TL;DR
A HIPAA compliant app is any mobile or web application that protects electronic Protected Health Information (ePHI) through encryption, access controls, audit logging, and a signed Business Associate Agreement. There is no official HIPAA certification, so providers must verify compliance themselves. For rehab clinics, using a compliant app is both a legal requirement and a prerequisite for billing Remote Therapeutic Monitoring CPT codes. The stakes are real: penalties reach over $2 million per violation category, and private practices are the most common entity type forced into corrective action by federal regulators.
Definition: What Is a HIPAA Compliant App?
A HIPAA compliant app is a mobile or web application designed to create, receive, store, or transmit electronic Protected Health Information while satisfying the privacy, security, and breach notification standards required by the Health Insurance Portability and Accountability Act.
That definition sounds simple. The reality is more nuanced.
HIPAA was signed into law in 1996, years before smartphones existed. The law itself never mentions apps. But its rules apply to any technology that touches patient data within the U.S. healthcare system. When a physical therapist sends a home exercise video through an app, when an SLP assigns speech homework digitally, when a chiropractor messages a patient about their treatment plan, HIPAA applies to every one of those interactions.
The most important thing clinicians should understand: compliance is an ongoing posture, not a one-time event. No government body issues a “HIPAA certified” stamp for apps. Any vendor claiming official certification is misleading you. What actually matters is whether the vendor maintains documented safeguards, signs a Business Associate Agreement, and conducts regular risk assessments.
If your practice uses physical therapy technology to communicate with patients or deliver care plans, every tool in that workflow needs to meet these standards.
What Makes an App HIPAA Compliant?
HIPAA compliance rests on three categories of safeguards defined in the HIPAA Security Rule, plus a contractual requirement that ties vendors to the same obligations as the healthcare providers they serve.
Administrative Safeguards
These are the policies and procedures that govern how your organization (and its vendors) handle patient data. They include conducting risk assessments, training staff on privacy practices, designating a security officer, and establishing incident response plans. Administrative safeguards are where most compliance failures begin, because they require ongoing attention rather than a one-time technical setup.
Physical Safeguards
Physical safeguards control who can physically access systems containing ePHI. This covers facility access (locked server rooms, restricted areas), workstation security, and proper disposal of hardware that stored patient data. For app vendors, physical safeguards extend to their data centers and cloud infrastructure.
Technical Safeguards
Technical safeguards are what most people think of first: encryption, access controls, audit logs, and automatic session timeouts. A HIPAA compliant app should encrypt data both at rest and in transit using modern standards (AES-256 for storage, TLS 1.2 or higher for transmission). Every user must have a unique identifier; shared logins violate HIPAA. The app must log who accessed what data and when, creating an audit trail that can be reviewed during investigations.
The Business Associate Agreement (BAA)
A Business Associate Agreement is a legally required contract between a healthcare provider (the “covered entity”) and any vendor that handles PHI on the provider’s behalf. The BAA spells out how the vendor will protect data, what uses are permitted, how breaches will be reported, and what happens when the relationship ends.
Without a BAA, using an app with patient data is a violation, period. North Memorial Health Care learned this the hard way, paying $1.55 million in penalties for failing to have a BAA with a major contractor.
Provider Checklist: What to Verify Before Using Any App
Before adopting any app for patient communication or care delivery, confirm these items:
- Signed BAA available. If the vendor won’t sign one, walk away.
- Encryption at rest and in transit. Ask specifically about AES-256 and TLS 1.2+.
- Unique user identifiers. No shared accounts across staff.
- Audit logging. The app should record access events automatically.
- Role-based access controls. Staff should only see data relevant to their role.
- Automatic session timeout. Idle sessions must lock.
- Breach notification procedures. The vendor should have documented response plans.
- Regular risk assessments. Ask how often the vendor conducts them and whether results are available.
See AC Health’s plan options to compare how a HIPAA-native platform handles these requirements across different practice sizes.
Which Apps Need HIPAA Compliance?
