Does HIPAA Apply to My App? How to Tell in 5 Minutes
HIPAA applies to your app only if you can answer yes to one of two questions: are you a covered entity — a health plan, a healthcare clearinghouse, or a healthcare provider — or are you a business associate handling protected health information (PHI) on a covered entity's behalf? Answer no to both, and HIPAA generally does not reach your app directly, though other privacy laws still might.
Quick Answer: Ask two questions. Are you a covered entity (health plan, clearinghouse, or provider)? Do you handle PHI on behalf of one as a business associate? Two "no" answers mean HIPAA generally doesn't apply to you directly. One "yes" means it does. Either way, confirm your specific situation with healthcare privacy counsel before you build.
Founders building anything with the word "health" in the pitch deck tend to assume HIPAA is watching. It usually isn't — not because the law is lenient, but because it was never written to cover every app that touches a health topic. It was written to cover specific parties handling specific data in specific relationships. Once you can answer the two-question test above, you know which side of that line your app sits on, and you can plan the rest of your build accordingly. If you want the fully worked playbook for sequencing HIPAA-safe validation experiments end to end, our guide to HIPAA for startups walks through it stage by stage.
How HIPAA coverage actually works — covered entities and business associates
HIPAA attaches to a relationship, not a subject. The law names two categories of regulated party, and if you're not one of them — or working on behalf of one — its direct requirements don't reach you, no matter how clinical your app sounds.
A covered entity is one of three things: a health plan, a healthcare clearinghouse, or a healthcare provider that transmits health information electronically for standard transactions such as billing and insurance claims. Hospitals, clinics that bill insurance, and insurers fall into this category. A pre-launch startup almost never does — you're not running a health plan or billing insurance on day one.
A business associate is a vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity. If a clinic hires your app to manage patient scheduling, process claims, or store chart data, you become a business associate the moment that work starts — and you're expected to sign a Business Associate Agreement (BAA) that contractually extends HIPAA's obligations to you. Any subcontractor you bring in on that work inherits the same obligations downstream.
PHI itself is the substance both categories exist to protect: individually identifiable health information tied to a person's care or payment for care. Our companion piece on what counts as PHI walks through that test in detail, but the short version is that the data has to be both health-related and identifiable, in a covered context, to qualify.
That leaves a third, much larger category: neither. If you never handle PHI on behalf of a covered entity or plan, HIPAA generally doesn't apply to you directly — no matter how sensitive the data feels. A direct-to-consumer app where a user logs their own symptoms, with no provider relationship anywhere in the picture, typically sits outside HIPAA's direct reach.
Examples table — common app types and their HIPAA status
Whether your specific app is covered comes down to two things: who your customer is, and whose data you're handling on whose behalf. Here's how that plays out across app types founders actually build:
| App type | Handles PHI for a covered entity? | HIPAA status | Why |
|---|---|---|---|
| Consumer meditation or mood-tracking app, self-reported data only | No | Generally not covered | Users enter their own data; no provider or plan relationship exists |
| Telehealth scheduling tool sold to a clinic | Yes | Covered as a business associate | Manages patient scheduling data on the clinic's behalf; needs a BAA |
| Symptom checker sold direct to consumers, no clinical integration | No | Generally not covered | No covered-entity relationship, though other consumer-protection laws may still apply |
| EHR integration or charting tool built for hospitals | Yes | Business associate | Creates and transmits PHI on behalf of covered entities |
| Fitness or sleep tracker syncing biometric data, sold direct to consumers | Usually no | Generally not covered | No covered-entity relationship; other health-data laws can still apply |
| Billing or claims-processing software for a medical practice | Yes | Business associate | Processes claims data containing PHI on a provider's behalf |
The pattern holds across every row: the deciding factor is never the topic, it's the relationship. A consumer app that never touches a provider or plan tends to fall outside HIPAA no matter how clinical it looks; a vendor tool built to serve a covered entity tends to fall inside it no matter how mundane the data seems.
What to do if HIPAA applies (and if it does not)
Once you know which side of the line you're on, the next steps look completely different — and starting the wrong one wastes real time and money.
If HIPAA applies to your app
Treat this as a build requirement, not an afterthought. At minimum, plan for:
- A signed BAA with every covered entity you work with, in place before PHI starts flowing.
- Security safeguards on anything that touches PHI — access controls, encryption at rest and in transit, and audit logging.
- Breach notification procedures you can actually execute, not just a policy document in a drawer.
- Workforce training for anyone on your team who can see PHI, including contractors.
