Healthcare app development in 2026: HIPAA, BAAs and AI

Key takeaways

HIPAA covers health plans, clearinghouses, most providers and their business associates; many consumer apps fall under the FTC.
As of 23 October 2026, AWS, Google Cloud, Microsoft, OpenAI and Anthropic sign BAAs covering listed services only.
OpenAI’s API needs Modified Retention for PHI, and Anthropic’s BAA excludes its Batch and Files APIs.
A 2024 court ruling narrowed HHS’s tracking guidance, but trackers on patient portals still need a BAA.
The EU AI Act’s obligations for AI medical devices needing third-party assessment now apply from 2 August 2028.

Healthcare app development starts with working out whether HIPAA applies to you. If it does, sign a business associate agreement (BAA) with every vendor before protected health information (PHI) reaches it, from the cloud and email providers to error tracking, analytics and the LLM API. Keep PHI out of logs and out of every tool without a BAA. Decide early how you’ll exchange data with electronic health records (EHRs), and whether any clinical AI feature makes the product a medical device.

As of 23 October 2026, AWS, Google Cloud, Microsoft, OpenAI and Anthropic all sign BAAs, each for named services and on conditions. OpenAI requires a data setting it calls Modified Retention, and Anthropic’s BAA leaves out its Batch and Files APIs. Google Analytics and Postmark don’t sign BAAs.

This guide covers what a healthcare product should settle in its first block of work, with the extra decisions an AI feature brings, and how we start one. It isn’t legal advice, so check your position with a healthcare lawyer.

When HIPAA applies to a health app

According to the Department of Health and Human Services (HHS), HIPAA applies to covered entities and their business associates. Covered entities are health plans, clearinghouses, and health care providers that transmit health information electronically in standard transactions. A business associate creates, receives, maintains or transmits PHI for a covered entity, and a subcontractor doing that for a business associate is one too. An organisation that is neither doesn’t have to comply.¹²

HHS’s examples of business associates include an app developer that contracts with a provider to run patient management services, and a third-party chatbot on a patient portal that handles symptom assessment, reminders and scheduling.² Its app scenarios show the other side. A consumer who downloads an app and enters their own readings, or directs it to exchange data with their provider’s EHR, doesn’t make the developer a business associate.³

Apps outside HIPAA answer to the FTC. Its Health Breach Notification Rule, amended with effect from 29 July 2024, covers vendors of personal health records, such as an app that collects consumers’ information and can sync with a fitness tracker.⁴⁵ Sharing data without the person’s authorisation counts as a breach. People must be told within 60 calendar days of discovery, and the FTC at the same time when 500 or more are affected. Violations cost up to $53,088 each in 2026.⁵⁶ In the first case under the rule, in 2023, GoodRx agreed to a $1.5 million penalty for failing to report that it had shared health data with Facebook, Google and others.⁷

States add their own rules. Washington’s My Health My Data Act covers consumer health data outside HIPAA, including inferences that algorithms or machine learning draw from other data. Collecting and sharing it need separate consents unless they’re necessary for a service the consumer asked for, and selling it needs the consumer’s signed authorisation. Geofences within 2,000 feet of in-person care sites can’t be used to track visitors, collect their health data or send them health ads. Consumers can sue under the state’s Consumer Protection Act.⁸⁹

Your situation	Rules to check first
You are a health plan, clearinghouse or provider	HIPAA, as a covered entity
Your software handles PHI for one of them	HIPAA, as a business associate under a BAA
Consumers download your app and add their own data or a wearable feed	FTC Act, the Health Breach Notification Rule, state laws such as Washington’s
Your software suggests a diagnosis or treatment	FDA device rules as well, covered below

Which cloud and AI APIs sign a BAA, as of 23 October 2026

HHS treats a cloud provider that stores electronic PHI (ePHI) for you as a business associate, even if it holds only encrypted data and no key. Using one without a BAA breaks the HIPAA Rules.¹⁰ Each BAA covers named services only, and other services in the same account sit outside it. The table uses each vendor’s own pages, read on 23 October 2026. “Not stated” means the page doesn’t say.

