What is HIPAA?
Teams shop for a 'HIPAA-compliant' database or a 'HIPAA-compliant' API and stop there. But the law does not certify products. It judges the system you built around them.
HIPAA
Health Insurance Portability and Accountability Act
HIPAA, the Health Insurance Portability and Accountability Act, is a 1996 US federal law that sets rules for protecting patient health information. It applies to covered entities, such as hospitals and health plans, and to the business associates that handle that data on their behalf.
HIPAA's rules for software mostly live in two places. The Privacy Rule, at 45 CFR Part 164 Subpart E, controls who may see or share protected health information. Its Security Rule, at Subpart C of the same part, sets the safeguards a system needs to keep electronic health data confidential and intact.
Neither rule names a product. Access control, audit controls and transmission security are required, but the exact mechanism is left to the organization. That is deliberate. Software tied to one product would be obsolete fast. It also means a vendor's claim of being 'HIPAA compliant' describes an intention, not a status the law hands out.
Compliance sits with the covered entity and its business associates. It gets judged as a whole system. That means the database, the code, the logs, the staff who can query it, and every vendor contract in between. A well-built database is one input. It is not the answer.
"HIPAA-compliant software" is not a thing you can buy
Buyers search for a HIPAA-compliant host or a HIPAA-compliant AI model, hoping the label transfers to whatever they build on top. It does not. Compliance describes how an organization runs a system, that vendor included. It is not a certificate stamped on a product page.
A cloud provider can offer every control HIPAA requires and sign the agreement. Your application built on top can still fail an audit. The gap is usually a part no vendor owns. Which staff accounts can query patient records. How long a debug log keeps request bodies. Whether an AI feature sends full records to a model with no agreement in place.
This is the correction worth remembering: HIPAA governs your whole system and every contract feeding it, not a checkbox on a pricing page. Ask what the product's compliant tier covers, then ask what your own code does with the data once it leaves that tier.
- 01The Privacy Rule controls who may access or share health information.
- 02Its Security Rule sets required safeguards, without naming the tools that provide them.
- 03A business associate agreement extends the duty to every vendor that touches the data.
- 04No vendor certification substitutes for the covered entity's own risk analysis.
- Data entersPatient record created or received.
- Access controlledRole-based, logged per user.
- Vendors boundBAA signed with every processor.
- Transit and storage encryptedIn motion and at rest.
- Risk analysis runDocumented, not assumed.
Most audits fail at the third node. A model API or an analytics tool added after launch is a new business associate, and it needs its own agreement before patient data reaches it.
Related questions
01Does HIPAA apply to my app?
It applies if you are a covered entity, such as a provider or health plan, or a business associate handling health data on one's behalf. A consumer wellness app with no covered entity behind it usually falls outside HIPAA. Other privacy laws can still apply. Check who the data ultimately serves, not only what the app tracks.
02Is a HIPAA-compliant cloud provider enough on its own?
No. A provider can offer the required safeguards and a signed business associate agreement, and your application can still misuse the data on top of it. Compliance is judged across the whole system, including your own code, your staff access and your other vendors.
03What is the penalty for a HIPAA violation?
Penalties are tiered by the level of culpability, set out at 45 CFR 160.404. The dollar figures are adjusted for inflation on a schedule HHS sets. Check the current figures against HHS's published table rather than assume them from memory.
