Key Takeaways
- Healthcare software development for a HIPAA-regulated product typically costs $75,000 to $250,000 or more, per Keyhole Software's 2026 benchmarks (January 2026).
- Any vendor that stores or accesses patient data for you, including cloud hosts and patient portal AI chatbots, needs a business associate agreement (BAA), per HHS (July 2026).
- The proposed HIPAA Security Rule update is not final as of October 2026. The federal agenda targets July 2027, and the current rule still applies.
- Build to the proposed bar (December 2024) now: encryption, multi-factor authentication (MFA), audit logs and backups you can restore within 72 hours.
- Plan EHR and payer connections around HL7 FHIR R4. CMS (January 2024) requires many payers to offer FHIR APIs, generally by January 1, 2027.
This article is not legal advice. Confirm your obligations with your compliance team or a healthcare attorney before you build or launch.
What Is Healthcare Software Development?
Healthcare software development is the work of planning, building and running software that handles health data or supports care, such as patient portals, telehealth apps and EHR (electronic health record) integrations. Regulation sets it apart. If your product creates, stores or shares health data for a provider or health plan, HIPAA shapes the design from day one.
HIPAA is the US law protecting health information held by covered entities (health plans, clearinghouses and most providers) and their business associates, per the HHS Privacy Rule summary. Protected health information (PHI) is health or payment data that can identify a person. ePHI is PHI in electronic form. Consumer apps outside HIPAA may fall under the FTC's Health Breach Notification Rule instead.
What Types of Healthcare Software Can You Build?
The most common types of healthcare software are patient portals, telehealth apps, EHR and insurance integrations, AI-assisted intake and document processing, and scheduling tools. Each type handles PHI in a different way, so each carries its own mix of security, integration and vendor-contract work. The table below shows the main concern for each one.
| Software type | Main build concern |
|---|---|
| Patient portal | Identity checks, record export, no ad trackers on logged-in pages |
| Telehealth app | Encrypted video and a BAA with any video vendor handling PHI |
| EHR integration | FHIR APIs, sign-in permissions and data mapping |
| Insurance integration | HIPAA transaction standards and payer APIs |
| AI intake and document processing | An AI vendor BAA, human review, possible FDA questions |
| Scheduling | Reminders that reveal as little PHI as possible |
Two extra checks matter. HHS tracking guidance (reviewed June 2024) says analytics pixels on logged-in pages can generally reach PHI. And an AI tool that suggests diagnoses may count as software as a medical device, which the FDA regulates.
Our AI development team flags this early. Portals usually start as web applications, telehealth often adds a mobile app, and our industries page shows the healthcare work we take on.
What Does HIPAA Require From Software Teams?
HIPAA gives software teams four sets of duties. The Privacy Rule limits how PHI is used and shared. The Security Rule requires administrative, physical and technical safeguards for ePHI. The Breach Notification Rule sets notice deadlines. Business associate agreements extend those duties to every vendor that handles PHI on your behalf.
Privacy Rule
The Privacy Rule's "minimum necessary" standard means sharing only what a task needs. The biggest feature driver is the patient's right of access. Under 45 CFR 164.524, a covered entity must act on a request within 30 days, with one 30-day extension, and give an electronic copy in the requested format if readily producible.
Security Rule Safeguards
The Security Rule's technical safeguards cover access control, audit controls, integrity, authentication and transmission security, per HHS (reviewed August 2026). Encryption is "addressable" today, which does not mean optional. You implement it, or document why not and use an equivalent. A written risk analysis, a documented review of threats to ePHI, is required.
Breach Notification Rule
The Breach Notification Rule requires notice to affected people without unreasonable delay and no later than 60 days after discovery, plus HHS notice within 60 days when 500 or more are affected, per HHS. Data encrypted to HHS-specified NIST standards, with keys kept separately, generally does not trigger notice if lost.