Vendor	Signs a BAA	What it covers	Conditions
AWS¹¹¹²	Yes, accepted in AWS Artifact	Its HIPAA eligible list, updated 15 October 2026, including Amazon Bedrock, Bedrock AgentCore and Amazon SES	PHI only in listed services, which you configure to HIPAA requirements
Google Cloud¹³¹⁴	Yes	Listed products, including Gemini Enterprise Agent Platform, which now includes Vertex AI	Disable unsupported services; no pre-GA offerings, and no PHI in resource metadata
Gemini Developer API¹⁵	Not stated	Not stated	Terms bar use in clinical practice or to give medical advice
Microsoft Azure¹⁶¹⁷¹⁸	Yes, by default through the Product Terms	In-scope services, including Foundry Models and Foundry Agent Service	Foundry Models scope is limited to models sold by Azure, which include Azure OpenAI
OpenAI API¹⁹²⁰²¹	Yes, accepted in API Platform settings	Listed endpoints, including Responses, Chat Completions, Embeddings, audio, Realtime and Batch	Modified Retention unless OpenAI says otherwise; self-serve needs a history of API use; live web search excluded
Anthropic API²²	Yes, signed by the organisation’s Primary Owner, then enabled by Anthropic	Messages API, including prompt caching and web search; token counting; computer use	Batch, Files and Skills APIs, code execution and web fetch excluded; some models need 30-day retention
Sentry²³	Yes, on Business tier or higher	Not stated	Not stated
PostHog Cloud²⁴	Yes, with the Boost, Scale or Enterprise package	Not stated	Not stated
Google Analytics²⁵	No	None	HIPAA-regulated customers must not expose PHI to it
Postmark²⁶	No	None	Postmark says it isn’t HIPAA compliant

Microsoft’s Foundry scope excludes components run by third-party model providers unless it says otherwise, and Microsoft lists Anthropic’s models among partner models. Anthropic’s own BAA covers Claude in Microsoft Foundry.¹⁷²⁷²² Azure can store prompts its abuse monitoring flags for review by Microsoft employees unless you’re approved for modified abuse monitoring.²⁸ For staff tools, OpenAI offers no BAA for ChatGPT Business, and Claude Enterprise is covered only after its Primary Owner activates HIPAA and accepts the BAA.¹⁹²²

Tracking pixels and analytics after the 2024 court ruling

HHS’s Office for Civil Rights issued a bulletin on online tracking technologies in December 2022 and updated it on 18 March 2024.²⁹³⁰ On 20 June 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated the part saying HIPAA applies when a tracker links a visitor’s IP address with a visit to an unauthenticated public page about specific health conditions or providers. HHS says it is evaluating its next steps.³¹

The rest of the bulletin still stands. Trackers on logged-in pages, such as a patient portal or telehealth platform, generally have access to PHI, which makes the vendor a business associate that needs a BAA. Trackers can also reach PHI in a regulated entity’s mobile app, and on public pages where people book appointments, use a symptom checker, or enter login details. A cookie banner isn’t a HIPAA authorisation, and a vendor’s promise to strip PHI after receiving it isn’t enough. HHS suggests a customer data platform under a BAA that de-identifies data before it reaches vendors that won’t sign one.³¹ Keep third-party pixels and session replay off logged-in screens, booking flows and symptom tools, and count product events in a tool under a BAA or one you host.

HIPAA compliant app development starts with where PHI lives

Put PHI in its own store, behind one service that every read and write goes through. The Security Rule’s technical safeguards ask for unique user IDs, emergency access, audit controls, integrity protection, authentication and transmission security.³² Encryption is “addressable” today. You implement it at rest and in transit where it is reasonable and appropriate, or document why not and use an equivalent measure.³¹

HHS proposed in December 2024 to require encryption and multi-factor authentication, with limited exceptions, plus vulnerability scans every six months, yearly penetration tests and procedures to restore certain systems and data within 72 hours.³³ As of 23 October 2026 the rule isn’t final, and eCFR still lists encryption as addressable.³⁴³² Build to the proposal anyway. ePHI encrypted to HHS’s standard falls within the breach “safe harbor” if it leaks without the key.¹⁰

The minimum necessary standard asks you to limit uses, disclosures and requests of PHI to what the purpose needs, and to set which roles see which categories.³⁵ In code, that means field-level scopes on the PHI service and prompts that carry only the fields a model needs.

