I work for a small IT firm and we are creating a web application (MVP) for doctors (in the USA).
The patients will register with the application. We will only save their name, email, password (hashed) and "connect" with the doctor. We wont be saving any of their medical records or PHI records.
The doctor and the patients can then chat with each other using the application, no chat messages are saved by us, so if someone refreshes their browser the messages are gone.
So essentially they just use the application to chat with each other (where the chats are not saved).
Since we are not saving any PHI or medical records nor chats, does our database/system need to be HIPAA compliant?
Let's say our web application does need to be HIPAA compliant, does our web application server and our database need to be hosted on a single HIPAA compliant hosting service? Can we have our web app server be hosted on a non HIPAA hosting and our database to be hosted on a HIPAA compliant hosting (remote db)?
I am super confused on whether our use case needs to be HIPAA compliant and if yes how to manage the hosting.
Any help or suggestion will be very appreciated.