HIPAA: the developer's pillar guide

HIPAA applies to covered entities (most healthcare providers, health plans, clearinghouses) and business associates (vendors who create, receive, maintain, or transmit PHI on behalf of a covered entity). If you are a SaaS that stores or processes patient data on behalf of a clinic, hospital, or insurer — you are almost certainly a business associate.

If you build a wellness app with no clinical relationship, HIPAA likely does NOT apply (but state laws and FTC Act do). When in doubt, ask: is this data flowing to or from a covered entity?

You sign a BAA with every covered entity customer. They are protected, you take on HIPAA obligations. You then sign a BAA with every sub-processor that touches PHI: your cloud provider, database host, email provider, error monitoring tool, customer support tool, AI provider.

Sub-processors who will sign a BAA in 2026 include: AWS, GCP, Azure, Supabase (paid plans), MongoDB Atlas (paid), OpenAI (Enterprise/Edu), Anthropic (Enterprise), Sentry (Business tier), Slack (Enterprise+ via EKM), Intercom (HIPAA add-on).

Sub-processors who will NOT sign a BAA (as of 2026): GitHub.com, Vercel Free/Hobby, most Discord/Telegram options, most consumer analytics tools. If PHI touches one of these, you are out of compliance.

The HIPAA Security Rule (45 CFR Part 164 Subpart C) is the part that touches your stack. Key citations:

• §164.308(a)(1) — Risk analysis. Document threats to ePHI annually.
• §164.308(a)(3) — Workforce access management. Quarterly access reviews + signed offboarding.
• §164.308(a)(5) — Security awareness + training.
• §164.312(a)(1) — Access control. Unique user IDs, automatic logoff, encryption.
• §164.312(a)(2)(iv) — Encryption at rest for ePHI (addressable, treat as required).
• §164.312(b) — Audit controls. Mechanisms that record access to ePHI.
• §164.312(c) — Integrity. Mechanisms to detect unauthorized modification.
• §164.312(d) — Person authentication. MFA, strong passwords, attestation.
• §164.312(e)(1) — Transmission security. TLS everywhere, period.

A few specific exposures auditors increasingly flag in 2026:

• PHI in test fixtures (real patient names in seed data). Replace with synthetic; document the dataset's provenance.
• PHI in commit messages or PR descriptions. Pre-commit hooks (gitleaks) catch some; education is the rest.
• PHI in error monitoring (Sentry breadcrumbs, log lines). Configure scrubbers for known fields.
• PHI in AI prompts. If you use OpenAI / Anthropic / Gemini on workflows that include patient data, you need an Enterprise tier with a signed BAA AND model-training opt-out.
• PHI in code-completion tools (Copilot, Cursor). If your code contains hardcoded PHI in any form, the model has seen it.

If unsecured PHI is acquired or disclosed without authorization, HITECH triggers notification:

• Notify affected individuals within 60 days.
• Notify HHS (annually for <500 affected; immediately for ≥500).
• Notify the media for breaches affecting 500+ residents of any single state.

"Unsecured" means not encrypted to HHS standards. Properly encrypted PHI that is exfiltrated is not a breach. This is why end-to-end encryption + at-rest encryption are massive risk reducers.