De-identified data isn’t PHI. HHS’s Safe Harbor method removes 18 identifiers, including names, geography below state level, dates other than the year, IP addresses and device numbers, and requires no actual knowledge that the rest could identify someone. Expert Determination has a qualified expert find the identification risk very small and document the analysis.³⁶ Use synthetic or de-identified data in development, staging, CI and eval sets.

The contingency plan standard requires a data backup plan and a disaster recovery plan, and testing them is addressable today.³⁷ Restore a backup into a clean environment on a schedule, and time it.

Meeting breach deadlines depends on audit logs that show whose records were read. Covered entities notify affected people within 60 days of discovery, and prominent media too when more than 500 residents of a state are affected. HHS hears within 60 days about breaches of 500 or more people, and within 60 days of the year’s end about smaller ones. Business associates tell the covered entity within 60 days.³⁸

HIPAA compliant AI: retention, logs and human review

Sending PHI to a model discloses it to the model vendor, so the call needs the vendor’s BAA, an endpoint the BAA lists, and the retention setting the vendor requires. Check every feature in the request path. OpenAI excludes web search with live internet access, Anthropic excludes code execution, web fetch and data sent to third parties through MCP, and Google rules out pre-GA offerings.²¹²²¹³

LLM traces usually hold the full prompt and response. Keep them in a store your BAAs cover, or redact them before they reach an observability or eval tool without one. Google warns that logs can capture resource metadata, and OpenAI asks customers to keep PHI out of support requests and screenshots.¹³¹⁹

Build eval sets from synthetic or de-identified cases, have clinicians label them, and rerun them on every model or prompt change, as in our LLM regression testing routine. Route anything clinical to a clinician who can see why the system said it. For chatbots, our post on US AI chatbot laws starting in 2027 covers state rules on disclosure, crisis referral and mental health.

When a clinical AI feature is a medical device

The FDA reissued its Clinical Decision Support guidance on 29 January 2026, replacing a version from 6 January. Decision support software is excluded from the device definition only if it meets all four criteria in section 520(o)(1)(E) of the FD&C Act. It must not analyse medical images or signals from in vitro diagnostic devices or signal acquisition systems. It must work from medical information, such as patient data or clinical guidelines. It must support a health care professional’s decisions on prevention, diagnosis or treatment. And it must let that professional independently review the basis for its recommendations.³⁹

Software for critical, time-sensitive decisions fails the fourth criterion. A specific diagnostic or treatment directive fails the third. Where software otherwise qualifies but only one recommendation is clinically appropriate, FDA intends to use enforcement discretion. For patient-facing software that meets the device definition, FDA’s existing digital health policies apply.³⁹ FDA’s guidance on AI-enabled device software functions is still the draft from January 2025.⁴⁰

In the EU, AI that is a medical device, or a safety component of one, is high-risk under Article 6(1) of the AI Act when the device needs a third-party conformity assessment. The Medical Device Regulation and the In Vitro Diagnostic Medical Devices Regulation are both on the Annex I list.⁴¹ The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved those obligations from 2 August 2027 to 2 August 2028. Annex III systems, which include emergency healthcare patient triage, moved from 2 August 2026 to 2 December 2027.⁴²⁴¹

FHIR API integration and the ASTP/ONC rules

For FHIR API integration with certified US EHRs, the baseline is certification criterion § 170.315(g)(10). It requires FHIR Release 4.0.1, US Core 6.1.0 with USCDI version 3, SMART App Launch 2.0.0 and Bulk Data Access 1.0.0, and accepts approved newer versions such as US Core 8.0.1.⁴³ SMART App Launch, the SMART on FHIR specification, uses OAuth 2.0 to authorise apps against FHIR servers.⁴⁴ Store the resources you receive with their source system and ID, so you can re-map them when profiles change.

ASTP/ONC sets these standards through its HTI rules. HTI-1, published on 9 January 2024, made USCDI version 3 the baseline and revised the decision support criterion to improve algorithm transparency.⁴⁵ HTI-5, a deregulatory proposal from 29 December 2025 that would remove or revise certification criteria, was still a proposal on 23 October 2026.⁴⁶⁴⁷

Information blocking rules apply to health care providers, developers of certified health IT, and health information networks and exchanges. A practice likely to interfere with access, exchange or use of electronic health information is prohibited unless law requires it or an exception in 45 CFR Part 171 applies.⁴⁸ HHS announced a crackdown on information blocking on 3 September 2025.⁴⁹ If you are a provider or build certified health IT, design exports and APIs so a patient’s chosen app can get the data.

