HIPAA app engineering checklist
A HIPAA compliance checklist for app development teams: the access, audit, encryption, vendor and recovery controls the Security Rule expects, written as engineering tasks you can assign, build and test.
For founders, product leads and engineers building apps that store or send electronic protected health information (ePHI).
Pre-release checks
- Audit event on every ePHI readPassed
- TLS on internal service callsPassed
- Idle session timeout on mobileOpen
- BAA on file for SMS vendorPassed
- Restore test from last backupOpen
What does the HIPAA app engineering checklist help you decide?
The HIPAA app engineering checklist helps a product team decide which Security Rule controls their app already has, which are missing and which need a documented decision before real patient data goes in. Each item maps an engineering task, such as audit logging or session timeout, to the 45 CFR 164 section it supports.
Last reviewed by the Agnotic Technologies engineering team
Which HIPAA controls does your app have in place?
Tick an item only when you can show evidence for it: a configuration, a test, a log sample or a signed agreement. Your ticks stay in this browser tab and are not sent anywhere.
- Required
- Required implementation specification in the Security Rule.
- Addressable
- Implement it, or document why an alternative is reasonable and appropriate.
- Standard
- Security Rule standard without a separate specification listed here.
- Practice
- Engineering practice that supports the rule; no single section.
0 of 22 controls in place · 9 required still open
Risk analysis and ownership
0/3Start here. The rest of the list only makes sense against a written risk analysis.
Access control and authentication
0/5Audit logging
0/3Encryption and integrity
0/4Vendors and business associate agreements
0/3Backup, recovery and incidents
0/4How do you use the checklist?
Sit down with the people who build and run the app: the engineering lead, the product owner and whoever owns security.
Work through the groups in order, starting with the risk analysis, and tick only what you can prove.
For each Addressable item you do not implement, write down why and what you do instead.
Record each gap and its owner in your risk analysis, then work through the list again before release.
What can this checklist not tell you?
- Whether HIPAA applies to you. That depends on whether you are a covered entity or a business associate. Consumer health apps outside HIPAA can fall under the FTC Health Breach Notification Rule (16 CFR Part 318).
- Whether your organization is compliant. HIPAA also covers policies, workforce training and physical safeguards, and a checklist is not a risk analysis.
- Which state privacy laws add duties beyond HIPAA for your users.
- Legal advice. Have your privacy or legal counsel confirm what applies to you.
Which technical safeguards map to which engineering controls?
The technical safeguards in 45 CFR 164.312, with their status in the rule and the control we usually build for each.
| Safeguard | Section | Status in the rule | What we build |
|---|---|---|---|
| Unique user identification | 164.312(a)(2)(i) | Required | Per-user accounts through your identity provider, no shared logins |
| Emergency access procedure | 164.312(a)(2)(ii) | Required | A logged break-glass role with review after use |
| Automatic logoff | 164.312(a)(2)(iii) | Addressable | Idle timeouts on web and mobile, short-lived API tokens |
| Encryption and decryption | 164.312(a)(2)(iv) | Addressable | Encrypted databases, storage and backups with managed keys |
| Audit controls | 164.312(b) | Standard | Append-only audit events for every ePHI read and change |
| Integrity | 164.312(c)(2) | Addressable | Record version history and checksums on stored files |
| Person or entity authentication | 164.312(d) | Standard | SSO and MFA for staff, signed tokens between services |
| Transmission security | 164.312(e)(2)(ii) | Addressable | TLS on every hop, including internal traffic |
What should you do with the result?
Required items still open
Close them before production ePHI goes into the app. The rule does not leave these to your judgment.
Addressable items still open
Implement them, or record why an alternative is reasonable and appropriate and what that alternative is.
Vendor items still open
Get the business associate agreement signed, or switch vendor, before that service touches ePHI.
If several groups have gaps, an engineering review of the whole app is usually quicker than fixing items one at a time. That review is what a scoping call starts.
What does the Security Rule text say?
The rule text behind the checklist, in brief, with a link to each section on eCFR.
The HIPAA Security Rule requires administrative, physical and technical safeguards for electronic protected health information.
Source: 45 CFR Part 164 Subpart C (eCFR)Audit controls are a Security Rule standard: hardware, software or procedural mechanisms that record and examine activity in systems that contain or use ePHI.
Source: 45 CFR 164.312(b) (eCFR)Risk analysis is a required implementation specification: an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI.
Source: 45 CFR 164.308(a)(1)(ii)(A) (eCFR)A covered entity must notify affected individuals of a breach without unreasonable delay and no later than 60 calendar days after discovering it.
Source: 45 CFR 164.404(b) (eCFR)Security Rule documentation must be kept for 6 years from the date it was created or the date it was last in effect, whichever is later.
Source: 45 CFR 164.316(b)(2)(i) (eCFR)
Which Agnotic services pick up from here?
Agnotic Technologies builds HIPAA-ready apps for digital health teams. These pages cover the engineering behind the checklist.
- HIPAA compliance for software teamsHow we turn the Security Rule into architecture and delivery decisions.
- HIPAA compliant software developmentApps and platforms built with these controls from the first sprint.
- PHI data security engineeringEncryption, access control and logging for health data at rest and in transit.
- Epic integration planning checklistThe next checklist if your app will connect to a health system on Epic.
- Healthcare software scope builderPut these controls into a full scope with features, users and integrations.