- Legal review of your agreements and data flows by counsel who specializes in healthcare privacy — this is not a place to guess.
Budget for this before you sign your first covered-entity customer, not after. Retrofitting compliance onto a live product costs more than designing it in from the start.
If HIPAA does not apply to your app
Don't read "HIPAA doesn't apply" as "no rules apply." Depending on what you collect and where your users live, you can still owe obligations under:
- State consumer health data laws, a growing category that regulates health-adjacent data collected outside HIPAA's reach, regardless of whether you're a covered entity.
- General consumer protection law, which polices deceptive or unfair claims about how you handle sensitive data.
- State privacy statutes, which can apply based on where your users are located, independent of your industry.
- Platform policies from app stores, which often impose their own health-data handling rules on top of whatever the law requires.
Practically, this means a HIPAA-free app can still justify real privacy investment: honest data-handling disclosures, sensible retention limits, and a real answer to "what happens to my data" before you scale. Whatever your HIPAA status, the underlying validation work — proving the problem is real before you build the compliance program around it — follows the same playbook; see our complete guide to startup idea validation for interview and demand-testing techniques that apply regardless. It's also worth treating this determination as a snapshot, not a permanent status: the moment you sign a covered-entity customer or start handling identifiable clinical records, you move into the section above.
HIPAA vs general privacy law — the difference
HIPAA is narrow and relationship-based; general privacy law is broad and applies regardless of who you are. That distinction is what trips founders up most often — clearing HIPAA doesn't mean you've cleared privacy law generally.
| Law | Who it applies to | What triggers it | Typical scope |
|---|---|---|---|
| HIPAA | Covered entities, business associates, and their subcontractors | Handling PHI in a covered relationship | US, sector-specific |
| State consumer health data laws | Companies collecting consumer health data, regardless of industry | Collecting or sharing health-related data about a state's residents | State-specific, broad by data type |
| General consumer protection law | Any company making claims to consumers | Deceptive or unfair data practices | US, broad by conduct |
| GDPR (where applicable) | Any company processing EU residents' personal data | Processing personal data of people in scope | EU, broad by data subject |
The practical implication: "not HIPAA-covered" is a narrower finding than founders often assume it is. It tells you one specific federal law doesn't reach you directly — it says nothing about the state law where your users live, or the general obligation not to mislead people about what you do with their data. Treat the two-question test as the first filter, not the only one, and get healthcare or privacy counsel to run the full check against your specific facts before you launch.
Key Takeaways
- HIPAA turns on two questions, not on topic. Are you a covered entity, or a business associate handling PHI on one's behalf? Two "no" answers generally mean HIPAA doesn't apply to you directly.
- PHI is individually identifiable health information tied to a covered relationship. Strip the identifiers or the covered-entity relationship, and most data isn't PHI at all.
- A BAA request is the clearest signal you've crossed the line. If a covered entity asks you to sign one, HIPAA is now contractually binding on you.
- App type alone never decides HIPAA status. A consumer wellness app and a hospital-facing charting tool can handle similar-looking data with completely different HIPAA outcomes, because the relationship differs.
- Falling outside HIPAA isn't the end of the analysis. State health-data laws, general consumer protection law, and platform policies can still apply.
- Confirm with healthcare privacy counsel. This test tells you where to start looking, not where to stop — your specific facts decide the answer.
Frequently Asked Questions
Do I need a lawyer to determine if HIPAA applies to my app?
For anything beyond an early, no-PHI prototype, yes. The two-question test tells you where to start looking, but the actual determination depends on facts specific to your product, your customers, and your data flows. Healthcare or privacy counsel can confirm your status and flag other laws the HIPAA test doesn't cover.
Does storing health data automatically trigger HIPAA?
No. Storing health-related data only triggers HIPAA if you're doing it as a covered entity or as a business associate handling PHI on one's behalf. A consumer app storing self-reported health data, with no provider relationship, typically stays outside HIPAA's direct reach — though other privacy laws may still apply to that same data.
What happens if I assumed HIPAA didn't apply and I was wrong?
Operating as an unrecognized business associate without the required safeguards and agreements creates real legal exposure, and the fix gets harder the longer PHI has already been flowing through the product. If there's any ambiguity about your relationship to a covered entity, get counsel to confirm before you build the data flow, not after it's live.
Can a consumer wellness app face legal risk even if HIPAA doesn't apply?
Yes. Falling outside HIPAA only clears one specific federal law. State consumer health data laws, general consumer protection rules, and app store policies can still govern how you collect, use, and disclose health-related data — so a HIPAA-free app still needs a real privacy posture, not none at all.