How to Make an App HIPAA-Compliant

The first step is to figure out if the app's going to require HIPAA compliance at all.

If the answer is "yes", then before initiating the development, it's important to take care of the following procedures:

• (If you outsource app development, modernization, or compliance testing) Sign a Business Associate Agreement (BAA) with service providers who have access to PHI.
• Appoint a compliance consultant overseeing the development process or outsource compliance consulting to a competent vendor.
• Ensure all the discovery team members are experienced in translating compliance requirements into software requirements.
• Prepare the development team to keep exhaustive documentation of the process (detailed software architecture, encryption methods, access policies, etc.).
• Plan the main software user roles (patients, physicians, admins) and the corresponding access rights and permissions.

• Ensure secure and highly redundant infrastructure. If you're using cloud services, choose a HIPAA-compliant provider (e.g., Azure or AWS).
• Install and configure firewalls, anti-malware, IDS/IPS to secure the networks.
• Enable at-rest and in-transit data encryption.
  ScienceSoft's tip: Sometimes, when at-rest encryption is enabled on the application level, it can affect the app's performance, so file-level or block-level encryption may be a better alternative.
• Implement access controls such as user authentication and authorization, automatic logoff, etc. For instance, for HIPAA-compliant mobile apps, biometric authentication can be enabled.
• Create a break-glass account for emergency access to sensitive patient data, as well as data backup and recovery procedures.
• Integrate audit controls to record any interactions with ePHI.
• Ensure secure communication protocols to protect in-transit data.
• Implement integrity controls to prevent improper ePHI alteration or destruction.
• Provide mechanisms for identifying and notifying users about PHI breaches, e.g., ML-powered scanning of the app for unusual activities.

ScienceSoft recommends regularly carrying out the following activities:

• Using the roles matrix to evaluate the risks related to different operations (viewing, adding, deleting, and modifying ePHI)
• Conducting the vulnerability assessment and penetration testing of the app and its infrastructure.
• Performing an automated code review to reveal encryption errors, cross-site scripting vulnerabilities, etc.
• Manually assessing the auditing, logging, and data validation mechanisms, the security of communication, etc.
• Checking if the obfuscation and serialization filtering are in place.
• Simulating SQL and script injections.

• Prepare user guides on how to operate the software without endangering ePHI.
• Carry out regular security and HIPAA compliance checks.
• If any changes are introduced to the software, revise and update documentation accordingly.

It can be conducted before deployment or at any stage of the application lifecycle before the upcoming audit. ScienceSoft's compliance consultants recommend including the following activities in the pre-audit:

• Vulnerability assessment and pentesting.
• Checking audit logging.
• Verifying the presence of obfuscation and serialization filtering.
• Evaluating data validation mechanisms, the security of communication, etc.
• Access and integrity controls assessment.

• Checking if any medical software functionality changed after deployment and modifying the documentation accordingly.