When HIPAA applies to a health app backend, what the Security Rule asks (risk analysis, access control, audit logs, BAAs, breach notification) and what Anpheros does and does not claim.
HIPAA applies to your backend when you create, receive, keep or send protected health information (PHI) for a covered entity (a provider, health plan or clearinghouse) or as its business associate. Then the Security Rule asks for risk analysis, access controls, audit logs, integrity and transmission security, a business associate agreement (BAA) with every vendor that touches PHI, and breach notification. A consumer app that people use on their own is usually outside HIPAA, but the FTC Health Breach Notification Rule and state laws still apply.
Does HIPAA apply to you?
Situation
HIPAA?
A clinic or health plan uses your app to manage its patients' data
Yes: you are a business associate and need a BAA with them
Your backend stores PHI on behalf of a business associate
Yes: you are a subcontractor business associate
People download your app and enter their own data, with no covered entity involved
Usually no; the FTC Health Breach Notification Rule and state privacy laws apply
A patient sends their records from a provider's API to your consumer app
Usually no for your app; the provider's duty ends at the patient's direction
What the Security Rule asks of a backend
Safeguard
In practice
Risk analysis and risk management
Document threats to PHI and how you reduce them; repeat when things change
Access control
Unique user IDs, least privilege, automatic logoff, emergency access procedure
Audit controls
Record who read or changed which record, and review the logs
Integrity
Protect PHI from improper change; keep versions instead of overwriting
Person or entity authentication
Strong authentication for staff and service accounts
Transmission security
TLS for everything in transit
Encryption at rest
Treated as "addressable", in practice expected
Contingency plan
Backups, disaster recovery and tested restores
Business associate agreements
A BAA with every vendor that stores or processes PHI (hosting, email, logging, AI)
HHS proposed an update to the Security Rule in January 2025 that would make more of these controls explicitly required; build as if they were.
Breach notification
Under HIPAA, a breach of unsecured PHI must be reported to affected individuals without unreasonable delay and within 60 days, to HHS, and to the media for large breaches. For consumer apps outside HIPAA, the FTC Health Breach Notification Rule sets similar duties for unauthorized disclosures, including sharing data without the person's authorization.
How Anpheros helps, and what it does not claim
Anpheros Platform is a FHIR R4 backend built around the same controls: one record per person, consent by scope and duration, an access log for every read, provenance and version history on every write, encryption in transit and at rest, and project isolation between apps. It does not make your app HIPAA compliant on its own; compliance depends on your whole organization and contracts.
Anpheros is hosted in the EU. A US data region and a HIPAA business associate agreement (BAA) are available on request for production customers; production for US patient data starts only after the BAA is signed. Until then, do not store protected health information that falls under HIPAA in Anpheros. The free sandbox uses synthetic patients only.
Frequently asked questions
Does my health app need to be HIPAA compliant?
Only if you handle PHI for a covered entity or as its business associate. Many consumer apps are not covered by HIPAA but must follow the FTC Health Breach Notification Rule, the FTC Act and state laws such as Washington's My Health My Data Act.
What is a BAA?
A business associate agreement: the contract HIPAA requires between a covered entity and a vendor that handles PHI for it, and between that vendor and its own subcontractors.
Is a cloud database enough for HIPAA?
No. You need a BAA with the provider, the right configuration (access control, audit logs, encryption, backups) and your own policies, risk analysis and training.
Is Anpheros HIPAA compliant?
Anpheros does not claim HIPAA compliance. A US data region and a BAA are available on request for production customers, and US patient data goes to production only after the BAA is signed.
