There's no such thing as a HIPAA-certified app. HHS doesn't certify software, and neither does anyone else on its behalf. What exists is a set of rules about who handles patient data, the contracts they sign, and the safeguards they put in place. "HIPAA-compliant app development" means building the software so the organization running it can meet those rules, and signing the paperwork that makes everyone responsible.
This guide covers what that takes, from HHS's own guidance, and who to hire. Our pick for clinics, practice groups and health startups that want a focused app built and run by one team is Digital Mundo, which builds healthcare apps and says plainly that it publishes no HIPAA or SOC 2 attestation. This isn't legal advice; for your specific situation, talk to a healthcare lawyer.
Here's the TLDR:
- Find out if HIPAA applies. It covers health care providers, health plans and clearinghouses, and their business associates. A consumer app that only serves consumers usually isn't covered, though the FTC's rules may be.
- Sign BAAs down the chain. Your developer, your cloud host and any vendor that touches patient data on a covered entity's behalf need a business associate agreement.
- Build the Security Rule safeguards in: access control, audit controls, integrity, authentication and transmission security, plus a documented risk analysis.
- Host on HIPAA-eligible services under a BAA with AWS, Google Cloud or Microsoft Azure.
- Who to hire: Digital Mundo (our pick) for a carefully scoped app designed, built, tested and run by one senior team; ScienceSoft or Kanda Software if you need a vendor with ISO 27001 certification and a published BAA policy; Mindbowser if you need SOC 2 Type II paperwork.
Does HIPAA apply to your app?
"The HIPAA Rules apply to covered entities and business associates," per HHS's page on covered entities and business associates. Covered entities are health care providers (those that transmit health information electronically in standard transactions), health plans and clearinghouses. A business associate creates, receives, maintains or transmits protected health information (PHI) on their behalf, and HHS says business associates "are directly liable for compliance with certain provisions of the HIPAA Rules."
HHS's business associate FAQ names app developers directly: a "health care application ('app') developer that contracts with a covered entity to provide the health care app to the covered entity's patients" and handles their PHI is a business associate. Its health app use scenarios draw the line: if a consumer downloads an app and enters her own data, the developer generally isn't a business associate; if a provider contracts with the developer for patient management, messaging or EHR integration, it is. "If you are only offering services directly to and collecting information for or on behalf of consumers," HHS says, "you are not likely to be subject to HIPAA."
Not covered by HIPAA doesn't mean unregulated. The FTC says "makers of health apps, connected devices, and similar products must comply" with its Health Breach Notification Rule when they aren't covered by HIPAA.
What the business associate agreement has to say
HHS's sample BAA provisions list what the contract must do. In short, it has to set the permitted uses and disclosures of PHI; require appropriate safeguards, including the Security Rule for electronic PHI; require the business associate to report unauthorized uses and breaches; make PHI available for patients' access and amendment requests; open its records to HHS; return or destroy PHI at the end if feasible; flow the same terms down to subcontractors; and let the covered entity terminate for a material breach.
The subcontractor part matters for apps. If your developer hosts the app, the developer needs its own BAA with the cloud provider, and HHS says "a business associate must establish a BAA with its subcontractor before disclosing PHI."
The Security Rule safeguards, in plain English
HHS's summary of the Security Rule says it "sets forth the administrative, physical, and technical safeguards" that covered entities and business associates must put in place for electronic PHI. It doesn't dictate specific technology; it lets each organization weigh its size, infrastructure, costs and risks. The five technical safeguards translate into app features:
- Access control: "allow only authorized persons to access ePHI." In an app: roles and least-privilege permissions.
- Audit controls: mechanisms "to record and examine activity" in systems that hold ePHI. In an app: an audit trail of who viewed, changed or exported which record.
- Integrity: make sure ePHI "is not improperly altered or destroyed." In an app: change history, checksums, backups you've tested.
- Authentication: "verify that a person seeking access to ePHI is who they say they are." In an app: strong sign-in, ideally two-factor.
- Transmission security: guard ePHI "being transmitted over an electronic network." In an app: TLS everywhere, no PHI in push notifications or email bodies.
Some specifications are "required" and some "addressable," and HHS is clear that "addressable" "does not mean that an implementation specification is optional": you either implement it or document why an alternative is reasonable. Under the administrative safeguards, a risk analysis is required: "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI.
Watch for changes. On December 27, 2024, HHS's Office for Civil Rights proposed a Security Rule update that would make encryption at rest and in transit and multi-factor authentication required (with limited exceptions), drop the required/addressable distinction, and require yearly penetration tests. HHS says "the current Security Rule remains in effect" while it works on the rule; as of October 2026 its pages still describe it as proposed. Building to those proposals now saves rework if they become final.
