HIPAA-Compliant Software Development: A Practical Checklist for 2026

There’s no such thing as a HIPAA certificate for software. The Department of Health and Human Services doesn’t issue one, and no vendor badge can make an app compliant on its own. Compliance comes from how the software is designed, built, hosted, and run, and from the paperwork that proves you did it on purpose.

That’s why so many healthcare products run into trouble late. The team builds a solid app, then someone asks where the audit logs are, or whether the analytics tool on the patient portal has a business associate agreement, and suddenly the launch date moves by three months.

This checklist is for founders, product owners, and IT leaders planning HIPAA-compliant software development in 2026. It covers what to settle before the first line of code, the technical safeguards the app itself needs, and the operational pieces that teams most often forget.

The Short Answer

HIPAA-compliant software development means designing, building, hosting, and maintaining software in a way that supports compliance with the HIPAA Privacy, Security, and Breach Notification Rules when protected health information (PHI) is involved. This requires a documented risk analysis, appropriate business associate agreements (BAAs) where applicable, access controls, authentication, audit logging, secure hosting, security testing, and a documented incident response process. Encryption and other safeguards should be selected and implemented based on applicable HIPAA requirements and the organization’s risk analysis.

Who Actually Needs HIPAA Compliant Software?

HIPAA applies to covered entities, which are health plans, healthcare clearinghouses, and most healthcare providers, and to their business associates. A business associate is any company that handles PHI on their behalf. If you build or host software that stores patient data for a clinic, you’re almost certainly a business associate, and so is your cloud provider.

PHI is broader than medical records. A name tied to an appointment date counts. So does an email address linked to a prescription refill, or an IP address in a log file next to a diagnosis code. If your app can connect a person to their health information, plan as if HIPAA applies.

A consumer wellness app that users download on their own, with no link to a provider or health plan, may sit outside HIPAA. It will still face other rules, such as the FTC Health Breach Notification Rule and state privacy laws, so get proper legal advice before assuming you’re exempt.

A Note On The 2026 Security Rule Update

HHS published a proposed overhaul of the HIPAA Security Rule at the end of December 2024. It would make encryption and multi-factor authentication required rather than “addressable,” and it adds asset inventories, regular vulnerability scans, annual penetration testing, and tighter recovery timelines. As of late 2026, that rule is still a proposal, and the current Security Rule is what’s being enforced.

Our advice is to build to the proposed standard anyway. Encryption and MFA are already expected under any honest risk analysis, cyber insurers increasingly ask for them, and retrofitting them into a live product is far more painful than designing them in.

Before You Write Any Code

Run A Risk Analysis

The Security Rule requires a documented risk analysis. For a new product, that means listing where PHI will enter the system, where it’s stored, who can see it, where it travels, and what could go wrong at each step. This document drives every design decision after it, and it’s one of the first things an auditor asks to see.

Map Your Data Flows

Draw the path of PHI through the app, the database, the backups, the logs, email and SMS notifications, third-party APIs, and analytics. Teams almost always find a surprise here, usually a logging tool or crash reporter quietly collecting patient data.

Sign a BAA Before PHI Touches A Vendor

Every vendor that stores or processes PHI needs a business associate agreement. That includes your cloud host, database service, email provider, SMS gateway, support desk tool and any AI service you send data to. The major cloud providers offer BAAs, but they usually cover only specific HIPAA-eligible services, so check the list before you pick a managed product.

Apply The Minimum Necessary Rule

Collect and show only the PHI each feature needs. A scheduling screen rarely needs a diagnosis. A billing export rarely needs clinical notes. Less data in each place means less damage if something goes wrong.

The HIPAA-Compliant Software Development Checklist

Access Control And Authentication

• Give every user a unique login, with no shared accounts, including for internal support staff
• Use role-based access so people see only the records their job requires
• Turn on multi-factor authentication for all users who can reach PHI, and always for admins
• Add automatic logoff after inactivity, especially on shared clinic workstations
• Build an emergency access procedure, so clinicians can reach records during an outage, with every use logged
• Remove access the same day someone leaves or changes roles

Encryption

• Encrypt PHI at rest in databases, file storage, and backups (AES-256 is the common standard)
• Encrypt PHI in transit with current TLS, including traffic between your own internal services
• Manage keys through a proper key management service, never hard-coded in the source
• Encrypt local data on mobile devices, and allow a remote wipe for lost devices

Encryption also matters after an incident. Under HHS guidance, PHI that was properly encrypted and whose keys weren’t exposed isn’t treated as “unsecured,” which can remove the obligation to notify patients of a breach.

