I was looking at developing a HIPAA compliant app a few years ago I was going to use https://www.truevault.com/.
Ultimately I decided against doing anything that requires HIPAA compliance.
Ultimately I decided against doing anything that requires HIPAA compliance.
We think this comment from Hacker News sums up the technical debt required to roll your own HIPAA compliant infrastructure quite accurately. This was completely unsolicited and is not from a TrueVault customer.
"[Building our own HIPAA compliant infrastructure] took upwards of 1,000 person-hours to figure out HIPAA-compliance issues. This will continue to be an ongoing cost for us, because HIPAA is an ongoing law and it changes sometimes. It takes substantial auditing time and money." — jphAlthough Patio11 did it with AppointmentReminder it sounds like basically their HIPAA plans were ran the same as their regular plans as far as servers/security. From what I read he just offered the agreement, etc to the higher paying customers.
There are lots of interesting apps that could benefit patients and doctors. HIPAA is just scary to tackle as a small company, it's way easier just to choose another niche.
People always say selling to the medical field is difficult too.