Business Associate Agreements
A BAA is the contract that binds a vendor to HIPAA safeguards. HHS counts cloud hosts, EHR vendors, app developers handling PHI for covered entities and portal chatbot vendors as business associates, even a host storing encrypted data without the key, per HHS cloud guidance. In HHS's report on 2024 breaches (listed on HHS.gov as of May 2026), business associates accounted for 16% of 663 large breaches but about 85% of the 242.9 million people affected.
What Is the Status of the Proposed HIPAA Security Rule Update?
The proposed HIPAA Security Rule update is still only a proposal as of October 2026. HHS published it in the Federal Register on January 6, 2025, and comments closed March 7, 2025. The federal regulatory agenda now lists final action for July 2027, and HHS says the current Security Rule stays in effect until a final rule is issued.
A Federal Register search for the rule's number, run in October 2026, returns only the January 2025 proposal. The Unified Agenda, the federal schedule of planned rules, shows July 2027, which HIPAA Journal reported in July 2026 replaced a May 2026 target. Agenda dates are not binding.
The HHS fact sheet (December 2024) says nearly all specifications would become required, including encryption and MFA. Teams would also need an asset inventory, network map, scans every six months, yearly penetration tests, 72-hour restore plans and yearly audits. As proposed, a final rule would take effect 60 days after publication, with compliance 180 days later. Treat it as a design target now.
How Do HL7 FHIR and the Cures Act Shape EHR Integration?
HL7 FHIR is the API standard that US health IT rules point to for sharing patient data, and the 21st Century Cures Act penalizes practices that block that sharing. For EHR integration, you will usually build against FHIR R4 endpoints and avoid features that make it hard for patients or providers to get their data out.
FHIR (Fast Healthcare Interoperability Resources) packages health data into building blocks called resources, like Patient or Observation, and moves them through APIs, which are set ways for systems to exchange data. HL7 lists R5 as current, but ONC's API certification criterion (updated May 2026) requires FHIR R4.0.1 and SMART App Launch, which governs app sign-in. The CMS interoperability rule (January 2024) requires Medicare Advantage, Medicaid, CHIP and some marketplace plans to offer FHIR APIs, generally by January 1, 2027.
Information blocking is any practice likely to interfere with access to or exchange of electronic health information, unless law requires it or an exception applies, per ONC. HHS-OIG (updated May 2026) says penalties can reach $1 million per violation. Review any data fees, delays or format locks with counsel.
Which Security Features Does HIPAA-Ready Software Need?
HIPAA-ready software needs encryption at rest and in transit, unique logins with role-based access, MFA, audit logs, tested backups and a signed BAA for every vendor in the PHI path. The checklist below ties each feature to the rule it supports, so your team can trace every control back to a requirement.
"HIPAA-ready" is our term, since compliance also depends on how you run the software. Encryption scrambles data so only key holders can read it. MFA adds a second login proof, like a phone code.
HIPAA-Ready Feature Checklist
| Feature | Why it matters | Rule it supports |
|---|---|---|
| Encryption at rest | Lost data may not be a reportable breach | 164.312(a); breach safe harbor; required (proposed) |
| Encryption in transit (TLS 1.2+, the protocol behind HTTPS) | Blocks interception between systems | Transmission security, 164.312(e) |
| Unique IDs, role-based access, auto logoff | People see only what their job needs | Access control, 164.312(a) |
| MFA | A stolen password alone cannot open records | Authentication, 164.312(d) |
| Audit logs | Shows who viewed or changed what | Audit controls, 164.312(b) |
| Tested backups | Restores service after ransomware | Contingency planning; 72-hour restore (proposed) |
| Asset inventory and data map | You cannot protect what you cannot see | Risk analysis, 164.308(a)(1) |
| Scans and penetration tests | Finds gaps before attackers do | Risk management; 6 and 12 months (proposed) |
| Patient record export | Patients get copies in their format | Right of access, 164.524; Cures Act |
| No trackers on logged-in pages | Stops hidden PHI sharing | Privacy Rule; HHS tracking guidance |
| BAA register | Proves every PHI vendor is under contract | Business associate provisions |
How Much Does Healthcare Software Development Cost?