Health data rules outside the US

Market	Rule	First-block work
EU	GDPR⁵⁰ Article 9 makes health data a special category, processed only under an exception such as explicit consent, or health care provided under law or a contract with a health professional	Record the Article 9 condition for each purpose, and run the DPIA that Article 35 requires for large-scale special-category processing
UK (NHS England)	The Data Security and Protection Toolkit⁵¹ is mandatory for every organisation with access to NHS patient data and systems	Self-assess against the National Data Guardian’s 10 data security standards
UK (NHS England)	DTAC⁵² is how NHS buyers assess digital health products on clinical safety, data protection, technical security, interoperability, and usability and accessibility; a form with 25% fewer questions arrived in February 2026	Prepare that evidence before the first NHS sale
India	The DPDP Act 2023 and the DPDP Rules,⁵³ notified on 14 November 2025 with an 18-month phased compliance period	Separate consent notices, plain-language breach notices, and rights requests answered within 90 days

Eighteen months from the DPDP Rules’ notification runs to May 2027.

How we kick off a healthcare product

9io has kicked off products in healthcare, ecommerce, edtech and fintech. A build with us starts with a first block that stands alone. At the end of it you hold the architecture, a working foundation and a firm price for the rest, and you can carry on with us, take it to another team, or stop.

Code, history and infrastructure definitions live in your repository from the first commit. Uptime and error alerting before launch, WCAG AA accessibility, tested backups, and documentation with a runbook are included as standard. You get a short written update every Friday, and each checkpoint gets seven working days of review against criteria agreed before the work started. We say so when a product doesn’t need AI. Plans start at $5,000. Our product engineering page describes the service.

A healthcare app development checklist for the first block

These fit in the first block of a digital health MVP:

Record whether you’re a covered entity, a business associate or neither, and which state laws apply.
List every vendor that could receive PHI, including any outside team such as a healthcare software development company, and get a BAA from each or keep PHI away from it.
Use only the services each BAA lists.
Put PHI in its own encrypted store, with MFA, unique user IDs and an audit log of every read and write.
Scope every query and prompt to the fields the task needs, and keep real PHI out of development, testing and eval sets.
Restore a backup into a clean environment and time it against the proposed 72-hour target, and write the breach runbook around the 60-day deadlines.
Confirm each model vendor’s retention setting, and keep prompt logs in a store your BAAs cover.
Send clinical output to a clinician, and record why each AI feature does or doesn’t meet the FDA’s four CDS criteria.
Plan EHR integration on FHIR R4, US Core and SMART App Launch, and test against vendor sandboxes early.

