HIPAA-aware app development: what to ask your vendor

No software vendor can hand you a HIPAA compliant app. Compliance is an organisational responsibility: it covers your policies, your staff training, your contracts and how your product is operated, not just the code. What a good vendor can do is build with those requirements in mind and answer specific questions honestly. This post lists the questions to ask. It is general information, not legal advice, so involve your own counsel or compliance advisor.

What we can and cannot say

To be clear about our own position: Netnexs is not HIPAA certified, and we do not claim to be. We have built healthcare-adjacent software, including AIRE Health, a US dermatology marketplace where physicians build branded stores of vetted products. That project included physician onboarding with identity verification flows and CMS tooling, and it runs in production.

That experience means we understand access control, identity checks and content management in a healthcare setting. It does not replace a compliance programme, and any vendor who tells you otherwise is overselling.

Contracts and subcontractors

Start with paper. If your app will create, receive, store or transmit protected health information, the rules generally require a business associate agreement with vendors who handle it on your behalf. Ask whether your vendor will sign one, and ask them to explain, in plain language, which of their people will ever touch real patient data. Often the answer should be nobody, because development can run on synthetic data.

Then ask about subcontractors. Which freelancers, agencies or cloud services sit behind your vendor? Each one that touches protected data may need its own agreement. A vendor who cannot list their subcontractors has not thought about this yet.

Access control and audit logs

Ask how roles and permissions are modelled. You want least-privilege access, where each user and each staff member sees only what their job requires, with role-based permissions enforced on the server and not just hidden in the interface.

Ask what is logged. A useful audit trail records who viewed, changed or exported sensitive records, and when. Ask how long those logs are kept, who can read them, and whether they can be altered. Logs that an administrator can quietly edit are not much of an audit trail.

Encryption, hosting and retention

Ask whether data is encrypted in transit and at rest, and how keys are managed and rotated. Ask where the application and database are hosted, which cloud provider and region, and whether that provider will enter the agreements your situation requires. Do not assume a cloud account is covered just because the provider is large.

Ask about backups: where they live, whether they are encrypted, and how restores are tested. Then ask about retention and deletion. How long is data kept, how is it removed on request or at contract end, and does deletion reach backups and logs?

Finally, ask about the basics that sit around all of this: separate staging and production environments, code review on every change, and a documented process for handling an incident, including how and when you would be told.

A sensible next step

Write your questions down before the first call and compare the answers across vendors. Specific answers are a good sign. Vague reassurance is not. Then have your compliance advisor review the architecture and the contract before launch.

If you are planning a build with us, the free scoping call is the place to raise all of this. Our site FAQ describes a focused MVP as typically an 8-14 week fixed-scope build, and the written scope can include your security requirements from the start.