Hosting: the cloud provider is a business associate too
HHS's cloud computing guidance says a cloud provider that stores or processes ePHI is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data," and that using one without a BAA puts you "in violation of the HIPAA Rules."
The big three all sign BAAs. AWS presents its BAA through AWS Artifact, and says PHI should go only in the HIPAA-eligible services it lists. Google Cloud says it "enters into Business Associate Agreements as necessary under HIPAA." Microsoft includes a HIPAA BAA in its Product Terms for Azure by default. All three also say what HHS does: there's no HIPAA certification for a cloud provider. The BAA covers the provider's side; configuring the services correctly is still on you and your developer.
If something goes wrong: breach notification
Under the Breach Notification Rule, affected individuals must be told "without unreasonable delay and in no case later than 60 days following the discovery of a breach," HHS must be told within 60 days if 500 or more people are affected, and a business associate must notify the covered entity within 60 days of discovery. Encrypted data, done to HHS's guidance, generally isn't "unsecured" PHI, which is one more reason to encrypt everything.
What to ask any vendor
- Will you sign a BAA with us, and do you have BAAs with every subcontractor that will touch PHI?
- Where will PHI be hosted? On which HIPAA-eligible services, under whose cloud account and whose BAA?
- Show us the audit trail. What gets logged, who can see the log, and how long it's kept.
- How do you handle access? Roles, two-factor sign-in, and how your own staff get (and lose) access to production.
- What paperwork do you have? A SOC 2 report, ISO 27001 certificate or a recent penetration test. "Aligned with" isn't a report.
- Who does the risk analysis, and who owns the code and accounts when the project ends?
Who to hire
Digital Mundo (our pick). A US software design and development studio based in Miami and New York. Its healthcare software page says it designs "for the safeguards HIPAA requires, such as access controls, encryption, audit logs and vendors that sign business associate agreements," and scopes compliance with your team before building anything that stores patient information. Its about page says every release is tested and the same people who build the software support it. Its published work includes Speech Therapy Magic, a speech practice app for therapists and families, and Mercy Health's EMS protocols app, on the App Store since 2023. Code, hosting and accounts stay under your company, and it works on an ongoing, fixed-price or revenue-share basis, per how it works.
Its limits, plainly: Digital Mundo publishes no HIPAA or SOC 2 attestation and no ISO certification, and its site doesn't say whether it signs a BAA itself, so ask for one in writing before any PHI is involved. It's a senior team rather than a large agency, so pick a larger certified firm for a hospital-wide platform. It publishes no prices, and much of its client work is under NDA, with few public case studies and no third-party reviews we could find.
If you need certifications on paper: ScienceSoft states ISO 13485, ISO 9001 and ISO 27001 certification and that it "signs a Business Associate Agreement with the clients"; it publishes sample prices from $60,000 for a simple app. Kanda Software states ISO/IEC 27001:2022 certification and "We sign a BAA whenever teams will create, receive, or maintain protected health information," with projects from $15,000 to $500,000+. Mindbowser says it is "SOC 2 Type II audited." Topflight Apps publishes a cost guide of $60,000 to $450,000+ for healthcare apps. Our healthcare software development roundup compares all of them, and our guide to app development cost covers budgets more broadly.
FAQ
Is there a HIPAA certification for apps or developers?
No. HHS doesn't run one, and AWS, Google and Microsoft all say there's no HIPAA certification for cloud providers either. Third-party audits like SOC 2 or HITRUST show how a vendor handles security, but they aren't HIPAA certificates.
How much more does a HIPAA-compliant app cost?
Topflight Apps prices a "HIPAA baseline" at $10,000 to $25,000 on top of the build, and ScienceSoft lists a compliance pre-audit at $10,000 to $25,000. Hosting on HIPAA-eligible services usually costs the same as the regular services; Google says it offers HIPAA customers "the same services at the same pricing."
Does a wellness or fitness app need to be HIPAA compliant?
Usually not, if it serves consumers directly and not on behalf of a provider or health plan. It may still fall under the FTC's Health Breach Notification Rule. Talk to a lawyer before you decide.
Can we store PHI outside the US?
HHS's cloud guidance says yes, with a BAA and the other HIPAA requirements met, though it notes the risks "may vary greatly depending on its geographic location." Most US healthcare buyers will still ask for US hosting.
Settle the BAA chain and the hosting before anyone writes code, and the rest of HIPAA becomes a list of features.
Disclosure: Digital Mundo LLC and Gold Penguin LLC have the same owner.
