Guide

What HIPAA-compliant app development costs

HIPAA adds 18% to what an app costs to build when it’s designed in from the start, and it applies to every part of the work. On a clinic app with intake forms, card payments, patient messaging and a staff portal, that’s $67,000 – $95,000 against $57,000 – $80,000 for the same app built without it. About $12,500 more, at the middle of the range.

+18%: What HIPAA adds to every part of the build, designed in from the start
$12,500: The difference on a clinic app with patient messaging and a staff portal
$67,000 – $95,000: That clinic app, with HIPAA built in

Written by

WhatWillMyAppCost

We build the estimator this site runs on, and we design and build custom mobile and web software for a living. Every figure below is the estimator’s own output, except the published vendor prices, which are read off each company’s own page and dated.

You run a practice or a clinic and you want patients using an app. You know HIPAA applies, and you don’t know what it does to the price. Or you’re building something health-related and you aren’t sure HIPAA applies to you at all.

HIPAA’s cost comes first: what it adds, and why it applies to every part of the build. Then whether your app falls under it, where health and fitness apps fall, and who signs a business associate agreement, all from HHS’s own pages.

How much does it cost to build a HIPAA-compliant app?

$67,000 – $95,000 for a clinic app on iPhone and Android with HIPAA designed in. Patients sign in, fill out intake forms before a visit, upload their insurance card, pay their balance by card, get a reminder the day before, and message the front desk. The front desk and the clinicians work from a web portal of their own, where they search for patients, and the practice manager gets a couple of reports.

The clinic app, built without HIPAA: $57,000 – $80,000 over 16–23 weeks. The same screens, for a practice HIPAA doesn’t cover.
The same app, holding the clinic’s patient records: $67,000 – $95,000 over 17–24 weeks. About $12,500 more at the middle of the range, and a week longer at each end of the schedule.

HIPAA stays at 18% whatever the app is, so the dollar figure grows with everything else you put in it. Other rules carry their own percentages, and the mobile cost guide has the spread across them.

Why does HIPAA make an app cost more?

It touches every part of the work, so the estimator adds 18% to each one: planning, design, the app on the phone, the server, the staff portal, testing and project management.

HIPAA never gets a line of its own on the clinic app’s estimate. It’s 18% on every line that’s already there, and that comes to $12,500.

The note that comes up beside the clinic app’s estimate reads: “HIPAA changes how the software is built, not just what gets documented at the end: encryption at rest and in transit, audit logging, access review, and business associate agreements. Designed in it’s a premium; retrofitted it’s a rebuild.”

On the clinic app, that means the intake forms, insurance cards and messages are encrypted where they’re stored and on their way between the phone and the server. There’s a log of which staff member opened which patient’s file. And somebody checks that the people who can see records still should.

Does my app need to be HIPAA compliant?

It does if it handles patients’ health information for a covered entity, or for a company working for one. HHS’s page on covered entities says: “If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules.”

A covered entity is one of three things.

A health care provider. HHS’s list names doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies, but only the ones that send certain information electronically, like insurance claims.
A health plan. Health insurance companies, HMOs, company health plans, and government programs that pay for care, such as Medicare and Medicaid.
A health care clearinghouse. A company that turns health information it gets from someone else into the standard format, or back again. Some billing services do this.

What the rules protect is what HHS calls protected health information. That’s anything held by a covered entity or its business associate that identifies a patient and relates to their health, the care they get, or paying for it. HHS gives a name, an address and a birth date as examples of details that identify someone. The intake forms and insurance cards on the clinic app are that kind of information.

That’s a summary of HHS’s definitions. It isn’t legal advice. Whether your practice is covered is worth settling with HHS’s guidance, or a lawyer who works with practices, before anybody prices the app. Then put the answer in the brief.

Do health and fitness apps need to be HIPAA compliant?

Usually not, when people download them and enter their own information. HHS published scenarios for app developers in 2016, and it comes down to who the app works for.

Someone downloads a health app and types in blood sugar and blood pressure readings they took at home: Not a business associate, in HHS’s reading. The developer isn’t handling health information for a covered entity or a business associate.
Their doctor recommends a diet and exercise app, and they send the doctor a report from it before the next visit: Still not. The doctor didn’t hire the developer, and HHS says a patient using an app to send their own information to a provider doesn’t by itself make the developer a business associate.
A provider hires a developer to run an app for its patients, with messaging, and what patients type goes straight into the provider’s records: A business associate. The developer is handling patients’ health information on the provider’s behalf, and has to follow HIPAA’s rules for business associates.