The dividing line is straightforward: if an app handles Protected Health Information that flows to or from a covered entity (a healthcare provider, health plan, or healthcare clearinghouse), HIPAA applies.
PHI includes any individually identifiable health information related to a person’s past, present, or future health condition, treatment, or payment for treatment. A patient’s name paired with their diagnosis, a video of a patient performing prescribed exercises, a message from a therapist about a treatment plan: all PHI.
Apps That Must Be HIPAA Compliant
- Electronic health record (EHR) systems
- Telehealth and video visit platforms
- Secure messaging apps used between providers and patients
- Home exercise program (HEP) apps that deliver personalized exercise instructions
- Remote Therapeutic Monitoring platforms
- Patient portals
- Condition-specific care management apps
Apps That Typically Do Not Need HIPAA Compliance
- General fitness trackers (Fitbit, Apple Watch activity rings) used independently
- Diet and nutrition logging apps
- Meditation and wellness apps
- Habit trackers with no clinical connection
The catch is that this distinction collapses quickly in practice. HHS has clarified that complications arise when a personal-use app provides a service on behalf of a covered entity. If a doctor asks a patient to wear a data-collecting device and that data will later be shared with the doctor, HIPAA applies. The same logic extends to PT practices that ask patients to log exercises or send progress photos through consumer apps.
| App Category | HIPAA Required? | Why |
|---|---|---|
| EHR / EMR system | Yes | Stores and transmits treatment records (ePHI) |
| Secure messaging with patients | Yes | Messages contain individually identifiable health info |
| HEP delivery app | Yes | Care plans prescribed by a clinician are PHI |
| RTM platform | Yes | Collects and transmits patient-reported health data |
| Consumer fitness tracker (standalone) | No | No data flows to a covered entity |
| Meditation app (no provider link) | No | No PHI involved |
| Fitness tracker prescribed by a provider | Yes | Data is shared with a covered entity |
Providers across specialties, including chiropractors and speech-language pathologists, face the same requirements the moment patient data enters a digital tool.
Common HIPAA App Mistakes Clinicians Make
The gap between knowing HIPAA exists and actually following it in daily practice is wide. These are the errors that create real liability for rehab clinics.
Texting Patients From Personal Phones
This is the single most common compliance trigger for rehabilitation providers. Standard SMS is not encrypted, not auditable, and not covered by a BAA. It does not matter if the patient texts first or if they say they’re fine with it. Patient consent does not override HIPAA requirements for secure transmission.
Practitioners on Reddit and clinical forums regularly describe texting patients as a normal part of their workflow, often without realizing it creates a violation. The convenience is obvious. The risk is just as real.
A HIPAA compliant messaging app replaces standard texting by offering encryption, audit trails, and a signed BAA. For clinics looking to stop PHI from leaking through SMS, switching to a purpose-built platform is the most direct fix.
Using Consumer Cloud Services Without a BAA
Google Drive, Apple iCloud, and Dropbox are excellent personal productivity tools. They are not, by default, HIPAA compliant channels for patient data. Many of these services explicitly prohibit using their platforms to create, receive, maintain, or transmit HIPAA-protected information in their standard terms of service. Some offer HIPAA-eligible configurations at enterprise tiers, but the free or standard versions clinicians typically use do not qualify.
Assuming Consumer Video Chat Is Compliant
During the pandemic, HHS temporarily relaxed enforcement around telehealth platforms like FaceTime and Zoom (consumer version). That enforcement discretion has ended. Clinicians who continued using non-compliant video tools after the public health emergency declaration expired are at risk.
Sharing Care Plans Through Non-Compliant Channels
Emailing exercise PDFs, texting links to YouTube demonstrations, sending progress photos through Instagram DMs: each of these common shortcuts involves PHI moving through channels that lack encryption, audit controls, and BAA coverage. Clinics that want to avoid emailing PHI to patients need a dedicated, secure delivery channel for care content.
The Cost of Non-Compliance
HIPAA violations carry financial penalties that can threaten the survival of a small practice. The numbers for 2026 are sobering.
