There is no such thing as a HIPAA-certified app. HIPAA has no certifying body, no approval process and no badge, so any claim that an app “is HIPAA compliant” is the vendor’s own assessment of their own product rather than a credential someone issued them. What the rule actually requires is a set of safeguards applied by covered entities and their business associates: access controls so only authorised people reach protected health information, encryption in transit and at rest, audit logging that records who accessed what, integrity controls, transmission security, and a signed business associate agreement with every vendor that touches the data — including the cloud provider, the analytics tool and the error-reporting service. Compliance is therefore a property of how an application is built, operated and contracted, not a state a product arrives in, which is why the honest question to ask a vendor is which safeguards they implement and who has signed a BAA, not whether they are compliant.

There Is No HIPAA Certification

“HIPAA compliant” is not a credential. There’s no government body or private organization that certifies an app as HIPAA compliant the way, say, a UL listing certifies electrical safety. When a vendor’s marketing page states flatly that their product “is HIPAA compliant,” that’s a self-assessment, not a verified fact — and treating it as verified is exactly the mistake a buyer being sold to makes most often in this category.

What the Security Rule Actually Requires

The actual requirements come from HHS’s Security Rule, and they translate into concrete application-level obligations: access controls that restrict PHI to authorized users, encryption of data in transit and at rest, audit logging that records who accessed what and when, integrity controls to prevent improper alteration or destruction of data, and transmission security.

Business Associate Agreements — Every Vendor in the Path

This is the commonly missed piece, and it’s where a lot of otherwise well-intentioned apps actually fail: every vendor that touches PHI anywhere in the application’s path needs a signed BAA, not just the primary cloud host. That includes analytics tools, crash-reporting services, push notification infrastructure if it ever handles anything derived from PHI, and any third-party SDK embedded in the app that could see the data flowing through it. A team that signs a BAA with its hosting provider and stops there has covered maybe half the actual chain.

Where Apps Usually Fail

These failures are grounded in real enforcement data rather than speculation. Application logs, screenshots captured for debugging, backups, and third-party SDKs are the recurring, practical failure points — places PHI leaks not through a dramatic breach but through an overlooked, routine engineering practice. And there’s a structural pattern worth knowing from actual HHS enforcement history: nearly every recent HHS resolution agreement citing a Security Rule violation has named “failure to conduct an accurate and thorough risk analysis” as a root finding. That’s not a coincidence — a real, documented risk analysis is the step that would have caught most of the failure points above before they became a breach, and skipping it is the single most common thread across enforcement actions.

What to Ask a Vendor Instead

Replace “are you HIPAA compliant” with questions that actually get a checkable answer:

  • Will you sign a BAA, and does it cover every subprocessor in your own path?
  • How is PHI encrypted at rest and in transit, specifically?
  • What does your audit logging actually capture, and for how long is it retained?
  • Have you conducted a documented risk analysis, and when was it last updated?
  • What happens to PHI in your application logs, crash reports and backups?

Going Deeper

This post answers one specific question — what “compliant” actually means, as opposed to a certification claim. For the fuller development process, see our HIPAA-compliant app development guide, and for the specific messaging-and-push-notification failure mode, see our companion post on healthcare app messaging.

Next Steps

The next time a vendor tells you their product “is HIPAA compliant,” ask them the five questions above instead of taking the claim at face value. If you’re building a healthcare app and want the safeguards and BAA chain built in correctly from the start, talk to our team.