How to Build a HIPAA Compliant Health App: Complete Guide

Key Takeaways

• HIPAA applies to any app handling protected health information (PHI) for covered entities
• Three pillars: encryption, access controls, and audit logging are non-negotiable
• Shared responsibility: your cloud provider covers infrastructure, you cover application security
• Common pitfalls: logging PHI, unencrypted backups, missing business associate agreements
• Real impact: Axiosware's HIPAA-compliant apps achieve zero data breaches across 12+ healthcare clients

What Counts as PHI?

HIPAA defines PHI broadly. Any of these combined with health data triggers compliance:

• • Names, addresses, phone numbers
• • Email addresses, Social Security numbers
• • Medical record numbers, device IDs
• • Dates (birth, admission, discharge)
• • Biometric identifiers, full-face photos

Even seemingly anonymous data like symptom logs become PHI when tied to a user identity.

Frontend: Next.js 14 with App Router, React 18, TypeScript strict mode

Backend: Supabase (HIPAA-eligible with BAA) or AWS with HIPAA-eligible services

Database: PostgreSQL with encryption at rest, never store PHI in client-side storage

Auth: Clerk or Supabase Auth with MFA enforcement, session timeout < 15 minutes

File Storage: S3 or Supabase Storage with server-side encryption, signed URLs only

Logging: CloudWatch or Supabase logs, never log PHI to stdout or error trackers

Access Control Implementation

Role-based access control (RBAC) is mandatory. Here's a practical implementation pattern:

// lib/hipaa/access-control.ts

export async function requirePHIAccess(
  user: User,
  targetPatientId: string,
  requiredRole: 'patient' | 'provider' | 'admin'
): Promise {
  // 1. Verify user is authenticated
  if (!user || !user.isAuthenticated) {
    throw new Error('Unauthorized: authentication required');
  }

  // 2. Check role assignment
  if (user.role !== requiredRole && user.role !== 'admin') {
    await auditLog({
      userId: user.id,
      action: 'ACCESS_DENIED',
      resource: `patient/${targetPatientId}`,
      reason: 'insufficient_role'
    });
    throw new Error('Unauthorized: insufficient permissions');
  }

  // 3. Verify patient ownership or provider assignment
  const access = await verifyPatientAccess(user.id, targetPatientId);
  if (!access.granted) {
    await auditLog({
      userId: user.id,
      action: 'ACCESS_DENIED',
      resource: `patient/${targetPatientId}`,
      reason: 'patient_mismatch'
    });
    throw new Error('Unauthorized: patient mismatch');
  }

  // 4. Log successful access
  await auditLog({
    userId: user.id,
    action: 'PHI_ACCESS',
    resource: `patient/${targetPatientId}`,
    timestamp: new Date().toISOString()
  });
}

Logging PHI Accidentally

The most common HIPAA violation we see: developers logging request bodies for debugging. Never log user data, especially PHI. Use request IDs instead:

// ❌ WRONG - logs PHI to console
console.log('User data:', req.body); 

// ✅ CORRECT - log only request ID
const requestId = crypto.randomUUID();
logger.info('Request received', { requestId, endpoint: req.path });

Client-Side Storage

Never store PHI in localStorage, sessionStorage, or IndexedDB. If your app caches data for offline access, use encrypted storage with automatic wiping on logout. We use React Native SecureStore for mobile apps.

Third-Party Analytics

Google Analytics, Mixpanel, and similar tools cannot receive PHI. Configure them to strip all user identifiers before sending data. Better yet, use HIPAA-compliant analytics or skip client-side analytics entirely for patient-facing features.

Missing Business Associate Agreements

If you use any third-party service that could access PHI (hosting, email, support tools), you need a BAA signed with that vendor. AWS, Google Cloud, and Supabase offer BAAs, but many SaaS tools don't. Verify before you integrate.

Challenge

A regional healthcare network needed a patient portal for appointment scheduling, secure messaging, and lab results viewing. They were using paper records and phone calls, resulting in 48-hour average response times for patient inquiries.

Solution

We built a HIPAA-compliant Next.js application with:

• • End-to-end encryption for all patient-provider messages
• • MFA enforcement for all provider accounts
• • Automated audit logging for every PHI access
• • 15-minute session timeout with biometric unlock on mobile
• • Integration with existing EHR via HL7 FHIR API

Results

Within 3 months of launch:

• 92% reduction in phone call volume for appointment scheduling
• 12-hour average response time for patient inquiries (down from 48 hours)
• Zero security incidents or compliance violations in 18 months
• 87% patient adoption rate within first quarter

Pre-Launch

• ☐ Risk assessment completed and documented
• ☐ All BAAs signed with cloud providers and third parties
• ☐ Encryption at rest and in transit verified
• ☐ MFA enabled for all accounts
• ☐ Audit logging configured and tested
• ☐ Session timeout configured (<15 minutes)
• ☐ No PHI in logs, error trackers, or analytics
• ☐ Incident response plan documented
• ☐ Workforce training completed

Ongoing

• ☐ Annual risk assessments
• ☐ Quarterly access reviews
• ☐ Monthly audit log reviews
• ☐ Annual workforce security training
• ☐ BAAs renewed before expiration
• ☐ Security patching within 7 days of release