Penalty Tiers (Effective January 28, 2026)
| Tier | Knowledge Level | Per Violation | Annual Cap |
|---|---|---|---|
| 1 | Did not know | $145 to $73,011 | $2,190,294 |
| 2 | Reasonable cause | $1,461 to $73,011 | $2,190,294 |
| 3 | Willful neglect, corrected | $14,602 to $73,011 | $2,190,294 |
| 4 | Willful neglect, not corrected | $73,011 to $2,190,294 | $2,190,294 |
Source: HIPAA Journal, 2026 penalty adjustments
Real Enforcement Numbers
The Office for Civil Rights (OCR) reached 21 settlements in 2025, the second-highest annual total on record. From 2009 through January 2026, 7,419 large healthcare data breaches affecting 935.5 million individuals were reported to OCR. The average cost of a healthcare data breach reached $10.93 million in 2025, the highest of any industry for the fourteenth consecutive year.
Private Practices Are the Top Target
This point matters most for the clinics reading this article. HHS reports that private practices are the most common type of covered entity required to take corrective action, ahead of hospitals, outpatient facilities, pharmacies, and health plans. Smaller organizations often lack dedicated compliance staff, making them more likely to have gaps in risk analysis, access controls, and BAA documentation, the three most commonly cited violations in OCR enforcement actions.
A real example from rehabilitation: Complete P.T., Pool & Land Physical Therapy, Inc. settled HIPAA Privacy Rule violations with OCR. The settlement required $25,000 in payment, adoption of a corrective action plan, and years of ongoing compliance reporting. For a small PT clinic, that financial hit plus the administrative burden of a corrective action plan can be devastating.
Poor communication tools don’t just create compliance risk. They also contribute to patient no-shows and dropoffs that erode revenue from the other direction.
How HIPAA Compliance Connects to RTM and Patient Engagement
Here’s where HIPAA compliance stops being purely defensive and starts generating revenue.
Remote Therapeutic Monitoring (RTM) allows rehab providers to bill for monitoring patients between visits using CPT codes 98975, 98977, 98980, and 98981. These codes cover device setup, data collection, interactive communication, and clinical management of patient-reported outcomes.
The requirement is clear: the platform used to collect and transmit RTM data must be HIPAA compliant. Without a compliant app, you cannot bill these codes. A HIPAA compliant app is not just a compliance expense; it is infrastructure that unlocks a legitimate revenue stream.
Beyond billing, HIPAA-compliant patient engagement apps enable secure HEP delivery, care plan monitoring, adherence tracking, and provider-to-patient communication. All of this data, when properly documented, supports both clinical outcomes and RTM billing workflows.
Providers interested in building stronger between-visit relationships can explore strategies for increasing patient engagement that work within a compliant framework.
What to Look For When Evaluating a HIPAA Compliant App
Not every app that claims HIPAA compliance actually meets the standard. Here is what to ask and verify during your evaluation.
1. Will the vendor sign a BAA? This is the first and most important question. If the answer is no, or if it’s vague (“we’re working on it”), the app is not compliant. Period.
2. How is data encrypted? Look for AES-256 encryption at rest and TLS 1.2+ (preferably TLS 1.3) in transit with Perfect Forward Secrecy. Ask directly if this is documented.
3. Does each user get a unique login? Shared accounts violate HIPAA. Every clinician and staff member must have their own credentials.
4. Is multi-factor authentication (MFA) supported? The proposed HIPAA Security Rule update would make MFA mandatory. Even before finalization, it’s a best practice that significantly reduces unauthorized access risk.
5. Does the app maintain audit logs? You need a record of who accessed patient data, when, and what they did with it. This is non-negotiable for investigations or audits.
6. Are role-based access controls available? A front desk coordinator should not have the same data access as the treating clinician. The app should allow granular permission levels.
7. Does the app enforce automatic session timeouts? Idle sessions on unlocked devices are a common breach vector, especially on tablets shared between treatment rooms.
8. What are the vendor’s breach notification procedures? The vendor should have documented plans for detecting, investigating, and reporting breaches within the timeframes required by HIPAA’s Breach Notification Rule.
