HIPAA Compliance for Engineering Teams

Building healthcare software means navigating one of the most stringent regulatory frameworks in tech: HIPAA (Health Insurance Portability and Accountability Act). Unlike SOC 2, HIPAA is federal law with civil and criminal penalties for violations.

What is PHI?

Protected Health Information (PHI) is any information that can identify an individual and relates to their health:

• Names, addresses, dates (birth, admission, discharge, death)
• Medical record numbers and health plan beneficiary numbers
• Biometric identifiers (fingerprints, voice prints)
• Full face photos and any unique identifying numbers

Even IP addresses or device IDs can be PHI if they're linked to health information.

HIPAA's Three Main Rules

1. Privacy Rule - Controls how PHI can be used and disclosed. Requires patient consent for most uses.

2. Security Rule - Mandates administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

3. Breach Notification Rule - Requires notification to affected individuals, HHS, and sometimes media when ePHI is breached.

Technical Controls Required

Encryption Everywhere

At Rest:

# Example: Field-level encryption for PHI
from cryptography.fernet import Fernet

class PHIEncryption:
    def __init__(self):
        self.key = os.environ.get('PHI_ENCRYPTION_KEY').encode()
        self.cipher = Fernet(self.key)

    def encrypt_phi(self, data: str) -> bytes:
        return self.cipher.encrypt(data.encode())

    def decrypt_phi(self, encrypted_data: bytes) -> str:
        return self.cipher.decrypt(encrypted_data).decode()

In Transit:

• TLS 1.3 minimum for all connections
• No exceptions for internal APIs (defense in depth)
• Certificate pinning for mobile apps

Access Controls

Implement role-based access control (RBAC) with least privilege:

const PERMISSIONS = {
  doctor: ['read:phi', 'write:phi', 'read:lab_results'],
  nurse: ['read:phi', 'write:vitals'],
  admin: ['read:phi', 'manage:users'],
  billing: ['read:billing_info', 'read:insurance']
};

function requirePermission(permission: string) {
  return (req, res, next) => {
    const userPermissions = PERMISSIONS[req.user.role] || [];

    if (!userPermissions.includes(permission)) {
      auditLog({
        userId: req.user.id,
        action: 'UNAUTHORIZED_ACCESS_ATTEMPT',
        resource: req.path
      });
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    next();
  };
}

Audit Logging

HIPAA requires detailed audit trails of PHI access:

CREATE TABLE phi_access_log (
    id BIGSERIAL PRIMARY KEY,
    user_id VARCHAR(255) NOT NULL,
    patient_id VARCHAR(255) NOT NULL,
    action VARCHAR(50) NOT NULL,
    resource_type VARCHAR(100) NOT NULL,
    ip_address INET NOT NULL,
    timestamp TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

Session Management

• Automatic logout after 15 minutes of inactivity
• No "remember me" functionality for PHI access
• Require re-authentication for sensitive operations

Business Associate Agreements (BAAs)

Any third-party service that processes PHI needs a signed BAA:

• Cloud providers (AWS, GCP, Azure all offer BAAs)
• Error tracking (Sentry)
• Email and SMS providers

Never send PHI to services without BAAs.

Common Pitfalls

1. Logging PHI - Never log sensitive data. Redact before logging
2. Development environments - Don't use real PHI in dev/staging
3. Backups - Encrypted backups, secure deletion when expired
4. Employee offboarding - Immediate access revocation
5. Mobile devices - Require device encryption, remote wipe capability

Infrastructure Checklist

• Encryption at rest for all databases
• TLS 1.3 for all data in transit
• MFA for all user accounts
• Automatic session timeout (15 min)
• Comprehensive audit logging
• Regular access reviews (quarterly)
• Penetration testing (annually)
• Incident response plan documented
• BAAs signed with all vendors
• Employee HIPAA training (annually)

Tools and Services

HIPAA-Compliant Cloud: AWS, Google Cloud Platform, Microsoft Azure (all with BAA)

Compliance Automation: Vanta, Drata, Aptible

Security Tools: HashiCorp Vault, AWS CloudHSM, OWASP ZAP

Conclusion

HIPAA compliance is not a one-time checkbox. It requires ongoing vigilance, regular audits, and a culture of security. Start with encryption, implement comprehensive audit logging, and ensure every vendor has a BAA.

---

Need help achieving HIPAA compliance? Schedule a consultation to discuss your healthcare application's security requirements.