You're launching a health app
The HIPAA decisions to make before a health app or digital health product goes live — whether the rules apply, which vendors need a BAA, and what applies if HIPAA doesn't.
At a glance
Before launching a health app, decide whether HIPAA applies: it does if you are a covered entity or handle PHI on behalf of one as a business associate. If it applies, sign BAAs with customers and with vendors that qualify as your business associates, document a risk analysis and policies, and make sure only covered services are used. If it doesn't, check the FTC Health Breach Notification Rule and state health privacy laws, and make sure analytics and advertising tools don't receive identifiable health data without permission.
| First question | Are you a covered entity, a business associate, or neither? |
|---|---|
| If business associate | BAAs with customers and vendors, risk analysis, policies, Security Rule safeguards |
| If neither | FTC Health Breach Notification Rule and state laws may apply |
| Common launch mistake | Analytics or ad pixels sending health data to third parties |
| Not available | Official "HIPAA certification" for apps |
What to do, in order
- Map who pays you and who directs the data: consumers, providers, health plans, or employers. That decides whether you are a covered entity, a business associate or neither.
- If HIPAA doesn't apply, check the FTC Health Breach Notification Rule and the state consumer health privacy laws in the states you serve.
- List every place health data will go: hosting, database, email and SMS, file storage, AI APIs, logging, analytics, support tools.
- If you are a business associate, sign a BAA with each vendor that qualifies as your subcontractor business associate, and confirm the services you use are covered.
- Review analytics, ad pixels and session replay so identifiable health information is not disclosed in a way HIPAA, the FTC rules or your own privacy promises don't allow.
- Write down your risk analysis, security policies and breach response plan before real patient data arrives.
- Prepare your own BAA for provider customers and a short security overview for their questionnaires.
- Re-check the whole list when you add a new customer type, feature or vendor.
The HIPAA question for an app is decided by the business model, not by the data: the same heart-rate data can be PHI when the app handles it on a clinic’s behalf, and fall outside HIPAA when a consumer uses the app for themselves. What counts is who the app is acting for. The health app startup page explains the scenarios in more detail.
Note on tracking: in 2024 a federal court in American Hospital Association v. Becerra vacated part of HHS’s tracking-technology guidance — the part about unauthenticated public web pages. The rest of the guidance, including tracking inside logged-in apps and patient portals, still describes how HHS reads the rules.
Tools that help
- HIPAA hosting and cloud platforms →ToolCloud platforms and managed hosts that sign a BAA — and the big difference between infrastructure you secure yourself and hosting where the provider runs the safeguards for you.
- AI tools and LLMs →ToolWhich AI assistants and model APIs sign a BAA — ChatGPT, Claude, Gemini, Copilot and healthcare-specific assistants — on which plans, and what you have to switch on before any patient information goes in.
- HIPAA email services →ToolEmail services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- HIPAA compliance software →ToolPlatforms that help you run a HIPAA program — policies, risk analysis, staff training and vendor BAAs in one place — compared on what they actually include and whether they publish prices.
Relevant requirements
- Covered entity →§ 160.103
- Business associate →§ 160.103
- Business associate agreements (BAAs) →§ 164.502(e)
- Security risk analysis →§ 164.308(a)(1)(ii)(A)
- De-identification →§ 164.514(a)
- Encryption of ePHI →§ 164.312(a)(2)(iv)
Applies to
Frequently asked questions
Do I need to be HIPAA compliant before launching?
If you will handle PHI for a covered entity from day one, yes — you need BAAs and safeguards before real patient data arrives. If your first version is consumer-only, HIPAA may not apply yet, but other laws can.
Can we use Google Analytics or Meta pixels in a health app?
Be careful. HHS has warned covered entities and business associates about tracking technologies that send PHI to third parties, and the FTC treats unauthorized sharing of health data by non-HIPAA apps as a breach. Keep health data out of tracking tools unless the vendor signs a BAA and the use is permitted.