The Importance of HIPAA Compliance in Mobile App Development

María Eugenia Gómez -

If you are in the health and healthcare space chances are you’ve heard the term HIPAA compliance. Read on to learn more about the Health Insurance Portability and Accountability Act (HIPAA), the requirements for HIPAA compliance and the overall importance of it in mobile app development. You can check out the full text of the law here.

What is it?

HIPAA is an acronym for Health Insurance Portability and Accountability Act and it was passed in 1996. It’s a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services issued the Privacy Rule standards to address the use and disclosure of individuals’ health information (known as “protected health information”) by entities subject to the Privacy Rule, these entities are also known as “covered entities”.

The main objective of the Privacy Rule is to ensure that individuals’ health information is protected while also allowing the flow of health information needed to provide and promote high quality health care. It’s meant to find a balance between using important information and protecting patients’ privacy.

The Protected Health Information (PHI) referred above is the following:

Who are considered covered entities and are subject to the Privacy Rule?

  • Healthcare providers: those who electronically transmit health information in connection with certain transactions (claims, benefit eligibility inquiries, referral authorization requests, among others).
  • Health plans: entities that provide or pay the cost of medical care.
  • Healthcare clearinghouses: Entities that process nonstandard information they receive from another entity into a standard.
  • Business associates: A person or organization (other than a member of a covered entity’s workforce) using or disclosing individually identifiable health information to perform or provide functions, activities, or services for a covered entity. These functions, activities, or services include claims processing, data analysis, utilization review, and billing.

What makes it important?

As we’ve stated, it’s meant to find a balance between using important information and protecting patients’ privacy. It helps both healthcare institutions and patients. As health care providers and other entities dealing with PHI move to computerized operations the need for HIPAA compliance is more important than ever. While the use of electronic methods provides increased efficiency, they also exponentially increase the security risks facing healthcare data.

The importance for patients lies in that entities cannot use their information without their consent, only healthcare professionals can share it with stakeholders. Billing professionals and prescription vendors also cannot disclose patients’ information. And lastly patients are to be notified in case a breach occurs.

The importance for healthcare providers lies in the understanding that in case of breaching HIPAA compliance, hospitals are held liable to pay massive fines. The Department of Health and Human Services (HHS) prefers to resolve HIPAA violations using non-punitive measures, such as voluntary compliance or issuing technical guidance to help covered entities address areas of non-compliance. However, if the violations are serious, have been allowed to persist for a long time, or if there are multiple areas of noncompliance, they could be fined.

The goal is to protect the privacy of individuals’ health information, while at the same time allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care.

Which apps should be HIPAA compliant?

According to US healthcare industry regulations, every medical software needs to be HIPAA compliant. So, if you are planning to create a product in this space, you should care about the HIPAA compliance of your company.

It will also inspire a lot more confidence in users when you show that your product is HIPAA compliant.  

Regarding telehealth solutions which are now widely available, the Department of Health and Human Services (HHS) stated that “A covered health care provider that wants to use audio or video communication technology to provide telehealth to patients during the COVID-19 nationwide public health emergency can use any non-public facing remote communication product that is available to communicate with patients. Some of these technologies, and the manner in which they are used by HIPAA covered health care providers, may not fully comply with the requirements of the HIPAA Rules. The Office for Civil Rights (OCR) will exercise its enforcement discretion and will not impose penalties for noncompliance against covered health care providers in connection with the good faith provision of telehealth during the COVID-19 nationwide public health emergency.” In essence, during the pandemic OCR will not impose penalties for noncompliance if healthcare providers are using mobile health apps for the provision of telehealth services.

To verify that your product should be HIPAA compliant we must ask ourselves the following:

Is the application used by some covered entity like a hospital, physician, or a healthcare insurance provider?

Does it contain protected health information (PHI)?

How to make a mobile app HIPAA compliant?

Not all health-related apps in the market are HIPAA compliant and not all are meant to be. It’s exclusively for the ones that collect, store, and transmit PHI.

To determine if your mobile application should be HIPAA compliant we must understand:

  • the app user (entity) type
  • the app information type (the information that is generated, stored, or shared)
  • the app software type (encryption type)

If your app is intended for use by a Covered Entity (see above who is considered a covered entity), it’s likely you’ll have to comply with HIPAA. Mobile app HIPAA compliance covers the flow of Protected Health Information. The main requirements are:

  • SSL Protection
  • Full Data Encryption
  • Full Data Backup
  • Permanent Data Deletion
  • Limited Access

Developing HIPAA compliant healthcare apps can at times pose a challenge for the mobile app developers because it asks for a number of modifications on both features and design front. There are many things to keep in mind such as: risk and exposure must be minimized, a qualified security or HIPAA expert must define the security requirements, don’t store or cache PHI whenever possible, when using cloud storage, provide secure PHI data transmission and storage (the cloud storage also should be HIPAA compliant), among others.

So don’t forget if your mobile application will be used by a covered entity and if it contains, collects or stores Protected Health Information you must comply with the act.

All in all HIPAA compliance essentially means that protecting patient data should always be the top priority, and you should strictly follow HIPAA technical safeguards during your health or healthcare startup development. It’s becoming more and more relevant as we switch to a hybrid model of medical consultation due to the pandemic. Telehealth has experienced a steady growth and we don’t foresee this changing.

Do you have a healthcare digital product that you need help with? Don’t hesitate to reach out to us!