HIPAA for health app startups
Whether HIPAA applies to your health app or digital health startup, what applies instead if it doesn't, and the early choices — cloud, email, AI APIs — that are hard to change later.
On this page
HIPAA for health app startups: at a glance
HIPAA applies to a health startup only if it is a covered entity — for example, a provider that bills insurance electronically — or a business associate that handles PHI on behalf of one. An app that consumers download and use for themselves is usually not covered by HIPAA, but the FTC Health Breach Notification Rule and state consumer health privacy laws can apply instead. The deciding question is who you work for: the patient, or a provider or health plan.
| Covered by HIPAA if | You are a covered entity, or handle PHI on behalf of one (business associate) |
|---|---|
| Consumer app, no provider involved | Usually not HIPAA — FTC Health Breach Notification Rule may apply |
| Patient connects your app to their records | Not a business associate just because of that (HHS guidance) |
| If you are a business associate | BAAs with customers and with vendors that touch PHI (cloud, email, AI APIs) |
| Not a HIPAA requirement | SOC 2 or a "HIPAA certification" — neither exists in the rules |
Who are you working for?
This page answers one question: does HIPAA apply to your business model? Once your product handles healthcare data with AI, the healthcare AI companies page covers roles, the BAA chain and permitted data uses.
HIPAA regulates covered entities — health plans, clearinghouses and providers that conduct standard electronic transactions — and their business associates: anyone who creates, receives, maintains or transmits PHI on a covered entity’s behalf (45 CFR 160.103). A startup is pulled in by its business model, not by the kind of data it holds.
HHS’s guidance for app developers turns on a few questions: Did a covered entity hire you or pay you? Does it direct you to collect or handle patient data? Or does the patient choose your app and use it for themselves?
| Your model | HIPAA status (typical) |
|---|---|
| Consumers download your app and enter their own data | Not covered by HIPAA |
| A patient connects your app to their provider’s records through an API, at their own request | Not a business associate because of that (HHS guidance) |
| A clinic or health plan licenses your app and you handle its patients’ data on its behalf | Typically a business associate |
| You provide care and bill insurance electronically | Typically a covered entity |
Many startups move between rows as they grow — a consumer app that adds a “share with your doctor” partnership, or a B2C product that starts selling to clinics. Re-check every time the business model changes. The Does HIPAA apply? tool walks through the same logic.
If HIPAA doesn’t apply, something else might
Health data outside HIPAA is not unregulated. The FTC Health Breach Notification Rule (16 CFR Part 318) applies to vendors of personal health records and related entities that are not covered by HIPAA; the FTC updated it in 2024 to make clear that it covers health apps and connected devices. It requires notifying users, the FTC and sometimes the media after a breach — and the FTC counts unauthorized sharing, such as sending health data to advertisers without permission, as a breach. Several states also have consumer health data laws. The rule does not apply to activities you carry out as a business associate.
If you are a business associate
From your first provider customer you need:
- A BAA with each customer that is a covered entity, and with each vendor that qualifies as your subcontractor business associate — typically cloud hosting, email, file storage, AI APIs and support tools that handle PHI for you. See business associate agreements.
- Services that are actually covered. Cloud and AI vendors’ BAAs cover named services only — check the list before building on a service. Compare HIPAA hosting and AI and LLM tools.
- A documented risk analysis and Security Rule safeguards, which apply to business associates directly.
If your product uses AI models, see also healthcare AI companies. The SaaS business associate page covers what running as a business associate involves once customers are live.
Using de-identified data
Data that meets HIPAA’s de-identification standard is no longer PHI, which is how many analytics and AI training projects stay outside the rules. It has to meet one of the two methods in 45 CFR 164.514 — removing names alone is not enough.
Main risks
- Assuming HIPAA doesn't apply, then signing a provider customer and discovering you are a business associate.
- Building on cloud services, email or AI APIs that the vendor's BAA doesn't cover.
- Treating a consumer app as unregulated and missing the FTC Health Breach Notification Rule or state health privacy laws.
- Analytics or advertising tools that disclose identifiable health information without permission or a BAA.
- Promising customers "HIPAA certification" — no such certification exists.
Requirements that matter most here
- Covered entity →§ 160.103What makes an organization a HIPAA covered entity, the three types, how the provider test works, and what covered entities must do.
- Business associate →§ 160.103Who counts as a HIPAA business associate, common examples including SaaS and cloud vendors, subcontractors, and what business associates must do.
- Business associate agreements (BAAs) →§ 164.502(e)A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate, and you need a signed BAA with it before it touches patient data. No BAA means you should not put PHI in that tool.
- PHI and ePHI →§ 160.103What counts as protected health information under HIPAA, how ePHI differs, what is excluded, and practical examples for small practices and health tech companies.
- Security risk analysis →§ 164.308(a)(1)(ii)(A)Every covered entity and business associate must document an accurate and thorough assessment of risks to the ePHI it holds — and then act on it. It is one of the most commonly missing pieces of HIPAA compliance, including in small practices.
- De-identification →§ 164.514(a)How HIPAA de-identification works — the Safe Harbor list of 18 identifiers and Expert Determination — and what it means for analytics, AI and research use of health data.
- Encryption of ePHI →§ 164.312(a)(2)(iv)Encryption is "addressable", not optional: you encrypt ePHI at rest and in transit where reasonable and appropriate, or document why not and use an equivalent alternative where that is reasonable. For email and cloud tools, encrypting is almost always the reasonable choice.
Solutions to look at
- HIPAA hosting and cloud platforms →ToolCloud platforms and managed hosts that sign a BAA — and the big difference between infrastructure you secure yourself and hosting where the provider runs the safeguards for you.
- AI tools and LLMs →ToolWhich AI assistants and model APIs sign a BAA — ChatGPT, Claude, Gemini, Copilot and healthcare-specific assistants — on which plans, and what you have to switch on before any patient information goes in.
- HIPAA email services →ToolEmail services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- Cloud storage and file sharing →ToolCloud storage services that sign a BAA — on which plans, how you put the agreement in place, and what you must configure before storing patient files.
- HIPAA compliance software →ToolPlatforms that help you run a HIPAA program — policies, risk analysis, staff training and vendor BAAs in one place — compared on what they actually include and whether they publish prices.
If something happens
- You're launching a health app →The HIPAA decisions to make before a health app or digital health product goes live — whether the rules apply, which vendors need a BAA, and what applies if HIPAA doesn't.
- You had a data breach →A misdirected email, a lost laptop, a hacked mailbox. What to do, in order, in the first days — and the deadlines that start running when you discover it.
Your path to compliance
- Confirm HIPAA applies to you and in which role — Does HIPAA apply?
- Put the requirements above in place, starting with a documented risk analysis.
- Choose how to do the work — yourself, with templates, software, a consultant or an attorney — compare every route.
Frequently asked questions
Does HIPAA apply to my health app?
Only if you are a covered entity or work for one. If a provider or health plan pays you or directs you to handle patient data, you are likely a business associate. If consumers use your app on their own, HIPAA usually doesn't apply, but the FTC's Health Breach Notification Rule may.
Can a startup get HIPAA certified?
No. HHS does not certify companies or products. You can show compliance through a documented risk analysis, policies, BAAs and, if customers ask, independent assessments such as SOC 2 — which is separate from HIPAA.
Do we need a BAA with our cloud provider?
Yes, if you are a business associate and the provider stores or processes PHI for you. AWS, Microsoft Azure and Google Cloud offer BAAs that cover a defined list of services.
When does a startup need to think about HIPAA?
Before you sign your first provider or health plan customer, and before any real patient data enters your systems — the vendor choices you make early are hard to undo.