Tepia builds HIPAA compliant web and mobile software for healthcare providers, health plans and digital health startups by mapping each Security Rule safeguard to a concrete architecture decision: unique user access, audit controls, encryption in transit and at rest, and BAA covered services on AWS, Azure or GCP. Each project ships with a data flow diagram and a safeguard map your compliance lead can maintain.
No certificate makes software HIPAA compliant; what counts is whether every safeguard in the Security Rule is designed, built, documented and kept running.
Tepia maps each Security Rule safeguard to the code, configuration or process that satisfies it, so audits start from evidence, not memory.
Read: How to Make an App HIPAA Compliant
Audit logs record who viewed, changed or exported each record, so a privacy officer can answer an access question in minutes, not weeks.
Read: SOC 2 Aligned Software Development
Every service that stores, processes or transmits PHI, from cloud hosting to SMS, is chosen from vendors that will sign a BAA with you.
Read: Security and Compliance
Tepia uses synthetic data in development and staging, so engineers build and debug without touching real patient records at any point.
Regulatory and breach figures Tepia designs around on every HIPAA project.
HHS reported that hacking and IT incidents caused 81 percent of the large health data breaches reported to it for 2024.
In the same HHS report, 16 percent of 2024 large breach reports involved a business associate, which is why every BAA matters.
HHS data shows network servers were the location in 63 percent of large breaches reported for 2024, so server hardening comes first.
HIPAA applies to organizations, not to code. Covered entities such as providers and health plans, and the business associates that handle protected health information for them, must meet the Privacy, Security and Breach Notification Rules. Software is compliant in a practical sense when it lets those organizations meet the rules: it controls who sees what, records access, protects data in storage and in transit, and supports breach investigation. Any vendor that claims a HIPAA certification is describing a third party assessment, not an official government credential.
That framing changes how you evaluate a development partner. The question is not whether they say HIPAA, but whether they can show how each safeguard is handled in the architecture, which vendors sign BAAs, how test data is produced, and what documentation you receive at handoff. Tepia answers those questions in writing during Discovery and keeps the answers current through Support.
The Security Rule groups requirements into administrative, physical and technical safeguards. Physical safeguards mostly sit with your cloud provider and offices. The technical ones land directly in the software, and Tepia maps them like this:
| Safeguard | What it means in the software | What Tepia delivers |
|---|---|---|
| Access control | Unique user IDs, role based permissions, emergency access, automatic logoff | Permission matrix by role and a tested break glass procedure |
| Audit controls | Record of reads, writes, exports and permission changes | Tamper resistant audit log with search for the privacy officer |
| Integrity | Protection against improper alteration or deletion | Versioned records, soft deletes and checksums on stored files |
| Person or entity authentication | Proof that a user is who they claim | Multifactor sign in for staff, single sign on where available |
| Transmission security | Protection of PHI moving across networks | TLS 1.2 or higher everywhere, certificate pinning in mobile apps |
| Encryption at rest | An addressable specification most teams treat as required | Encrypted databases, storage and backups with managed keys |
| Risk analysis | Administrative requirement to identify threats and gaps | Data flow diagram and risk register for your compliance lead |
| Contingency plan | Backups, disaster recovery and emergency operations | Automated backups, restore tests and a recovery runbook |
Our security and compliance page covers the same controls beyond healthcare.
AWS, Azure and GCP each offer a BAA covering a defined list of eligible services. The list matters: a service outside it should not hold PHI even inside a covered account. Tepia checks each component against the current list before choosing it and records the decision in the architecture document.
The harder cases are the small tools every app uses. Email delivery, SMS, push notifications, crash reporting, product analytics, customer support chat and error monitoring each can capture PHI by accident. Tepia handles them in three ways: use a vendor that signs a BAA, scrub identifiers before data leaves your system, or keep the tool away from PHI entirely. Push notifications and texts carry neutral wording such as a new message is waiting, never a diagnosis or appointment type.
AI features follow the same rule. Model APIs reached through BAA covered services such as Azure OpenAI or AWS Bedrock can process PHI under the right terms; consumer chat tools cannot.
Most healthcare breaches in software come from ordinary engineering shortcuts rather than sophisticated attacks. Tepia builds checks against the patterns that show up again and again:
Automated checks for these run in the build pipeline through our DevOps and CI/CD practice, so they are caught before release.
Health systems and payers rarely stop at HIPAA when they review a vendor. They send security questionnaires based on SOC 2 or HITRUST controls and ask about penetration tests, access reviews and incident response. Tepia follows SOC 2 aligned practices, such as change management, quarterly access reviews and documented incident response, so your answers reflect how the system really runs.
State laws add another layer. California’s CCPA, Washington’s My Health My Data Act and similar laws cover consumer health data that HIPAA may not, and the FTC Health Breach Notification Rule applies to many health apps outside HIPAA. Tepia designs consent records, data deletion and export features with these laws in mind. See SOC 2 aligned software development for detail.
Compliance work is built into each of Tepia’s six phases, with a US based project manager accountable for both delivery and documentation.
Typically Discovery takes 1 to 3 months, development and QA 2 to 6 months, and launch about a month. Read about our process, see our work or contact Tepia.
A paragraph or two with information on your product/service or describes a problem your product/service is designed to solve.
CEO
Senior Project Manager
VP & Operations Manager
