plan.
What we do build is HIPAA-ready health apps: secure cloud storage, access controls, and data handling designed around the safeguards above. If you are a wellness brand, a researcher, or a provider exploring a connected-device app, see our health apps and our white-label HealthKit app. If you want to talk it through first, start with a free assessment.
Figure out your options, keep your patients' information safe, and get back to doing what you do best: helping people.