HHS, “Covered Entities and Business Associates”, last reviewed 21 August 2024, https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html ↩
HHS, “Business Associates Frequently Asked Questions (FAQs)”, last reviewed 21 October 2026, https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html ↩↩
HHS Office for Civil Rights, “Health App Use Scenarios & HIPAA”, February 2016, https://www.hhs.gov/sites/default/files/ocr-health-app-developer-scenarios-2-2016.pdf ↩
Federal Trade Commission, “Health Breach Notification Rule”, final rule, Federal Register, 30 May 2024, effective 29 July 2024, https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule ↩
Federal Trade Commission, “Complying with FTC’s Health Breach Notification Rule”, https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0 ↩↩
Federal Trade Commission, “Civil Penalty Inflation Adjustments”, notice for publication on 15 September 2026, https://public-inspection.federalregister.gov/2026-18853.pdf ↩
Federal Trade Commission, “FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising”, 1 February 2023, https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising ↩
Washington State Legislature, RCW chapter 19.373, Washington My Health My Data Act, https://app.leg.wa.gov/RCW/default.aspx?cite=19.373&full=true ↩
Washington State Office of the Attorney General, “Protecting Washingtonians’ Personal Health Data and Privacy”, https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy ↩
HHS, “Guidance on HIPAA & Cloud Computing”, last reviewed 23 December 2022, https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html ↩↩
Amazon Web Services, “HIPAA Compliance”, https://aws.amazon.com/compliance/hipaa-compliance/ ↩
Amazon Web Services, “HIPAA Eligible Services Reference”, last updated 15 October 2026, https://aws.amazon.com/compliance/hipaa-eligible-services-reference/ ↩
Google Cloud, “HIPAA compliance on Google Cloud”, last updated 20 October 2026, https://cloud.google.com/security/compliance/hipaa ↩↩↩
Google Cloud, Gemini Enterprise Agent Platform release notes, entry of 22 April 2026, https://docs.cloud.google.com/gemini-enterprise-agent-platform/release-notes ↩
Google, “Gemini API Additional Terms of Service”, effective 23 March 2026, https://ai.google.dev/gemini-api/terms ↩
Microsoft Learn, “HIPAA (US)”, Azure compliance documentation, https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us ↩
Microsoft Service Trust Portal, “Azure - Compliance Offerings (September 2026)”, Appendix A and note 9, last updated 1 October 2026, https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3 ↩↩
Microsoft Learn, “Data, privacy, and security for Foundry Models sold by Azure in Microsoft Foundry”, https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy ↩
OpenAI Help Center, “Getting a Business Associate Agreement for the OpenAI API”, read on 23 October 2026, https://help.openai.com/en/articles/8660679-getting-a-business-associate-agreement-for-the-openai-api ↩↩↩
OpenAI Help Center, “HIPAA eligible products and functionality”, read on 23 October 2026, https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality ↩
OpenAI, “Data controls in the OpenAI platform”, https://developers.openai.com/api/docs/guides/your-data ↩↩
Anthropic Privacy Center, “Business Associate Agreements (BAA) for Commercial Customers”, read on 23 October 2026, https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers ↩↩↩↩
Sentry, “Privacy”, Sentry Trust Center, https://sentry.io/trust/privacy/ ↩
PostHog, “PostHog & HIPAA compliance”, https://posthog.com/docs/privacy/hipaa-compliance ↩
Google Analytics Help, “HIPAA and Google Analytics”, https://support.google.com/analytics/answer/13297105 ↩
Postmark Support Center, “Is Postmark HIPAA Compliant?”, last updated 14 March 2025, https://postmarkapp.com/support/article/1041-is-postmark-hipaa-compliant ↩
Microsoft Learn, “Microsoft Foundry Models overview (classic)”, https://learn.microsoft.com/en-us/azure/ai-foundry/concepts/foundry-models-overview ↩
Microsoft Learn, “Foundry Models sold by Azure abuse monitoring”, https://learn.microsoft.com/en-us/azure/ai-foundry/openai/concepts/abuse-monitoring ↩
HHS, “HHS Office for Civil Rights Issues Bulletin on Requirements under HIPAA for Online Tracking Technologies to Protect the Privacy and Security of Health Information”, 1 December 2022, https://www.hhs.gov/about/news/2022/12/01/hhs-office-for-civil-rights-issues-bulletin-on-requirements-under-hipaa-for-online-tracking-technologies.html ↩
HHS Office for Civil Rights, “HIPAA Update from the Office for Civil Rights”, presentation to NCVHS listing the bulletin’s 18 March 2024 update, April 2024, https://ncvhs.hhs.gov/wp-content/uploads/2024/04/S-Presentation-NCVHS-FC-Day-2-OCR-Noonan.pdf ↩
HHS Office for Civil Rights, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates”, last reviewed 26 June 2024, https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html ↩↩↩
eCFR, 45 CFR 164.312, “Technical safeguards”, text as of 1 October 2026, https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312 ↩↩
HHS, “HIPAA Security Rule Notice of Proposed Rulemaking to Strengthen Cybersecurity for Electronic Protected Health Information”, fact sheet, 27 December 2024, https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html ↩
HHS, “Regulatory Initiatives”, last reviewed 27 June 2025, https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/index.html ↩
HHS, “Minimum Necessary Requirement”, https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html ↩
HHS, “Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule”, last reviewed 3 February 2025, https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html ↩
eCFR, 45 CFR 164.308(a)(7), “Contingency plan”, text as of 1 October 2026, https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308 ↩
HHS, “Breach Notification Rule”, https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html ↩
FDA, “Clinical Decision Support Software”, final guidance issued 29 January 2026, https://www.fda.gov/regulatory-information/search-fda-guidance-documents/clinical-decision-support-software ↩↩
FDA, “Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations”, draft guidance, January 2025, https://www.fda.gov/regulatory-information/search-fda-guidance-documents/artificial-intelligence-enabled-device-software-functions-lifecycle-management-and-marketing ↩
EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 6, Article 113 and Annexes I and III, https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng ↩↩
EUR-Lex, Regulation (EU) 2026/1744 (Digital Omnibus on AI) of 8 July 2026, OJ L of 24 July 2026, https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng ↩
ASTP/ONC, “§ 170.315(g)(10) Standardized API for patient and population services”, updated 15 May 2026, https://healthit.gov/test-method/standardized-api-patient-and-population-services/ ↩
HL7, “SMART App Launch Implementation Guide”, v2.2.0, https://hl7.org/fhir/smart-app-launch/ ↩
ASTP/ONC, “Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing” (HTI-1), Federal Register, 9 January 2024, https://www.federalregister.gov/documents/2024/01/09/2023-28857/health-data-technology-and-interoperability-certification-program-updates-algorithm-transparency-and ↩
ASTP/ONC, “HTI Rules”, https://healthit.gov/regulations/hti-rules/ ↩
ASTP/ONC, “Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions To Unleash Prosperity” (HTI-5), proposed rule, Federal Register, 29 December 2025, https://www.federalregister.gov/documents/2025/12/29/2025-23896/health-data-technology-and-interoperability-astponc-deregulatory-actions-to-unleash-prosperity ↩
ASTP/ONC, “Information Blocking”, updated 8 April 2026, https://healthit.gov/information-blocking/ ↩
HHS, “HHS Announces Crackdown on Health Data Blocking”, 3 September 2025, https://www.hhs.gov/press-room/hhs-crackdown-health-data-blocking.html ↩
EUR-Lex, Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 4(15), 9 and 35, https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng ↩
NHS England, “Data Security and Protection Toolkit”, https://www.dsptoolkit.nhs.uk/ ↩
NHS England Digital, “Digital Technology Assessment Criteria (DTAC) guidance for buyers and suppliers”, https://digital.nhs.uk/services/digital-technology-assessment-criteria-dtac ↩
Press Information Bureau, Government of India, “DPDP Rules, 2025 Notified”, 17 November 2025, https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf ↩