9. Does the vendor conduct regular risk assessments? Ask for evidence. A vendor that performs ongoing internal security reviews demonstrates the kind of sustained compliance posture that protects your practice.
10. Does the app support your clinical workflow? Compliance matters, but so does usability. A HIPAA compliant app that clinicians find too cumbersome to use will get bypassed in favor of personal phones and texts, recreating the very risk you were trying to eliminate.
Explore AC Health’s clinic solutions to see how these requirements are handled for single and multi-location practices.
2026 Regulatory Update: What’s Changing
The most significant HIPAA regulatory development in over a decade is currently working its way through the rulemaking process.
On January 6, 2025, OCR published a Notice of Proposed Rulemaking for the first material overhaul of the HIPAA Security Rule since 2013. The proposal would make several major changes that directly affect app compliance requirements.
Elimination of “addressable” specifications. Under the current rule, some implementation specifications are labeled “addressable,” meaning organizations can tailor their approach based on size and resources. “Addressable” has never meant optional, but it has provided flexibility. The proposed rule would remove that distinction, making nearly all specifications firm requirements regardless of practice size.
New mandatory technical controls. The proposal includes requirements for multi-factor authentication, encryption of ePHI at rest and in transit, anti-malware protection, vulnerability scanning at least every six months, penetration testing at least once every 12 months, network segmentation, a complete technology asset inventory, and a network map showing how ePHI flows through the organization.
Incident response tightening. The proposed rule would require a 72-hour timeline for certain incident response actions, compressing the window organizations have to detect, contain, and report security events.
Current status (mid-2026): The rule remains on OCR’s regulatory agenda. The agency is reviewing approximately 4,745 public comments. The proposal’s final form, scope, and timing remain uncertain.
What this means for providers evaluating apps now: Choose platforms that already meet the proposed standards. If a vendor’s app lacks MFA, encryption at rest, or audit logging today, it will almost certainly fail to meet the final rule’s requirements. Building compliance around the current minimum is shortsighted when stricter rules are on the horizon.
FAQ
Is there an official HIPAA certification for apps?
No. No government agency certifies apps as HIPAA compliant. Any vendor claiming “HIPAA certified” is using marketing language, not a legal designation. What you should look for instead is a signed BAA, documented security safeguards, and evidence of regular risk assessments. These are the concrete indicators of compliance.
Does my fitness tracker need to be HIPAA compliant?
Not if it operates independently and doesn’t share data with a healthcare provider. But the moment a clinician prescribes a wearable device and receives data from it, HIPAA applies. The test is whether patient health data flows to or from a covered entity.
Can I text patients if they consent?
Patient consent does not exempt a provider from HIPAA’s security requirements. Even if a patient says “just text me,” the provider is still obligated to use a secure, encrypted communication channel that meets HIPAA standards. Standard SMS fails this test regardless of consent. Providers can learn more about building a compliant texting policy for their practice.
What is a Business Associate Agreement?
A BAA is a legally required contract between a covered entity (like your clinic) and any third-party vendor that handles PHI. It defines the vendor’s responsibilities for protecting patient data, limits how they can use it, establishes breach reporting obligations, and extends HIPAA’s requirements beyond your organization to everyone in the data chain.
Do free app plans cover HIPAA compliance?
It depends entirely on the vendor. Some platforms offer HIPAA-compliant features even on free tiers, while others restrict compliance features (encryption, BAA access, audit logging) to paid plans. Always ask explicitly whether the free plan includes a signed BAA and full security safeguards before using it with patient data.
What happens if I use a non-compliant app and there’s no breach?
HIPAA violations don’t require an actual data breach. OCR can investigate and penalize the failure to have proper safeguards in place, even if no data was ever exposed. Using a non-compliant app with PHI is itself the violation.
Can my clinic use one app for everything, or do we need separate compliant tools?
A single HIPAA compliant app that handles messaging, care plan delivery, and monitoring is ideal because it reduces the number of vendors requiring BAAs and minimizes the risk of data leaking between systems. Consolidating tools also reduces the administrative burden of managing compliance across multiple platforms.