HHS’s guidance for developers says that if you only offer services to consumers, and not on behalf of a provider, a health plan or a clearinghouse, “you are not likely to be subject to HIPAA as either a covered entity or business associate.” A fitness or wellness app people buy for themselves looks like the first two rows. One offered through a wellness program tied to an employer’s health plan can be the third, and HHS names that case too.

Being outside HIPAA doesn’t leave a health app with no rules. HHS’s page for health app developers points to a tool from the FTC, HHS and the FDA covering other federal rules a health app can fall under, the FTC’s Health Breach Notification Rule among them. The estimator prices HIPAA and has no setting for those other rules.

Who signs a business associate agreement for a HIPAA app?

If your practice is a covered entity, it needs one with each outside company it engages to handle patient information on its behalf. HHS’s own examples include a developer contracted to provide an app to a provider’s patients that handles their information, a cloud company that stores or processes patient information, and an IT firm that maintains systems holding it.

The agreement says what the company may do with the information, and that it’ll do nothing else with it, except where the law requires it. Under the Security Rule it also commits the company to following that rule and reporting security incidents.

HHS’s summary of the Security Rule says the agreement has to be in place before a business associate creates, receives, keeps or sends patient information. On the clinic app, that includes whoever hosts it and stores the intake forms, insurance cards and messages. What hosting costs is a yearly figure separate from the build.

HIPAA adds 18% to the build when it’s designed in, spread across every part of the work. On the clinic app that’s $67,000 – $95,000 against $57,000 – $80,000, and a week longer at each end of the schedule.

It applies when an app handles patients’ health information for a covered entity or a business associate. An app people download and use on their own usually falls outside it.

FAQ

Questions about HIPAA-compliant apps

Can an app be HIPAA compliant?

Yes. HHS calls the Security Rule, the part covering health information kept electronically, “flexible, scalable, and technology neutral.” The rules apply to organizations, covered entities and their business associates, and to the patient information they keep or send electronically, whatever software they use for it.

How can I develop a HIPAA-compliant app?

HHS’s summary of the Security Rule lists five technical safeguards. Access control lets only authorized people reach patient information. Audit controls record activity in the systems holding it. Integrity protections keep it from being altered or destroyed improperly. Authentication confirms people are who they say they are, and transmission security guards it on its way across a network. The administrative and physical safeguards cover how the practice runs, with risk analysis and staff training among them. In the estimator, building HIPAA in from the start costs 18% more than the same app without it.

How long does it take to build a HIPAA-compliant app?

A clinic app with patient sign-in, intake forms, card payments, messaging and a staff portal takes 17–24 weeks with HIPAA designed in, and 16–23 weeks without it. The schedule grows by less than the price, and why bigger builds don’t take much longer has a page of its own.

Is a smaller first version of a HIPAA app cheaper?

Yes, though HIPAA comes with it. Take a clinic app with intake forms, card payments, messaging, reminders, reports and a staff portal, and cut it back to a first version: a few staff screens in place of the full portal, one report, simpler search, two kinds of user, and no messaging or reminders yet. HIPAA still adds about $8,000 to that version, because it still holds patient records.

Can you make AI HIPAA compliant?

Yes, on the same terms as any other business associate. HHS lists one case by name: a third-party AI chatbot on a provider’s patient portal that uses patient information for things like symptom checks, medical reminders and appointment scheduling. The company behind it signs a business associate agreement. In the estimator, an AI feature in an app with HIPAA carries the same 18% as everything else in it, and what AI adds to an app prices the feature itself.

Does HIPAA apply if a practice doesn’t bill insurance electronically?

It may not. HHS counts a health care provider as a covered entity only when it sends certain information electronically as part of a standard transaction, like a claim or an eligibility check, either itself or through a billing service. Using email doesn’t make a provider covered on its own. HHS’s covered-entities page links to a question-and-answer tool for working out where a practice stands, and HHS notes that other federal and state laws sometimes require privacy protections too.

Is HIPAA compliance a one-time cost for an app?

No. The 18% pays for building it in. HHS’s summary of the Security Rule says a regulated entity has to keep reviewing and updating its security measures and evaluate them periodically, so the work carries on for as long as the app holds patient information. What upkeep costs is a yearly figure of its own, separate from the build.