Outsourcing healthcare software is common and can be done safely under HIPAA. This checklist covers what to put in place before an offshore team touches your code or your data.
US healthcare organizations and health-tech companies outsource software development all the time. HIPAA does not ban using vendors outside the United States. What it requires is that protected health information (PHI) is protected wherever it goes, and that vendors who handle it are bound by a Business Associate Agreement (BAA).
Use this checklist before you bring in an offshore development partner.
1. Decide whether the vendor needs PHI at all
The safest PHI is the PHI a vendor never sees. Most development and testing can be done with synthetic or de-identified data. Only give production access where a task truly requires it, such as investigating a live data issue.
2. Sign a Business Associate Agreement
If the vendor will create, receive, maintain or transmit PHI on your behalf, sign a BAA before work starts. It should cover permitted uses, safeguards, breach notification, subcontractors and return or destruction of data at the end of the contract.
3. Control access
- Named accounts for every person, no shared logins.
- Access through your SSO and VPN with multi-factor authentication.
- Least privilege: developers get only the environments and data they need.
- A leaver process: access removed the same day someone leaves the project.
4. Encrypt and log
- Encryption in transit (TLS) and at rest for databases, backups and file storage.
- Audit logs for access to PHI, reviewed regularly.
- No PHI in tickets, chat messages, emails, screenshots or log files.
5. Keep code and environments under your control
- Source code in your repositories, not the vendor's.
- Development, test and production separated, with PHI only in production.
- Code review and automated security scanning on every pull request.
6. Build the safeguards into the product
HIPAA's Security Rule expects administrative, physical and technical safeguards. For software, that usually means role-based access, automatic logoff, audit trails, integrity controls, secure authentication and encrypted data flows, including HL7 and FHIR interfaces.
7. Ask these vendor questions
- Will you sign our BAA, and who are your subcontractors?
- How do you train staff on privacy and security?
- What devices do your developers use, and are they encrypted and managed?
- How quickly will you notify us of a security incident?
- Can you work entirely inside our environment?
8. Remember who owns compliance
There is no official "HIPAA certification" for software or vendors. Your organization remains responsible for its compliance program, including risk analysis. A good vendor makes that easier; it can't do it for you.
HHS proposed updates to the HIPAA Security Rule in January 2025. Check the current status with your compliance team, because the final rule may add specific requirements such as mandatory encryption and MFA.
How Level 8 works with healthcare clients
We sign BAAs, work inside your systems, develop with de-identified data and build HIPAA safeguards into the product from the start. See our healthcare software services.
This article is general information, not legal advice.