Building healthcare software means navigating HIPAA—the Health Insurance Portability and Accountability Act. For developers, HIPAA compliance isn't just checkbox security; it's a fundamental architecture requirement that affects every layer of your application.

This guide covers the technical safeguards required for HIPAA compliance in 2025. We've built HIPAA-compliant patient portals, telemedicine platforms, and clinical tools. Here's what actually matters when you're writing code that handles Protected Health Information (PHI).

Understanding PHI and Scope

Protected Health Information is any individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate. In practical terms:

If your application stores, processes, or transmits this data on behalf of a healthcare provider, insurer, or clearinghouse, you're subject to HIPAA requirements.

Technical Safeguards: The Implementation Checklist

HIPAA's Security Rule mandates specific technical safeguards. Here's how to implement each one:

1. Access Control (§164.312(a))

Unique User Identification
Every user must have a unique identifier. No shared accounts. Implement UUID-based user identification with strict session management.

// User identification requirements
- Unique UUID per user
- No shared service accounts for user access
- Automatic session timeout after 15 minutes inactivity
- Concurrent session limits (prevent account sharing)

Role-Based Access Control (RBAC)
Implement granular permissions. A nurse shouldn't access billing records. A billing clerk shouldn't see clinical notes. Your authorization layer should enforce these boundaries at the API level.

Emergency Access Procedure
Build a "break-glass" mechanism for emergency situations where normal access controls would impede patient care. Log all emergency access with mandatory justification.

2. Audit Controls (§164.312(b))

Every access to PHI must be logged. This isn't just authentication logs—you need application-level audit trails:

// Required audit log fields
{
  "timestamp": "2025-03-18T10:30:00Z",
  "user_id": "uuid-of-user",
  "action": "VIEW|CREATE|UPDATE|DELETE|EXPORT",
  "resource_type": "patient_record|lab_result|prescription",
  "resource_id": "uuid-of-resource",
  "patient_id": "uuid-of-patient",
  "ip_address": "192.168.1.100",
  "user_agent": "Mozilla/5.0...",
  "success": true|false,
  "justification": "required_for_emergency"
}

Store audit logs immutably. Use append-only storage with cryptographic verification. Retain for 6 years minimum.

3. Integrity Controls (§164.312(c))

PHI must not be altered or destroyed in unauthorized ways. Implement:

4. Transmission Security (§164.312(e))

Encryption in Transit
TLS 1.3 is mandatory. No exceptions. Configure your servers to reject older protocols:

// Nginx SSL configuration
ssl_protocols TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
ssl_prefer_server_ciphers off;
hsts max-age=63072000; // 2 years

Encryption at Rest
All PHI must be encrypted when stored. Use AES-256-GCM with proper key management:

Business Associate Agreements (BAAs)

You cannot use any third-party service that touches PHI without a signed BAA. This includes:

// baa_warning

Slack, Datadog, and most analytics platforms will NOT sign BAAs for their standard offerings. You need their HIPAA-compliant tiers (often enterprise plans) or self-hosted alternatives.

Recommended Architecture Stack

Based on our production experience, here's a HIPAA-compliant reference architecture:

// HIPAA-Compliant Stack
Infrastructure: AWS with BAA (GovCloud for highest security)
Container Orchestration: ECS Fargate or EKS with encryption
Database: RDS PostgreSQL with encryption at rest + TDE
Caching: ElastiCache Redis with encryption in transit + at rest
File Storage: S3 with server-side encryption (SSE-KMS)
Secrets Management: AWS Secrets Manager with automatic rotation
Monitoring: CloudWatch Logs with encryption
CDN: CloudFront with field-level encryption

Application Layer:
- Authentication: Auth0 HIPAA-compliant tier or AWS Cognito
- API: Node.js/Python with strict input validation
- Encryption: AWS KMS for key management
- Audit: CloudWatch Logs with log integrity verification

Authentication Requirements

HIPAA requires strong authentication:

Data Minimization and De-identification

HIPAA requires that you only access the minimum necessary PHI. Implement:

Incident Response

Breach notification requirements are strict:

Your application must have mechanisms to detect, report, and respond to security incidents. Build automated alerting for:

Compliance Verification

✓ Signed BAAs with all vendors processing PHI
✓ End-to-end encryption (TLS 1.3 in transit, AES-256 at rest)
✓ Comprehensive audit logging with 6-year retention
✓ Role-based access control with unique user IDs
✓ Multi-factor authentication for all users
✓ Automatic session timeouts (15 minutes)
✓ Data integrity controls (checksums, versioning)
✓ Incident response procedures and breach notification
✓ Regular security risk assessments

Cost of Non-Compliance

HIPAA violations are expensive:

Criminal penalties can include up to 10 years imprisonment for intentional wrongful disclosure.

Building Healthcare Software?

We've built HIPAA-compliant patient portals, telemedicine platforms, and clinical tools. We understand the technical requirements and can guide you through the compliance process from architecture to audit.

Discuss Your Healthcare Project →