HIPAA-Compliant Software Development
We’ve shipped HIPAA-architected AI healthcare apps. BAA available. Compliance baked into architecture from week one, not bolted on after audit.
Our status against HIPAA
Compliant builds
We ship products that meet HIPAA technical safeguards. We are not HIPAA "certified" because HIPAA is a regulation, not a certification.
| Requirement | Status | Note |
|---|---|---|
| HIPAA Privacy Rule | Met | Team trained, patterns documented. |
| HIPAA Security Rule | Met | Technical safeguards architected into every build. |
| HITECH Act | Met | Breach notification workflows in place. |
| BAA availability | Met | We sign a BAA for our role as business associate. |
| HIPAA-trained engineers | Met | All engineers on healthcare projects complete HIPAA training. |
| Annual risk assessment | Partial | We do per-project assessments; not a formal annual organizational assessment yet. |
Compliance architected from week one, not bolted on after
What this means for your build
- We architect for HIPAA from day one, not as a retrofit after audit.
- We sign a BAA for our role as business associate handling PHI during development and support.
- We follow the HIPAA Security Rule for technical safeguards: encryption at rest and in transit, access controls, and audit logging.
- We don’t share PHI internally beyond the engineers actively assigned to your project.
- We can advise on HIPAA architecture, but we are not lawyers; formal HIPAA opinions require a healthcare compliance attorney.
How we ship HIPAA-compliant code
Encryption at rest
AES-256, AWS KMS or equivalent, encrypted DB volumes, and encrypted S3 buckets.
Encryption in transit
TLS 1.3, certificate pinning where appropriate, and no plaintext PHI in logs.
Access controls
RBAC, principle of least privilege, named IAM roles, and time-bounded access.
Audit logging
Immutable audit trail for all PHI access, with CloudWatch + S3 storage and retention.
PHI segregation
PHI separated from non-PHI in the data architecture: never in logs, never in URLs.
BAA-eligible services only
Only HIPAA-eligible AWS / GCP / Azure services used in PHI-handling pipelines.
What HIPAA does NOT cover
- HIPAA is US-only; international privacy requires GDPR / UK GDPR / regional regulations.
- HIPAA does not address AI-specific risks such as model leakage or training-data privacy.
- HIPAA covers PHI handling, not clinical safety; FDA SaMD is a separate regulatory regime.
- HIPAA compliance is not HITRUST certification; HITRUST is a separate framework.
- HIPAA does not strictly require encryption (safeguards are "addressable"); we always encrypt anyway.
When you need a separate consultant
We engineer for HIPAA; we are not a law firm or a certifying body. Bring in a specialist when you need:
- A formal HIPAA legal opinion → a healthcare compliance attorney.
- A HIPAA risk assessment or formal documentation → a HIPAA compliance consultant (e.g. HIPAA One, Compliancy Group).
- HITRUST certification → a HITRUST-authorized assessor.
- FDA SaMD pre-submission → an FDA regulatory consultant.
- We can recommend specific consultants on request.
Industries where HIPAA applies
AI Healthtech
Clinical assistants, triage, mental-health companions, and medical-document workflows.
- Clinical copilots
- Triage + intake
- Mental-health companions
AI Fintech
Health-insurance products and benefits platforms that touch PHI.
- Health-insurance underwriting
- Benefits + claims platforms
- Eligibility + enrolment
Work we've shipped with HIPAA requirements
Free tool
HIPAA Stance Builder
Answer a few questions about your product and PHI flows, and get a tailored summary of the HIPAA technical safeguards your build needs.
Build your HIPAA stance
Infrastructure under controls
Compliance lives in the architecture, not in a policy document
Encryption at rest, access controls, audit logging, and immutable decision trails are wired into the build from the first sprint. The posture on this page reflects how we actually ship.
Frequently asked questions
No, and neither is anyone, honestly. HIPAA is a federal regulation, not a certification. We ship HIPAA-compliant builds that meet the technical safeguards of the Security Rule, and we sign a BAA for our role as business associate.
Building HIPAA-regulated healthcare software? Schedule a meeting.
No account managers. A direct conversation about your PHI flows, your architecture, and what it takes to ship a HIPAA-compliant build with a signed BAA.