Healthcare software development usually costs $75,000 to $250,000 or more, according to Keyhole Software's 2026 benchmarks from over 200 projects. HIPAA compliance, EHR integration and patient data security push costs up. A simple MVP, or minimum viable product, takes about 2 to 4 months, while complex platforms run 8 to 18 months or longer.
Keyhole's 2026 ranges are below; the healthcare examples are ours.
| Size | Cost | Timeline | Example healthcare scope |
|---|---|---|---|
| Simple or MVP | $40,000 to $120,000 | 2 to 4 months | Booking app or single-clinic portal |
| Medium | $120,000 to $300,000 | 4 to 8 months | Portal with messaging and EHR sync |
| High | $300,000 to $1,000,000+ | 8 to 18+ months | Multi-site telehealth with AI intake |
Security spend looks small next to a breach. IBM's Cost of a Data Breach Report 2026 (July 2026) puts the global average at $4.99 million. Healthcare averaged $6.64 million, the costliest industry for the 13th straight year, per Baker Donelson's summary (July 2026).
A $6.64 million breach is about 26 times the top of the typical build range ($6,640,000 divided by $250,000 = 26.56). For pricing models, see our guide to custom software development cost in 2026.
What Does a Phased Healthcare Build Plan Look Like?
A phased healthcare build plan runs in five stages, each with a compliance output. You map PHI and vendors first, design access rules before screens, build in two-week sprints, test security before every release and keep monitoring after launch. Skipping the early stages is how teams end up retrofitting encryption and audit logs later.
This is how Software Solutions Inc. works, with an NDA before discovery and a detailed estimate before any code.
| Phase | What happens | Compliance output |
|---|---|---|
| 1. Discovery and planning | Goals, users and systems mapped; scope and estimate set | PHI data map, vendor list with BAA status |
| 2. Design and architecture | Foundation set; you approve clickable screens | Role matrix, encryption plan, FHIR-resource list |
| 3. Agile development | Two-week sprints with progress updates | MFA, access control and audit logs built early |
| 4. Testing and security | Automated, manual and security tests each release | Findings fixed, evidence saved |
| 5. Launch and support | Deploy, monitor and improve | Incident plan, restore test, alerts |
You own all source code, designs and documentation, and we never use client data to train outside AI models.
When Should You Not Build Custom Healthcare Software?
You should not build custom healthcare software when an off-the-shelf product fits your workflow and its vendor will sign a BAA. Custom work pays off when you need a distinct patient experience, several integrations or a product you plan to sell. For a standard video visit or basic booking, buying is usually faster and cheaper.
Before you commit, ask who will own security after launch. With custom software, you do.
Final Thoughts on Healthcare Software Development
Healthcare software development goes best when compliance is part of the plan from week one. Map your PHI, sign BAAs, design to the proposed Security Rule bar and build on FHIR. Then budget with the ranges above and the cost of a breach in mind.
Book a free consultation with Software Solutions Inc., and we will reply within one business day.
Sources
- HHS, HIPAA for Professionals: the Privacy, Security, Breach Notification and Enforcement Rules.
- HHS, Summary of the HIPAA Privacy Rule: who HIPAA covers, the definition of PHI, the minimum necessary standard.
- eCFR, 45 CFR 164.524, Access of individuals to protected health information: 30-day response window, one 30-day extension, electronic copy in the requested format if readily producible.
- HHS, Summary of the HIPAA Security Rule: administrative, physical and technical safeguards and the meaning of addressable specifications.
- eCFR, 45 CFR 164.312, Technical safeguards: access control, automatic logoff, encryption (addressable), audit controls, integrity, authentication and transmission security.
- HHS, Guidance on Risk Analysis: risk analysis as a required specification under 45 CFR 164.308(a)(1)(ii)(A).
- HHS, Breach Notification Rule: 60-day individual notice deadline and 60-day HHS notice for breaches affecting 500 or more people.
