HIPAA compliant software development

There is no such thing as HIPAA certified software

This is the first thing worth knowing, because a lot of marketing suggests otherwise. The US Department of Health and Human Services does not certify software, developers or hosting companies as HIPAA compliant. Some private firms offer assessments or seals, but none of them is an official HIPAA certification.

Compliance is a property of how an organization handles health information, not a badge a piece of software carries. The software is one part of it. The way it is hosted, the agreements with vendors, and your own policies, training and risk assessments are the others. Good software makes compliance much easier. It cannot make an organization compliant on its own.

Who HIPAA applies to

• Covered entities: healthcare providers that bill electronically for their services, health plans, and healthcare clearinghouses.
• Business associates: companies that create, receive, store or transmit protected health information on behalf of a covered entity, such as billing companies, IT providers and cloud hosts.
• A business associate agreement (BAA) is the contract between a covered entity and a business associate that sets out how the information will be protected.
• Some health and wellness apps that work directly with consumers are not covered by HIPAA at all, but may still fall under other rules such as the FTC’s Health Breach Notification Rule and state privacy laws.

What HIPAA compliant software development involves

The HIPAA Security Rule groups its requirements into administrative, physical and technical safeguards. Software mostly touches the technical ones. When we build software that will handle health information, we design these in from the start rather than adding them later:

• Access controls: a unique login for every user, role-based permissions so people only see the records their job requires, and automatic sign-out after inactivity.
• Strong authentication, including multi-factor sign-in for staff accounts.
• Audit logs that record who viewed, created, changed or deleted health information, and when.
• Encryption of data in transit and at rest, including backups.
• Integrity checks, so records cannot be altered without a trace.
• Hosting on infrastructure from providers that offer BAAs, such as AWS, Google Cloud and Microsoft Azure, using only the services covered by those agreements.
• Keeping health information out of places it does not belong, such as error reports, analytics tools, email notifications and text messages.
• Using made-up test data during development rather than real patient records.

How we work with your compliance team

1. Identify the health dataWe list exactly what protected health information the software will store, display or send, and where it flows.
2. Bring in your advisorYour compliance officer or outside HIPAA advisor reviews the plan, including which vendor agreements are needed and who signs them.
3. Choose covered vendorsHosting, email, text messaging and file storage are chosen from providers that offer BAAs for the services used.
4. Design and build with safeguardsYou review clickable designs and then software built in rounds, with access controls, logging and encryption in place from the first round.
5. Support your documentationWe provide the technical details your risk assessment and policies need, such as where data is stored and how access is controlled.

Off-the-shelf healthcare tools vs. custom software

Established healthcare products such as EHRs, practice management systems and telehealth platforms have done much of this work already and will sign a BAA with your practice. If one of them fits your workflow, it is often the simpler path.

Custom software makes sense when your process does not fit those products, for example a specialty intake flow, a care program, a referral network or a health startup’s core product. In that case the safeguards have to be built in deliberately, and the hosting and vendor agreements have to be set up correctly, which is the work described above.

What it costs

Zoti custom projects start at $499/month, covering design, development, hosting and ongoing changes. Software that handles health information usually needs more careful hosting, logging and review than a typical app, and that is reflected in the written quote you get before work begins. Fees for your compliance advisor and any third-party assessments are separate.