HIPAA-Compliant Software Development: A Practical Checklist for Healthcare Startups

If your product creates, receives, stores or transmits protected health information (PHI) for a US covered entity, HIPAA applies to you, either directly or as a business associate. There is no official "HIPAA certification" for software, which surprises many founders. Compliance is a combination of how you build the product and how your organisation operates. This checklist translates the rules into work your team can plan.

This article is general information for product teams and not legal advice. Work with a qualified HIPAA compliance professional or attorney for your specific situation.

Start With the Basics: What Is PHI?

PHI is individually identifiable health information: names, contact details, dates, medical record numbers, diagnoses, images, billing information and any data that can reasonably identify a patient and relates to their health or care. Map exactly where PHI enters, moves through and leaves your system before you design anything else.

Technical Safeguards

• Access control: Unique user IDs, role-based access and the principle of least privilege, so each person sees only what their job requires.
• Authentication: Strong passwords or SSO, multi-factor authentication for administrators and anyone with access to PHI, and automatic session timeouts.
• Encryption: Encrypt PHI in transit (TLS) and at rest (for example, AES-256 on databases, file storage and backups). HIPAA treats encryption as an addressable specification, but in practice it is expected.
• Audit controls: Log every read, write, export and delete of PHI with user, time and device, and protect the logs from tampering.
• Integrity: Protect records from improper alteration and detect changes.
• Transmission security: No PHI in email bodies, SMS or unencrypted channels; secure APIs between systems.

Administrative Safeguards

• Risk analysis: Document threats and vulnerabilities to PHI and update the analysis regularly. This is one of the most commonly cited gaps.
• Policies and procedures: Written policies for access, incident response, backup and disaster recovery.
• Workforce training: Everyone who touches PHI is trained, and the training is recorded.
• Access management: A documented process for granting, reviewing and revoking access when staff change roles or leave.
• Vendor management: A signed Business Associate Agreement (BAA) with every vendor that handles PHI for you, including your cloud provider and any AI service.

Physical Safeguards

If you use a major cloud provider with HIPAA-eligible services and sign a BAA, much of the data-centre security is covered. You are still responsible for device security, workstation policies and securing the environments where your team works with PHI.

Engineering Practices That Make Compliance Easier

• Keep PHI out of logs, error messages, analytics tools and test data. Use synthetic data in development.
• Separate environments (dev, staging, production) with different credentials and no real PHI outside production.
• Back up regularly and test restores, with encrypted backups.
• Use infrastructure as code so your configuration is reviewable and repeatable.
• Run penetration tests before launch and after major changes.
• Define data retention and secure deletion rules.

Breach Readiness

Assume that something will eventually go wrong. Have an incident response plan with named roles, a way to identify what data was affected, and a process for notifying the covered entity, and where required, individuals and regulators, within the deadlines HIPAA sets. Practise the plan with a tabletop exercise at least once a year.

A Simple 90-Day Plan

1. 1Days 1 to 15: Map PHI flows, choose HIPAA-eligible infrastructure and sign BAAs.
2. 2Days 16 to 45: Implement access control, MFA, encryption and audit logging.
3. 3Days 46 to 70: Write policies, run the risk analysis and train the team.
4. 4Days 71 to 90: Penetration test, fix findings, run an incident drill and prepare your documentation for customers.