HIPAA is an engineering problem, not just a legal one
Most teams treat HIPAA compliance as something legal signs off on. In practice, the controls that matter — encryption at rest and in transit, audit logging, access controls, breach notification pipelines — are all engineering decisions made at the code level.
We have built four telehealth platforms in the past two years. Each one started with the same conversation: what counts as PHI in your system, where does it live, and who can touch it?
Business Associate Agreements come first
Before writing a single line of code, you need BAAs with every vendor that will touch PHI. That means your cloud provider (AWS, GCP, Azure all have BAA programs), your database hosting, your video conferencing SDK, your analytics platform, and your logging service.
This is not bureaucracy for its own sake. If a vendor does not offer a BAA, they cannot be used in a system that handles PHI. Finding this out mid-build is expensive. We audit the vendor list before kickoff.
Encryption and access controls
PHI must be encrypted at rest and in transit. In practice this means TLS everywhere, encrypted database volumes, and application-level encryption for especially sensitive fields like mental health notes or HIV status.
Role-based access control is non-negotiable. Patients should only see their own records. Providers should only see records for patients in their care. Admins should have a separate, audited access path. We enforce this at the API layer, not just the UI.
Audit logs: the part teams underestimate
HIPAA requires audit logs of who accessed PHI, when, and from where. This is more complex than it sounds. You need immutable logs (append-only, ideally shipped to a separate system), you need to log at the right granularity, and you need a process for reviewing anomalous access.
We use a dedicated audit log table with a write-once policy, replicated to a separate storage bucket on a daily schedule. Every PHI read and write emits an event. Alerts fire when access patterns deviate from a rolling baseline.
Breach notification and incident response
HIPAA requires breach notification to affected individuals within 60 days and, for breaches affecting more than 500 people, to the Secretary of HHS and prominent media outlets. Having a documented incident response plan is required — and discovering you do not have one during an actual breach is the worst time.
We include a lightweight incident response runbook in every telehealth project we deliver. It covers detection, containment, notification, and post-incident review. It is not glamorous, but it is what gets you through a stressful moment without making it worse.