Healthcare App Development · 3 Nov 2026 · 7 min read · By Amit Kumar Sharma

Healthcare app development in the US: HIPAA basics, telehealth features and security

Before you scope a health app, work out which privacy laws apply. Here's HIPAA in plain terms, the FTC rule many health apps miss, telehealth features and a security checklist.

Key takeaways

HIPAA applies to covered entities and their business associates, not every health app.
Health apps outside HIPAA can still fall under the FTC's Health Breach Notification Rule.
Every vendor that touches PHI needs to sign a business associate agreement.
Keep health data out of ad pixels, analytics events, logs and push text.
This is planning guidance, not legal advice.

Healthcare app development in the US starts with a question most teams skip: which privacy laws apply to this app? The answer changes your architecture, your vendors, your analytics stack and even how you advertise. This guide covers HIPAA basics for app builders, the telehealth features buyers usually need, the integrations that take the most time, and a security checklist you can hand to any development team.

This is practical guidance for planning, not legal advice. Talk to a healthcare privacy attorney about your specific app before you launch.

First, work out whether HIPAA applies

HIPAA applies to covered entities (health plans, healthcare clearinghouses and most healthcare providers) and to their business associates: vendors that create, receive, maintain or transmit protected health information (PHI) on their behalf. A rough way to think about it:

Likely covered by HIPAA: an app a clinic, hospital or insurer provides to its patients or members, or an app your company builds and runs for such an organization. You'll typically sign a business associate agreement (BAA) with them.
Often not covered by HIPAA: a consumer app people download on their own to track symptoms, sleep or fitness, with no relationship to a provider or plan.

"Not HIPAA" doesn't mean unregulated. The FTC's Health Breach Notification Rule applies to many health apps outside HIPAA, and its 2024 amendments, effective July 29, 2024, made clear that a breach includes unauthorized disclosures, such as sharing health data with advertisers in ways users weren't told about, not just hacks, per the final rule in the Federal Register. State health privacy laws may also apply.

HHS's health apps resource page links to use-case guidance on when a developer acts as a business associate, and to an interactive tool built with the FTC, ONC and FDA that points developers to laws that may apply. Run through it before scoping.

HIPAA basics for app builders

If HIPAA applies, three rules matter most to a development team:

Privacy Rule: limits how PHI is used and disclosed, and gives patients rights such as access to their records. In app terms, use the minimum necessary data and be careful what leaves your systems.
Security Rule: requires administrative, physical and technical safeguards for electronic PHI, including risk analysis, access controls, audit controls, integrity protections and transmission security.
Breach Notification Rule: requires notifying affected individuals, HHS and in some cases the media after a breach of unsecured PHI.

Every vendor that touches PHI, from your cloud host to your video provider, email service and support desk, needs to be willing to sign a BAA. This rules out many popular consumer-grade tools and is one of the biggest drivers of a healthcare app's tech stack.

Major cloud providers offer BAAs, but only for specific services, and a BAA doesn't make your app compliant by itself. You still have to configure those services correctly: encryption on, access restricted, logging enabled, backups protected. HHS's guidance on cloud computing makes the same point: the responsibility is shared between you and the provider. List every service in your architecture, mark which ones touch PHI, and confirm each is covered before development starts, not during a security review before launch.

A change to watch: HHS proposed a major update to the HIPAA Security Rule in January 2025, with more prescriptive requirements such as encryption, multifactor authentication and regular testing. The final rule's target date has been pushed to July 2027, according to Fierce Healthcare. Building to those proposed standards now is sensible either way.

Telehealth features buyers usually need

Feature	What to get right
Patient onboarding and identity	Identity verification where needed, consent capture, insurance details
Scheduling	Provider availability, time zones, reminders that don't expose PHI in notification text
Video visits	A video vendor that signs a BAA, waiting rooms, connection fallback for weak networks
Secure messaging	Encrypted in transit and at rest, retention rules, attachment handling
Intake forms and questionnaires	Structured data that can map into the EHR, not free-text blobs
E-prescribing and labs	Certified e-prescribing partners, lab order and result integrations
Payments and billing	Card payments, copays, insurance eligibility checks, receipts
Provider dashboard	Role-based access, visit notes, audit logs of who viewed what

Two non-technical points shape telehealth products as well. Providers generally need to be licensed where the patient is located, so scheduling and provider matching often have to filter by state. And rules for prescribing remotely, especially controlled substances, have been changing, so confirm the current position with counsel before designing prescription flows.

Most products don't need all of this at launch. Start with the visit flow your providers actually use, and add integrations as volume justifies them. Our MVP scoping guide helps decide what goes into v1.