- HHS, Guidance to Render Unsecured PHI Unusable, Unreadable, or Indecipherable: NIST SP 800-111 for data at rest, encryption safe harbor, storing keys separately.
- HHS, Business Associates: definition and examples including cloud providers, app developers and AI chatbot vendors.
- HHS, Guidance on HIPAA and Cloud Computing: a cloud provider storing only encrypted ePHI without the key is still a business associate.
- HHS, Annual Report to Congress on Breaches of Unsecured PHI, Calendar Year 2024: 663 large breaches, about 242.9 million people affected, business associates at 16% of reports and 85% of affected people.
- HHS, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates: tracking technologies on logged-in portal pages can generally access PHI.
- FTC, Complying with FTC's Health Breach Notification Rule: the rule covers health apps and vendors not covered by HIPAA.
- FDA, Software as a Medical Device: definition of software as a medical device.
- HHS, HIPAA Security Rule NPRM: NPRM issued December 27, 2024; the current Security Rule remains in effect during rulemaking.
- HHS, HIPAA Security Rule NPRM Fact Sheet: proposed required encryption and MFA, asset inventory and network map, six-month scans, yearly penetration tests, 72-hour restoration plans and yearly audits.
- Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of ePHI: January 6, 2025 publication, March 7, 2025 comment deadline, proposed 60-day effective date and 180-day compliance period.
- Reginfo.gov, Unified Agenda entry for RIN 0945-AA22: final action listed for July 2027.
- HIPAA Journal, HIPAA Security Rule Update Postponed: July 2026 report of the move from a May 2026 target to July 2027.
- ONC, Standardized API for patient and population services, 170.315(g)(10): FHIR R4.0.1, SMART App Launch and TLS 1.2 or higher for certified health IT APIs.
- CMS, Interoperability and Prior Authorization Final Rule (CMS-0057-F): impacted payers, FHIR APIs, requirements generally starting January 1, 2027.
- ONC, Information Blocking: definition of information blocking and its exceptions.
- HHS-OIG, Information Blocking: penalties of up to $1 million per violation.
- Keyhole Software, Custom Software Development Cost: 2026 Pricing and Timeline Benchmarks: healthcare range of $75,000 to $250,000+, size-based cost and timeline ranges.
- IBM, Cost of a Data Breach Report 2026: global average breach cost of $4.99 million.
- Baker Donelson, Ten Takeaways from IBM's 2026 Cost of a Data Breach Report: healthcare average of $6.64 million, costliest industry for the 13th straight year.
Frequently Asked Questions
A HIPAA compliant app usually costs $75,000 to $250,000 or more, based on Keyhole Software's 2026 benchmarks. Simple MVPs with one integration sit near the low end. Two-way EHR sync, AI features, payer connections and many user roles push the cost higher. Ask vendors for an itemized written estimate first.
You need a BAA if your developer will create, receive, store or access PHI for you, such as during hosting, support or testing with real data. HHS lists app developers handling PHI for covered entities as business associates. If the developer only sees fake test data, ask your compliance team.
No. As of October 2026, the HIPAA Security Rule update remains a proposed rule, published January 6, 2025. The federal regulatory agenda lists final action for July 2027, though that date is not binding. The current Security Rule still applies, so check HHS and the Federal Register as you plan.
Most US EHR and payer integrations should target FHIR R4, version 4.0.1, because ONC's API certification criterion and the CMS payer API rule both reference it. FHIR R5 is the latest published version, but US rules still point to R4. Confirm each EHR vendor's version during discovery.
Yes, with safeguards. An AI vendor that handles PHI for a covered entity, such as a patient portal chatbot, is a business associate and needs a BAA. Limit the data it sees, log its use and keep a person reviewing outputs. Software Solutions Inc. never uses client data to train outside AI models.
The Software Solutions Inc. Team
Engineering & Content Team
Written by the team at Software Solutions Inc., a custom software development company building web, mobile, AI, blockchain and cloud software. We write these guides from what we learn on real client projects.