Audit Logs And Integrity

• Log who viewed, created, changed or deleted PHI, and when
• Protect logs from tampering, and store them separately from the application database
• Keep PHI out of the log messages themselves, using record IDs instead of names or diagnoses
• Review logs on a schedule, with alerts for unusual patterns such as one user opening hundreds of records
• Use checksums or database controls to show records weren’t altered without authorization

Hosting And Infrastructure

• Host only on services covered by your provider’s BAA
• Separate production from development and testing, and never copy real PHI into test environments
• Restrict network access with private subnets, firewalls, and least-privilege cloud permissions
• Run encrypted, automated backups, and test restoring them, not only creating them
• Keep an inventory of every system and data store that holds PHI

App-Level Privacy Details

• Keep PHI out of push notifications, email subject lines, and SMS text. “You have a new message” is safe; a lab result is not
• Check every third-party script, analytics tool, and tracking pixel on logged-in pages, because many of them collect data you never meant to share
• Mask sensitive fields on screen where full values aren’t needed
• Make sure PHI isn’t cached in browsers or stored in plain text on devices

For mobile products, these details matter even more. Our healthcare mobile app development work starts with a list of what may and may not appear on a lock screen.

Testing And Security Reviews

• Run automated security scans in the build pipeline
• Do vulnerability scans on a regular schedule and penetration testing at least once a year
• Include security checks in code review for every change that touches PHI
• Review AI-generated code with the same care as human code. A model can write code that works and still breaks a rule it was never told about, a risk we covered in our look at AI-enabled software development

Breach Response And Documentation

• Write an incident response plan that names who does what in the first hour
• Know the notification rules: affected individuals must be told without unreasonable delay and no later than 60 days after discovery, and breaches affecting 500 or more people also go to HHS and the media
• Keep policies, risk analyses and security decisions in writing for at least six years
• Train everyone with PHI access, including developers and support staff, and record that they finished the training

Mistakes We See Most Often

The most common one is treating compliance as a launch-week task. By then the database design, the logging setup and the vendor list are already locked in, and every fix means rework.

The second is trusting the cloud provider to handle it. Hosting on a HIPAA-eligible service covers the infrastructure layer. It doesn’t configure your access controls, encrypt your exports or stop a developer from logging patient names.

The third is forgetting the people around the software. Support agents who screen-share with patients, sales demos that use real data, spreadsheets exported for a quick report. Most real-world breaches start with ordinary shortcuts like these, not clever hackers.

Building For Canada As Well

Many healthcare products now serve both the US and Canada. Canada has no single HIPAA equivalent. Federal privacy law (PIPEDA) applies to many private organizations, while provinces have their own health privacy laws, such as Ontario’s PHIPA. A product built to the checklist above covers most of the technical ground, but data residency, consent and breach reporting rules differ, so map them early if Canadian users are in your plans.

How Maple Software Approaches HIPAA-Compliant Software Development

At Maple Software, compliance starts in the first planning session, before anyone estimates a timeline. We map PHI flows, settle the vendor list and BAAs, and design access and audit logging into the architecture rather than adding them later. Every change that touches patient data goes through code review and our ISO 9001:2015 quality process, whether a person or an AI tool wrote it. If you’re planning a healthcare product, our HIPAA-compliant software development services page explains how we work, and our guide on how to choose a custom software development company covers the questions to ask any vendor.

Frequently Asked Questions

Is There An Official HIPAA Certification For Software?

No. HHS doesn’t certify software or vendors. Some third parties offer assessments or attestations, which can be useful evidence, but compliance depends on how the software is built and operated and on your documented safeguards.

Does Using AWS, Azure Or Google Cloud Make My App HIPAA Compliant?

Not on its own. These providers will sign a BAA for their HIPAA-eligible services, which covers the infrastructure. You’re still responsible for access control, encryption settings, logging, application security and your own policies.

Is Encryption Required Under HIPAA?

Under the current Security Rule, encryption is an “addressable” specification, which means you must implement it or document why an equivalent measure is reasonable. In practice, almost every organization should encrypt. The proposed 2026 update would make it required outright.

How Much Does HIPAA Compliant Software Development Cost?

It depends on the product’s scope, but compliance work usually adds to discovery, architecture, testing and documentation. Building it in from the start costs far less than retrofitting a live product after an audit or breach.

Can I Use AI Tools With Patient Data?

Only if the AI service is covered by a BAA and configured so your data isn’t retained or used for training outside that agreement. Never paste PHI into a consumer AI tool.

Start with the risk analysis and the vendor list. If those two documents are solid, most of the checklist above becomes engineering work your team already knows how to do.