I work for a small IT firm and we are creating a web application (MVP) for doctors (in the USA).

The patients will register with the application. We will only save their name, email, password (hashed) and "connect" with the doctor. We wont be saving any of their medical records or PHI records.

The doctor and the patients can then chat with each other using the application, no chat messages are saved by us, so if someone refreshes their browser the messages are gone.

So essentially they just use the application to chat with each other (where the chats are not saved).

My questions:

  1. Since we are not saving any PHI or medical records nor chats, does our database/system need to be HIPAA compliant?

  2. Let's say our web application does need to be HIPAA compliant, does our web application server and our database need to be hosted on a single HIPAA compliant hosting service? Can we have our web app server be hosted on a non HIPAA hosting and our database to be hosted on a HIPAA compliant hosting (remote db)?

I am super confused on whether our use case needs to be HIPAA compliant and if yes how to manage the hosting.

Any help or suggestion will be very appreciated.

bumped to the homepage by Community yesterday

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

  • I am not sure HIPAA is in the scope of Security.SE, imo this is a question for a lawyer. – CaffeineAddiction May 17 at 15:27

I found a very helpful link a while back that was able to answer questions in regards to HIPAA compliant server. Let me know if this helps.


  • Thanks for the link. Its definitely helpful, but I am still not sure if my system needs to be HIPAA compliant since its just a basic chat app (where we are not even saving any chats). I dont want to invest in HIPAA compliant hosting if my requirements dont need me to. – codeinprogress May 17 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.