Does Your Healthtech MVP Need HIPAA? US, UK and UAE Rules Before You Build

The short answer by country

Where your users are matters more than what your app does. The list covers the three markets founders ask us about most. Use it as a first filter. It is not legal advice. Before you launch, ask a healthcare lawyer in your market to confirm it.

• Telehealth app a clinic uses to see patients. Market: US. HIPAA: yes. Main rule to check: HIPAA, as a covered entity or business associate.
• Intake or records tool sold to clinics. Market: US. HIPAA: yes, you are a business associate. Main rule to check: HIPAA, with a business associate agreement for each client.
• Fitness, diet or symptom tracker sold to consumers. Market: US. HIPAA: usually no. Main rule to check: FTC Health Breach Notification Rule.
• Any app processing UK patients' health data. Market: UK. HIPAA: no, HIPAA is US law. Main rule to check: UK GDPR, where health data is special category data.
• Any app for health services delivered in the UAE. Market: UAE. HIPAA: no. Main rule to check: Federal Law No. 2 of 2019 on ICT in health fields.

United States: when HIPAA applies

HIPAA applies to covered entities, which are healthcare providers, health plans and healthcare clearinghouses. It also applies to their business associates. These are vendors that handle protected health information (PHI) for a covered entity under a written contract called a business associate agreement (BAA). The FTC says many companies that collect health data, such as fitness trackers, diet apps and connected blood pressure cuffs, "aren't covered by HIPAA". It also says its July 2024 amendments make clear that makers of health apps and connected devices must comply with the Health Breach Notification Rule. That rule sets out what you have to do if health data leaks. In practice:

• You sell to clinics, hospitals or insurers and your app handles their patient data. HIPAA applies, and you sign a BAA with each client.
• Consumers download your app and enter their own health data. HIPAA usually doesn't apply. Other rules still do.
• Example. A founder builds a sleep tracker and sells it on the App Store. That is not a HIPAA app. Then a sleep clinic licenses the same app to monitor its patients. That version now handles PHI for a covered entity, so HIPAA applies.

United Kingdom: UK GDPR, not HIPAA

HIPAA doesn't cover UK users. Their health data falls under UK GDPR, which defines it as personal data about a person's physical or mental health. The ICO treats it as special category data. To process it, you need a stronger legal basis and extra safeguards. The ICO's guidance also counts appointment details, and fitness tracker data that reveals a health condition. If you plan to sell to the NHS, ask your lawyer which extra standards buyers will expect. Do this before you scope the build, because buyers can ask for them during procurement.

UAE: where the data is stored matters

For health services provided in the UAE, Federal Law No. 2 of 2019 on the use of ICT in health fields applies. Article 13 says health data related to services provided in the UAE may not be stored, processed, generated or transferred outside the country without approval from the health authority. The UAE government portal lists this law among the rules for digital health. This affects your build directly, because you have to choose your hosting region on day one. If you start on servers outside the UAE by default, you may have to migrate later. For founders building in Dubai and other cities, see our local guides for app founders.

What the core build looks like

Most of a health app is a normal app: sign up, onboarding, the main screens, store release. Our mobile app build is fixed price, from $3,460, and we deliver an MVP in about 20 days. The core build includes:

• iOS and Android from one Expo project
• Auth, onboarding and the core loop of your app
• TestFlight and Play submission support
• 100% of the source code
• 2 weeks of fixes after delivery

Two things that matter even more for health apps

What goes on top for PHI, such as database access rules or an audit log, depends on your market, your buyers and your vendors. We confirm on the call what a health project adds to the core build. Book a call and bring your feature list.

• Access control in the database. Ask any developer to enforce roles in the database with row level security, not only in the interface. That way patients, clinicians and admins each see only their own records.
• Code ownership. You keep the repository, so you can show it to a lawyer, an auditor or a future CTO.

Checklist: infrastructure and data

Whoever builds your app, get a written answer to each of these questions before you sign. Vague answers here are how health projects end up over budget.

