Does your mHealth app need to be HIPAA compliant?

Looking to grab a share of that $2.4 billion in revenue that mobile health (mHealth) applications are expected to generate by 2017? If so, Step #1 in the process should be determining if the information your app will gather and transmit falls under the Health Insurance Portability and Accountability Act (HIPAA).

As an InformationWeek story succinctly described, “HIPAA was written nearly 20 years ago, before mobile health applications were ever envisioned. Because of this, some areas of the law make it hard to determine which apps must be HIPAA-compliant and which are exempt.”

At the essence of HIPAA is protected health information or PHI, defined by the US Department of Health and Human Services as individually identifiable information that is created or received by a health care provider, health plan or health care clearing house and relates to past, present or future physical or mental health conditions of an individual.

So, in short, an app that shares personally-identifiable information with a covered entity (a health care provider or health plan) must be HIPAA-compliant.

A basic rule of thumb – although certainly not true in every case – is that mHealth apps intended for the general public (calorie counting, step tracking, etc.) do not to be HIPAA-compliant, while apps used by medical personnel at covered entities do.

For instance, SD3 created the HIPAA-compliant apps HipaaCat and My Doctor Note (for Android and iOS) for a client seeking the ability to safely transfer protected images and messages between doctors and staff at a healthcare provider.

If you’re looking for assistance with mobile app development that requires experience with the healthcare industry and HIPAA compliance, consider contacting SD3 Corporation.

 

<< Back