HIPAA Compliance Checklist for Choosing a Wound Imaging App Vendor

When does a wound imaging app vendor qualify as a business associate?

A vendor’s role—not its marketing language—determines whether it is a business associate. If the vendor creates, receives, maintains, or transmits protected health information (PHI) on behalf of your organization, it will generally be a business associate. For example, a vendor may qualify if it hosts patient wound images, provides access to those images for your care team, or can access them while troubleshooting the app. HHS explains that a software vendor with access to a covered entity’s PHI to provide its service can be a business associate. HHS guidance on software vendors and business associates

If the vendor is a business associate, your organization generally needs a Business associate agreement (BAA) before allowing it to handle PHI. The agreement should define permitted uses and disclosures, require safeguards, address security incidents and breaches, and set expectations for returning or destroying data at the end of the relationship. HHS sample business associate contract provisions

There are exceptions based on the relationship and service. For instance, an app that an individual independently selects to receive information at their direction does not automatically become a business associate merely because it receives the information. Ask the vendor to describe who provides the app, who controls the workflow, what information the vendor handles, and whether vendor staff or service providers can access it. HHS guidance on apps designated by individuals

What should a HIPAA risk analysis and safeguards review cover?

Evaluate the app as part of your organization’s broader HIPAA Security Rule risk analysis—not as a standalone “HIPAA compliant” badge. Consider how ePHI is created, received, maintained, and transmitted across the app, mobile devices, web dashboards, integrations, vendor support tools, and cloud services. The risk analysis should assess threats and vulnerabilities affecting the confidentiality, integrity, and availability of that information. HHS guidance on HIPAA risk analysis

Ask the vendor for documentation that helps you assess its safeguards and the risks that remain, such as a security overview, access and incident-response procedures, independent assessment summaries where available, and details about hosting and integrations. Then document your organization’s own assessment, decisions, and risk-management steps. A vendor’s materials can inform your review, but they do not replace your organization’s risk analysis. HHS summary of the HIPAA Security Rule

• Identify the data and systems involved, including wound photographs, measurements, patient identifiers, and connected records.
• Review administrative, physical, and technical safeguards, including user access, device security, backups, recovery, and security incident procedures.
• Assess risks at each point where information is captured, stored, viewed, shared, exported, or deleted.
• Record gaps, mitigation plans, responsible parties, and how the review will be revisited when the environment changes.

How are wound photos, measurements, and metadata stored and retained?

Ask the vendor to map the information lifecycle from image capture through deletion. Find out whether images remain in the phone’s camera roll, app cache, temporary files, or local storage, and whether copies are created in cloud storage, backups, exports, or support systems. Also ask how measurements, annotations, timestamps, device details, and any location metadata are associated with each image.

Confirm how the app links images to a patient record and prevents accidental mismatches, duplicate uploads, or unauthorized exports. Ask whether the vendor uses patient information for analytics, product development, or other secondary purposes, and how those uses are limited by contract and configured in the product.

Set retention and deletion rules that fit your clinical record policies and applicable state requirements. HIPAA does not set a general medical-record retention period; HHS notes that state law generally governs how long medical records must be retained. HHS guidance on medical record retention Ask how long the vendor keeps production data, backups, and archived copies; how deletion requests are handled; and what happens to information when you end the contract.

Which access controls, authentication methods, and audit logs should vendors provide?

Look for individual user accounts, unique user identification, and configurable permissions so staff can access only the information and functions their work requires. Role-based access control can help organize these permissions, but it is a design approach rather than a substitute for evaluating whether the organization’s actual access rules are appropriate. The HIPAA Security Rule requires technical policies and procedures that allow access only to authorized persons or software programs and requires procedures to verify a person’s identity. HHS summary of Security Rule access and authentication standards

Ask whether the app supports multi-factor authentication, secure account recovery, prompt removal of access when staff leave or change roles, and controls for lost or shared devices. Review how the vendor protects administrator and support accounts, which may have broad access to patient information.

Check the audit controls: whether the system records relevant activity, whether logs can be exported or retained for your review, and whether they identify the user, time, patient record, and action. Useful events may include viewing, changing, exporting, or deleting a wound image, as well as administrative changes and failed access attempts. HIPAA requires audit controls and regular review of information-system activity records, such as audit logs and access reports. HHS HIPAA audit protocol

How should encryption protect stored and transmitted patient information?

