Why a HIPAA-Compliant App Is Not Enough for Your Practice

A secure messaging or records platform does not make a medical practice HIPAA compliant by itself. The current framework still requires the practice to understand where electronic protected health information travels, document its risks, control access, manage vendors and maintain procedures that staff actually follow.

There is also a concrete compliance change to address now: since February 16, 2026, covered entities must include specified information about substance use disorder records in their Notice of Privacy Practices. That update belongs alongside the less visible work—mapping data, testing safeguards and assigning responsibility—that prevents routine mistakes from becoming reportable incidents.

Confirm that HIPAA applies to each part of the operation

Start by identifying the legal role of the practice and every organization handling information for it. HIPAA covers health plans, health care clearinghouses and health care providers that conduct specified standard electronic transactions; an ordinary consumer app or unrelated company does not automatically become subject to HIPAA merely because health information passes through it.

A vendor that creates, receives, maintains or transmits protected health information on behalf of a covered practice may be a business associate. The HHS explanation of covered entities and business associates says the practice must have a written contract or other qualifying arrangement defining the vendor’s work and requiring protection of the information; business associates are also directly liable for certain HIPAA duties.

Apply that review to cloud storage, billing, transcription, appointment systems, telehealth, IT support and any analytics or communications service that can encounter patient information. A vendor’s security page or general claim of compliance is not a substitute for determining its role, executing the necessary agreement and configuring the service for the practice’s actual workflow.

Build the risk analysis around real data flows

The most useful starting document is an inventory showing where electronic protected health information is created, received, stored and transmitted. Include electronic health records, email, patient portals, mobile devices, backups, scanners, shared drives, remote-access tools and vendor systems. Record who can reach each system, how access is authenticated and where information is copied or exported.

Current HHS risk-analysis guidance treats this assessment as foundational, requires its scope to cover all electronic protected health information and says the process must document threats, vulnerabilities, existing safeguards, likelihood, impact and corrective actions. It does not prescribe one universal method or a fixed review interval; the analysis should be revisited when technology, operations, ownership, key personnel or known threats change.

Turn the inventory into an action register rather than filing it as a one-time questionnaire. For each material risk, name the affected system, the responsible person, the chosen control, the completion date and the evidence that the control works. A migration to a new records platform, deployment of a patient chatbot or decision to let staff work remotely should trigger review before patient data enters the new workflow.

Convert identified risks into enforceable controls

Controls should follow the risks the practice has documented. Common priorities include individual user accounts, prompt removal of access when roles change, secure remote access, device encryption where appropriate, protected backups, audit review and restrictions on downloading records to unmanaged devices. “Addressable” Security Rule specifications should not be treated as optional: when a measure is not reasonable and appropriate, the practice must document that conclusion and use an equivalent measure when reasonable and appropriate.

Communication policies need the same workflow-level precision. Instead of declaring that every text message is forbidden or that one branded platform makes every message safe, define what information may be sent, through which approved channel, to which recipient and after what identity check. Include procedures for wrong numbers, shared family phones, copied email recipients, message previews on locked screens and photographs that capture charts or patients in the background.

Apply the minimum-necessary principle where it is relevant. Scheduling staff generally do not need the same record access as clinicians, and an IT contractor may need to maintain a system without routinely viewing its clinical contents. Role-based access reduces accidental exposure and makes audit logs more meaningful when the practice investigates unusual activity.

Make workforce rules observable

Annual training alone cannot demonstrate that day-to-day behavior is controlled. Train staff when they join, when their duties change and when the practice introduces a new system or procedure. Use short, role-specific exercises covering misdirected messages, verbal discussions, printed records, screen visibility, patient identity checks and escalation of suspected incidents.

Pair training with evidence: signed policy acknowledgements, access approvals, termination checklists, device inventories and records of corrective action. Managers should periodically verify that former workers have lost access, shared credentials are not being used, unattended workstations lock and paper containing protected information reaches the approved disposal process.

Social media deserves a simple boundary. Workforce members should not post patient images, appointment details, clinical documents or stories that could identify an individual unless the practice has established a valid legal basis and completed its approved authorization process. Removing a name does not necessarily make a photograph, rare diagnosis or detailed narrative non-identifiable.

Update the patient notice for the 2026 requirement

Notice maintenance is now a current operational task, not an old form to leave untouched. The HHS model-notice page updated in February 2026 says covered entities must include information about substance use disorder patient records in their Notice of Privacy Practices as of February 16, 2026. Federally assisted substance use disorder programs must provide a corresponding Part 2 patient notice, and programs that are also HIPAA covered entities may use a combined notice meeting both sets of requirements.

Compare the practice’s notice with its real operations and revise references to uses, disclosures, patient rights and contact information where necessary. Make the current version available on request and post it prominently on any website that provides information about services or benefits. Staff who answer privacy questions should know which version controls and where patients can obtain it.

Prepare for mistakes before one occurs

Give workers a fast, blame-aware route for reporting a lost device, an email sent to the wrong person, suspicious account activity or an improper disclosure. The first response should preserve evidence, contain further exposure and alert the designated privacy or security lead. Staff should not independently delete logs, negotiate with a recipient or decide that an incident is too small to document.

The practice then needs a consistent process to determine what happened, what information was involved, who received it, whether the risk was mitigated and whether notification duties are triggered. Keep the assessment and decision, even when the conclusion is that notification is not required. After containment, feed the cause back into the risk register, training and technical controls.

The practical test is evidence, not labels. A practice should be able to show its data inventory, current risk analysis, mitigation decisions, business associate arrangements, access records, training evidence, patient notice and incident documentation. Software can support those controls, but it cannot replace the practice’s responsibility for designing and operating them.

A HIPAA-Compliant App Is Not Enough: What Your Practice Must Fix