What specific HIPAA rules apply to my software?

Introduction

Before writing a single line of code, you must identify which parts of HIPAA govern your application. HIPAA breaks into three core rules—Privacy, Security, and Breach Notification—each containing explicit requirements. Below, we map every rule to concrete developer actions so you can bake compliance into your architecture and processes from day one.

1. Privacy Rule

What it covers:

Uses & Disclosures of PHI
Patient Rights (access, amendment, accounting of disclosures)

Developer Actions:

Data Minimization
- Enforce “required” vs. “optional” fields in your ORM/schema so you never collect unnecessary identifiers.
Purpose-Based Access
- Tag PHI records with metadata (e.g., purpose = ["treatment", "payment", "operations"]) and wrap every fetch/update in middleware that checks the user’s allowed scopes.
Patient Portals & APIs
- Build endpoints for patients to view, download, or request corrections to their PHI. Log each request for auditing.

2. Security Rule

Divided into Administrative, Physical, and Technical safeguards—developers primarily implement and support Technical controls, but must enable processes for the other two.

Rule Category	Requirement	Developer Translation
Admin Safeguards	Risk Analysis & Management	Automate risk register updates; feed findings into backlog tickets.
	Workforce Training	Integrate LMS completion status into your IdP; disable PHI roles on expiry.
	Security Incident Procedures	Expose incident-reporting API endpoints; instrument SIEM alerts.
Physical Safeguards	Facility Access Controls	Enforce disk encryption flags in IaC; fail builds if disabled.
	Device & Media Controls	Script remote wipe tools in your deployment playbooks.
Technical Safeguards	Access Control	Implement RBAC via policy-as-code (e.g., Open Policy Agent).
	Unique User Identification	Centralize authentication with SAML/OIDC—no rolling-your-own users.
	Integrity Controls	Store SHA-256 hashes of PHI payloads; verify on read.
	Transmission Security	Enforce TLS 1.3+; disable legacy ciphers in your web server configs.
	Encryption at Rest	Use AES-256-GCM with HSM-backed key management (AWS KMS, Azure Key Vault).

3. Breach Notification Rule

What it mandates:

Timely Reporting: Notify HHS within 60 days of breach discovery; individual notices if harm is likely.
Content of Notices: Who, what, when, how you’re mitigating and preventing recurrence.

Developer Actions:

Automated Detection
- Configure SIEM rules to flag unusual PHI exports or access spikes (e.g., more than 100 records/hour).
Forensic Readiness
- Retain immutable, timestamped snapshots of audit logs and database records for at least 90 days.
Notification Pipeline
- Build a serverless function that, upon breach confirmation, auto-generates draft notices populated with data from your logs and flags them for legal review.

Putting It All Together

Compliance Matrix: Maintain a living spreadsheet or code-driven dashboard that links each feature/API to the exact HIPAA provision it satisfies.
Policy-as-Code Gates: Integrate Open Policy Agent or equivalent into CI/CD so that any pull request missing required controls is blocked.
Continuous Auditing: Schedule quarterly “compliance sprints” where your team reviews the matrix, runs automated scans, and closes any gaps.

Bottom Line

Knowing which HIPAA rules apply is half the battle. The other half is translating those rules into code, configuration, and process. Use the mappings above as your blueprint—and insist on audit-ready evidence at every step, from design to deployment.