Ask how the vendor protects information on mobile devices, in app storage, in cloud systems, in backups, and while it moves between the app, the vendor’s services, and your organization’s systems. Confirm that the vendor’s description covers both encryption at rest and in transit, and ask how encryption keys are managed and access to them is restricted.

Encryption is an important safeguard to assess, but HIPAA does not make encryption a universally required implementation specification in every situation. The Security Rule treats encryption as addressable: the regulated organization must determine whether it is reasonable and appropriate based on its circumstances and risk analysis. If it is not, the organization must document its decision and implement an appropriate alternative when needed to meet the relevant standard. “Addressable” does not mean an organization can ignore the issue without evaluation. HHS guidance on Security Rule encryption

Ask the vendor what protections apply to images stored temporarily on a device, and what happens if that device is lost or compromised. Also clarify who can access encryption keys and whether backups and support copies receive the same protections as primary data.

What should you verify about subcontractors, incident response, and data deletion?

Request a list of subcontractors and other service providers that create, receive, maintain, or transmit your information, including cloud and support providers. Ask what information each can handle and how the vendor ensures that relevant subcontractors are bound to required protections. HIPAA requires business associates to obtain appropriate written assurances from subcontractors that handle ePHI on their behalf. HHS business associate guidance

Review the vendor’s breach notification procedures and incident-response process. Ask how the vendor will notify you, what details it will provide, how quickly it will escalate suspected incidents, and how it will support investigation and response. HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; your BAA can specify a shorter contractual reporting timeline. HHS Breach Notification Rule guidance

Before signing, agree on how you can retrieve your data and how the vendor will return or destroy PHI when the contract ends, where feasible. Ask about deletion from active systems, backups, and subcontractor environments; any limits on immediate deletion; and what protections remain if information cannot feasibly be returned or destroyed. HHS’s sample contract provisions address subcontractors and the return or destruction of PHI at termination. HHS sample business associate contract provisions

What privacy controls apply when HIPAA does not cover an app?

HIPAA does not cover every app that collects health information. Whether HIPAA applies depends on whether the organization is a covered entity or business associate and on the app’s relationship to that organization. A direct-to-consumer app that is not acting for a covered entity may fall outside HIPAA, even though the information it collects is sensitive. HHS overview of covered entities and business associates

That does not necessarily mean the information has no protection. Depending on the app and the information flows, the Federal Trade Commission’s Health Breach Notification Rule may apply to certain health apps and related service providers not covered by HIPAA. The FTC explains that the Rule covers, among others, certain vendors of personal health records and their service providers; it does not apply to organizations covered by HIPAA. FTC guidance on the Health Breach Notification Rule

Ask how the app uses, shares, and retains data, whether users can control those practices, and what happens after a suspected breach. Also consider other applicable federal and state privacy and breach-notification laws. Do not assume that a privacy notice or a “HIPAA compliant” claim alone answers these questions.

Before adopting a wound imaging app, confirm the vendor’s business associate status, review the app’s risks and safeguards, understand the full data lifecycle, and document your organization’s decisions. A signed BAA is important when required, but it does not replace careful review of access, audit controls, encryption, subcontractors, incident response, and data deletion.

FAQs.

Does a wound imaging app vendor need a business associate agreement?

Generally, yes, if the vendor creates, receives, maintains, or transmits PHI on behalf of your covered organization. The answer depends on the actual relationship and service: an app selected by an individual to receive information at that individual’s direction does not automatically create a business associate relationship. HHS guidance on apps and business associate agreements

What security safeguards should a healthcare organization review before adopting a wound imaging app?

Review the organization’s risk analysis for the app and its connected systems, then assess safeguards for authorized access, authentication, audit controls, device and data security, backups, incident response, and subcontractors. HIPAA requires regulated organizations to conduct a risk analysis and implement reasonable and appropriate security measures; the specific measures depend on the organization’s circumstances and risks. HHS guidance on HIPAA risk analysis

How should wound photographs and associated metadata be protected?

Determine where images and metadata are stored, which users and service providers can access them, how they are protected during transmission and storage, and how long copies remain in devices, backups, and other systems. Use access controls and audit controls appropriate to your risk analysis, and establish retention and deletion terms that align with applicable recordkeeping requirements.

Does HIPAA apply to wound information entered into every health app?

No. HIPAA applies based on the roles of the organizations handling the information and their relationship to a covered entity or business associate; it does not automatically cover every consumer health app. Some apps outside HIPAA may be subject to the FTC’s Health Breach Notification Rule or other applicable laws. FTC guidance on the Health Breach Notification Rule