How does HIPAA compliance affect RTM billing?
You cannot bill RTM CPT codes (98975, 98977, 98980, 98981) using a non-compliant platform. The data collection, patient communication, and reporting required for these codes must occur through HIPAA-compliant channels. Compliance is literally a billing prerequisite.
Choosing the right HIPAA compliant app protects your patients, your practice, and your revenue. If you’re evaluating platforms for your clinic, reach out to AC Health to see how a HIPAA-native solution works in practice.
{ “@context”: “https://schema.org”, “@type”: “FAQPage”, “@id”: “#faq”, “mainEntity”: [ { “@type”: “Question”, “@id”: “#faq-question-1”, “name”: “Is there an official HIPAA certification for apps?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “No. No government agency certifies apps as HIPAA compliant. Any vendor claiming \”HIPAA certified\” is using marketing language, not a legal designation. What you should look for instead is a signed BAA, documented security safeguards, and evidence of regular risk assessments. These are the concrete indicators of compliance.” } }, { “@type”: “Question”, “@id”: “#faq-question-2”, “name”: “Does my fitness tracker need to be HIPAA compliant?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “Not if it operates independently and doesn’t share data with a healthcare provider. But the moment a clinician prescribes a wearable device and receives data from it, HIPAA applies. The test is whether patient health data flows to or from a covered entity.” } }, { “@type”: “Question”, “@id”: “#faq-question-3”, “name”: “Can I text patients if they consent?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “Patient consent does not exempt a provider from HIPAA’s security requirements. Even if a patient says \”just text me,\” the provider is still obligated to use a secure, encrypted communication channel that meets HIPAA standards. Standard SMS fails this test regardless of consent. Providers can learn more about building a [compliant texting policy](https://ac-health.com/sample-hipaa-compliant-texting-policy-for-therapists/) for their practice.” } }, { “@type”: “Question”, “@id”: “#faq-question-4”, “name”: “What is a Business Associate Agreement?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “A BAA is a legally required contract between a covered entity (like your clinic) and any third-party vendor that handles PHI. It defines the vendor’s responsibilities for protecting patient data, limits how they can use it, establishes breach reporting obligations, and extends HIPAA’s requirements beyond your organization to everyone in the data chain.” } }, { “@type”: “Question”, “@id”: “#faq-question-5”, “name”: “Do free app plans cover HIPAA compliance?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “It depends entirely on the vendor. Some platforms offer HIPAA-compliant features even on free tiers, while others restrict compliance features (encryption, BAA access, audit logging) to paid plans. Always ask explicitly whether the free plan includes a signed BAA and full security safeguards before using it with patient data.” } }, { “@type”: “Question”, “@id”: “#faq-question-6”, “name”: “What happens if I use a non-compliant app and there’s no breach?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “HIPAA violations don’t require an actual data breach. OCR can investigate and penalize the failure to have proper safeguards in place, even if no data was ever exposed. Using a non-compliant app with PHI is itself the violation.” } }, { “@type”: “Question”, “@id”: “#faq-question-7”, “name”: “Can my clinic use one app for everything, or do we need separate compliant tools?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “A single HIPAA compliant app that handles messaging, care plan delivery, and monitoring is ideal because it reduces the number of vendors requiring BAAs and minimizes the risk of data leaking between systems. Consolidating tools also reduces the administrative burden of managing compliance across multiple platforms.” } }, { “@type”: “Question”, “@id”: “#faq-question-8”, “name”: “How does HIPAA compliance affect RTM billing?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “You cannot bill RTM CPT codes (98975, 98977, 98980, 98981) using a non-compliant platform. The data collection, patient communication, and reporting required for these codes must occur through HIPAA-compliant channels. Compliance is literally a billing prerequisite. — Choosing the right HIPAA compliant app protects your patients, your practice, and your revenue. If you’re evaluating platforms for your clinic, [reach out to AC Health](https://ac-health.com/contact-us/) to see how a HIPAA-native solution works in practice.” } } ] }
