HIPAA Requirements for a Wellness App: What Founders Get Wrong

Ashton Group · Updated August 2026

The most common HIPAA misunderstanding we see: founders assume any app that touches health data is covered by HIPAA. The reality is narrower, and more interesting, because the answer changes with your business model, sometimes overnight.

When HIPAA actually applies

HIPAA covers "covered entities" (providers, health plans, clearinghouses) and their "business associates," vendors that handle protected health information on a covered entity's behalf. A direct-to-consumer wellness app, where individuals track their own sleep, workouts, or symptoms and no provider is involved, is generally not covered by HIPAA.

The trap is that the moment you sell to an employer health plan, integrate with a clinic, or land a B2B contract with an insurer, you likely become a business associate, sign a Business Associate Agreement (BAA), and inherit the full obligation set. Many wellness companies cross this line at their first enterprise deal, with an architecture that was never designed for it. Note also that not being covered by HIPAA does not mean unregulated: the FTC's Health Breach Notification Rule and state privacy laws such as Washington's My Health My Data Act reach consumer health apps directly.

What HIPAA alignment demands of your architecture

• Encryption everywhere: TLS in transit and encryption at rest for anything containing PHI, including backups and logs, which teams reliably forget.
• Access control and minimum necessary: role-based access, unique accounts (no shared logins), and automatic session timeouts.
• Audit logging: a tamper-resistant record of who accessed what PHI and when. This is architectural; bolting it on later is expensive.
• A BAA chain: every vendor touching PHI (hosting, email, analytics, LLM providers) must sign a BAA. This immediately disqualifies many popular tools and most consumer AI endpoints.
• Breach readiness: documented incident response, risk analysis, workforce training, and notification procedures.

The design move that avoids most of this

The strongest position is often architectural: keep sensitive processing on the user's device so PHI never reaches your servers. We build health products where video and biometric analysis run entirely on-device, and only derived, de-identified metrics sync to the cloud. Data you never hold is data you cannot breach, and "we cannot see your health data, by design" is both a compliance posture and a marketing asset.

What it costs

One honest caveat: engineers align your systems with HIPAA's technical safeguards; only qualified counsel can tell you HIPAA applies to you and review your BAAs. Good firms bring both to the table and don't blur the line.

Frequently asked questions