• Which hosting provider will hold PHI, and does it sign a BAA? Check the plan before you commit, not after.
• Whose name is the hosting account in? It should be yours, so you control the infrastructure and the data.
• How is access enforced? Ask whether roles are enforced in the database with row level security or only in the interface.
• What is encrypted? Ask about data in transit (HTTPS everywhere) and data at rest (database and file storage).
• Is there an audit log? Ask who viewed or changed which record, and when. Ask if it is in scope and how it is built.
• What are the session rules? Ask about automatic logout after inactivity and biometric unlock on mobile.
• What do push notifications say? They should say "You have a new message" and never include clinical detail. Anyone near the phone can read a lock screen.

Checklist: third party tools

Every tool that touches PHI must either sign a BAA or never see PHI. Ask how each one is handled. Replacing one of these after launch means rewriting part of the app. Choosing the right ones before the build costs less.

• Analytics: is it kept off screens that show health data, or does the tool sign a BAA?
• Email and SMS: do notifications leave out clinical content, or does the provider sign a BAA?
• Video calls: does the telehealth video provider sign a BAA?
• Payments: are clinical details kept out of payment descriptions and metadata? Ask your lawyer how payment data is treated in your setup.
• AI features: if patient data goes to an AI model, the AI provider is also a vendor handling PHI.

Checklist: scope and paperwork

Settle these three points in writing before the build starts.

• What exactly is in the quote, and what is not? Get it in writing, item by item.
• Who writes the compliance documents? Data flow diagrams, vendor lists and policies are often left unassigned.
• Who signs which BAA? Usually the company that is the covered entity or business associate signs with its vendors. Your developer may need to sign one with you if they can access PHI. Your lawyer confirms who signs in your setup.

What usually sits outside an MVP build

Plan for these separately, whoever builds your app. To see what other features cost, read our feature cost guides.

• Security certifications that larger health systems may ask for later. Outside auditors assess your company for these.
• EHR integrations. They depend on access approvals from the EHR vendor and the clinic, so the timing isn't in your hands.
• Medical device rules. If your app diagnoses or treats, talk to a regulatory specialist before you build.
• External penetration testing. An independent firm runs it.
• Risk assessment and policies. These are your company's responsibility.

How to keep a healthtech MVP lean

Five steps keep compliance work in proportion to what you are testing.

• 1. Answer the HIPAA question first. Use the list above, then confirm with a lawyer.
• 2. Collect less. If you don't need a date of birth or a diagnosis to prove the idea, don't store them.
• 3. Start with a pilot that has no PHI. A wellness version or a demo with test data can show demand before you take on compliance.
• 4. Choose hosting and vendors on day one. That means BAA vendors in the US and the hosting region in the UAE.
• 5. Keep identity separate from clinical data. Then fewer parts of the app need the strictest controls.

Did you build a health prototype with an AI builder?

These tools rarely set up row level security or covered vendors by default. Read our guides on taking an AI prototype to production before you put real patient data in it. Want a clear read on HIPAA and on what your healthtech MVP needs? Book a call.

Does every health app need to be HIPAA compliant?

No. HIPAA applies to US covered entities and their business associates. A consumer app where users log their own data usually falls outside HIPAA. The FTC Health Breach Notification Rule can still apply.

Does HIPAA apply to an app for UK or UAE users?

No, HIPAA is US law. In the UK, health data is special category data under UK GDPR. In the UAE, Federal Law No. 2 of 2019 applies and limits storing health data outside the country.

What should I prepare before asking for a quote on a HIPAA app?

A list of the data you collect and which of it is PHI. The user roles. The third party tools you plan to use. Your target market. With these, a developer can tell you clearly what is in scope and what isn't.

Who signs the BAA with the hosting provider?

Usually the company that is the covered entity or business associate. Your lawyer confirms who signs in your setup. Keep the hosting account in your name so you control the infrastructure and the data.

Does a HIPAA MVP take longer to build?

It can. Access control, audit logs and covered vendors all add work. Work that needs outside approvals, like EHR access, depends on other parties' timelines. Ask any developer to confirm the timeline in writing once the scope is clear.