Privacy planned in from the first sketch.
Health data needs extra care. Here is how we handle it when we build your app, and where our part ends and yours begins.
Built to meet HIPAA requirements
We build apps to meet HIPAA's requirements from the start: access based on each person's role, encryption when data is sent and stored, audit logs of who viewed or changed records, and hosting with providers that sign business associate agreements. We sign a BAA with you before we handle any protected health information.
HIPAA compliance is shared. The app covers the technical safeguards, and your organization covers its policies, staff training, and vendor agreements. We work with your compliance lead so every requirement has an owner and nothing falls through the gaps.
How we handle data on every project
- Before code
Map the data
What the app collects, why it needs it, where it is stored, and who can see it. We write this down and agree on it with you.
- Before code
Agree on the rules
HIPAA, your IRB approval, or your own policies. Your compliance lead decides what applies. We plan the build around it.
- During the build
Build the controls
Access by role, careful storage, and only the data the app needs. We document what we built and why.
- Before launch
Review together
We walk through the data map and the controls with your team before real users or real data go in.
Different teams answer to different rules
HIPAA
For clinics and the companies that work with them, we build to the HIPAA requirements your compliance lead identifies, and we work with them on what the app must do.
IRB and study protocols
For research teams, we plan data collection and storage around your approved protocol and your institution's policies.
Your own policies
Many organizations have their own security and data rules. We read them first and build to them.
AI services
If an app uses AI, we decide with you what data, if any, is sent to the AI service, and we keep personal details out unless your rules allow it.
Controls we plan for
Every app is different. These are the questions we work through with you on every project that handles personal or health data.
Who can see what
Access based on each person's role, so staff, patients, and admins only see what they need.
Collect less
If the app does not need a piece of data, we do not collect it.
Storage and transfer
Encryption when data is sent and when it is stored, on hosting chosen to fit your rules, usually AWS, Google Cloud, or Microsoft Azure.
Records of access
Audit logs of who viewed or changed records in apps that handle health data.
When a project involves protected health information, we sign a business associate agreement before we handle any of it.
Clear about who is responsible for what
Privacy is shared work. Here is how we usually split it.
We take care of
- Mapping the app's data with you
- Building the controls we agree on
- Documenting what we built and why
- Signing a business associate agreement when the work involves protected health information
- Fixing security issues in our code while we support the app
You take care of
- Deciding which rules apply, with your compliance lead
- Your policies, staff training, and how the app is used
- Agreements with your own vendors
- Approving the data map before launch
We do together
- Choosing hosting and outside services
- Reviewing the app before real data goes in
- Deciding what changes when your rules change
Questions about privacy and security
Are your apps HIPAA compliant?
We build apps to meet HIPAA's requirements, including role-based access, encryption, audit logs, and a business associate agreement with you. Full compliance also depends on your organization's policies and training, so we work with your compliance lead on both.
Can you work within our IRB requirements?
Yes. We plan the app's data collection and storage around your approved protocol and your institution's policies, and we work with your team when anything needs to change.
Will you sign a business associate agreement?
Yes. When a project involves protected health information, we sign a business associate agreement before we handle any of it.
Where will our data be stored?
Where your rules allow. We usually host on major cloud providers that sign business associate agreements, such as AWS, Google Cloud, or Microsoft Azure, and we choose with you during the data map. Health data stays out of tools that are not approved for it.
Will you sign an NDA?
Yes. We are happy to sign your NDA before you share details, or we can send ours.
Do you test apps for security issues?
Yes. Every project gets code review, automated checks for known security issues in the libraries we use, and testing of sign-in and access rules before launch. When your rules call for it, we arrange outside security testing too.
Have health data in your plans?
A 30-minute call about what your app needs to collect and the rules you work under. You'll leave with a clear next step, whether or not we work together.