The full answer
HIPAA applies to US healthcare providers, insurers and the businesses that handle protected health information on their behalf. It has technical, administrative and physical safeguards, and software design covers a large share of the technical ones.
In practice that means encrypting health data in transit and at rest, giving each user only the access their role requires, logging every view and change of patient records, enforcing strong authentication and session timeouts, and keeping health data out of logs, analytics tools and push notifications.
Infrastructure is built on cloud services that the provider makes available for HIPAA workloads, configured under the business associate agreement you hold with that provider. Third-party tools that touch patient data must also support HIPAA, and we check this before choosing them.
Before major releases, we run vulnerability assessment and penetration testing. We document the controls we implement so your compliance team can include them in risk assessments and audits.
HIPAA projects also need careful thinking about mobile devices and integrations, such as what is cached on a phone, how files are shared and how data is exchanged with labs, pharmacies or insurers. We document these flows during discovery so every point where health information moves is protected.