Frequently asked questions

Does HIPAA apply to my app?

Only if you are a covered entity, meaning a health plan, a clearinghouse or a provider that conducts standard electronic transactions, or you handle PHI on behalf of one as a business associate. A consumer app that people download and fill in themselves usually falls under the FTC Act, the FTC’s Health Breach Notification Rule and state laws such as Washington’s My Health My Data Act.

Does OpenAI sign a BAA for the API?

Yes. As of 23 October 2026, eligible organisations accept OpenAI’s BAA in the API Platform settings without an enterprise agreement, though self-serve enrolment needs a history of API usage. The organisation must also be provisioned with Modified Retention, and only listed endpoints are covered.

Is Claude HIPAA compliant?

Anthropic signs a BAA covering its first-party API, Claude Enterprise and Claude in Microsoft Foundry, once the organisation’s Primary Owner accepts it and HIPAA is enabled. On the API, the Messages API is covered, but the Batch API, Files API, code execution and web fetch are not, and some models need 30-day data retention.

Which AI APIs sign a BAA?

As of 23 October 2026, Amazon Bedrock is on AWS’s HIPAA eligible list, Google’s BAA covers Gemini Enterprise Agent Platform, and Microsoft’s covers Foundry Models sold by Azure, including Azure OpenAI. OpenAI and Anthropic sign BAAs for their own APIs with conditions. Google’s Gemini Developer API terms don’t mention a BAA and bar clinical use.

Is Google Analytics HIPAA compliant?

Google says it makes no representation that Google Analytics meets HIPAA requirements, and it doesn’t offer a BAA for it. HIPAA-regulated customers must not expose PHI to it, which rules it out for patient portals and booking flows.

Does a clinical AI feature need FDA clearance?

Not if it meets all four of the FDA’s Non-Device CDS criteria. The software must not analyse medical images or signals, must work from medical information, must support a health care professional, and must let that professional independently review the basis for its recommendations. Time-critical tools and patient-facing diagnosis fall outside that exclusion.