Integrations that take the most time

EHR integration: most major EHRs expose FHIR APIs, and SMART on FHIR lets apps launch inside or connect to them. Access usually requires approval from the EHR vendor or the health system, which can take longer than the coding.
Apple HealthKit and Android Health Connect: read and write wearable and fitness data with explicit user permission. Both platforms restrict how that data can be used, including for advertising.
Insurance eligibility and claims through clearinghouse APIs.
Identity and e-signature for consent forms and, where needed, controlled-substance prescribing rules.

Get a fixed quote for your app in 24 hours

Tell us what you're building. You get a written scope, timeline and fixed price — plus free Google Play and App Store submission and one month of launch marketing with every build.

Get my free quote WhatsApp us

Security checklist for a healthcare app

A documented risk analysis before build, updated when the system changes.
Encryption in transit (TLS) and at rest, including databases, backups and file storage.
No PHI stored unencrypted on the device; use the platform keychain or keystore for secrets.
Multifactor authentication for providers and admins, and session timeouts.
Role-based access control and audit logs of access to patient records.
BAAs in place with every vendor that handles PHI.
No PHI in logs, crash reports, analytics events or push notification text.
Separate environments, with no real patient data in development or testing.
Regular vulnerability scans and penetration testing before launch and after major changes.
A written incident response plan with breach notification steps.

App store rules for health apps

Both stores add requirements on top of the law. Apple expects apps in regulated areas such as healthcare to be submitted by the legal entity providing the service, and may ask for regulatory documentation for medical features. Google Play requires every app to complete a health apps declaration, and apps regulated as medical devices must say so. Our store submission guide covers the rest of the checklist.

Marketing a health app without leaking data

This is where many health apps get into trouble. Ad pixels and SDKs that send events like "booked therapy session" or a condition-specific page view to ad platforms can count as disclosing health information. Practical rules:

Audit every SDK and pixel for what it sends, before launch and after each update.
Send only non-health events to ad platforms, such as "account created", with no condition or treatment details.
Keep consent clear and specific, and honor it in your data flows.
Use server-side event setups that let you strip sensitive fields before anything leaves your systems.

The same caution applies to ad creative and targeting. Ads that imply the viewer has a condition, or audiences built from health data, can breach platform ad policies as well as privacy rules, so review both with your legal and marketing teams together.

Healthcare app development cost and timeline drivers

Healthcare apps cost more than comparable consumer apps because of compliance work, not features: BAA-ready vendors, security controls, audit logging, documentation, testing and integration approvals. EHR integrations, e-prescribing and insurance workflows are the biggest variables. See the 2026 app development cost guide for ranges by complexity.

Building a healthcare app with Appryze

Appryze builds iOS, Android and web apps for clients in the USA, UK, UAE and India, with the security checklist above built into scope rather than added later. You get a fixed-price written quote within 24 hours, weekly written updates and call times that overlap US business hours, and you own the code and every account. Start on our Studio page.

Frequently asked questions

Does my health app need to be HIPAA compliant?

It depends on who you work with. If the app is offered by or built for a covered entity, such as a healthcare provider, health plan or clearinghouse, and handles protected health information, HIPAA likely applies and you'll sign a business associate agreement. Many direct-to-consumer apps aren't covered by HIPAA but may fall under FTC and state rules. Get legal advice for your case.

What is the FTC Health Breach Notification Rule?

It's an FTC rule covering vendors of personal health records and related entities that aren't covered by HIPAA, including many health apps. Amendments effective July 29, 2024 clarified that a breach includes unauthorized disclosures, such as sharing health data with advertisers without proper authorization, and require notifying affected users, the FTC and sometimes the media.

What features does a telehealth app need?

Most telehealth apps need patient onboarding and consent, scheduling with reminders, video visits, secure messaging, intake forms, payments and a provider dashboard with access controls and audit logs. E-prescribing, lab integrations, insurance eligibility and EHR connections are often added in later phases as volume grows.

How much does it cost to build a HIPAA-compliant app?

More than a comparable consumer app, mainly because of compliance work: BAA-ready hosting and vendors, encryption, audit logging, access controls, documentation, security testing and integration approvals. EHR integration, e-prescribing and insurance workflows are the biggest cost variables. Get a fixed-price quote against a written scope to compare vendors.

Can I use Google Analytics or Meta pixels in a health app?

Be very careful. Sending events that reveal a health condition, treatment or appointment type to ad or analytics platforms can count as an unauthorized disclosure under HIPAA or FTC rules. Audit every SDK, send only non-health events, use server-side setups that strip sensitive fields, and get legal review of your tracking plan.