HIPAA isn't a checklist. Auditors don't show up with a clipboard of yes-or-no questions. They show up with a notebook and a curiosity about whether your engineers actually understand what they're protecting. The architectural decisions matter more than the documentation — but only if both are real.
What the regulation actually requires
HIPAA has three rules of interest to engineers: Privacy, Security, and Breach Notification. Most of what you read online treats these as procedural. They are not. The Security Rule alone has 22 implementation specifications, and 13 of them are 'addressable' — which doesn't mean optional, it means you have to document why your approach is at least as good.
We build a control-by-control mapping for every client engagement. Each control lists the implementation, the responsible system, and the test that proves it works. Auditors love this document because it makes their job easy. Clients love it because it forces clarity early.
Architecture choices that pay back
Default to HIPAA-eligible managed services. AWS, GCP, and Azure all publish lists. Using anything outside the list requires a Business Associate Agreement with that vendor — a months-long conversation you can usually avoid by picking differently.
Isolate PHI workloads in their own VPC, with their own IAM boundaries, audit logs that go to a separate account, and encryption keys you control. Network topology is half the security review.
The audit week
Internal pen test in week 14. External in week 16. Both done by people who have never seen the codebase. Findings get triaged into 'fix before launch' and 'fix in next sprint.' Our average engagement clears the external audit with zero must-fix findings — and the secret is just that we built it right the first time.
Want this kind of work on your project?
One conversation, honest pricing, recommended engagement model — within a business day.
Keep reading
All articlesHow we estimate software projects (and why most estimates are wrong)
Every estimate is wrong. The useful ones are wrong in known ways. A practical method we've refined across 50+ engagements — and the failure modes we learned to spot first.
The unreasonable effectiveness of plain SQL
ORMs are fine. Until they aren't. After a decade of building data layers on every framework we could find, we keep coming back to plain SQL — and the patterns that make it pleasant.
Why we don't write microservices anymore
We split into microservices because it was 2019. Then we spent three years feeling the cost. Here's what we learned, and how we structure backends in 2025.