How to Build a HIPAA‑Compliant Flask App: A Practical Python Guide + Checklist

Building a HIPAA‑compliant Flask app means protecting ePHI end‑to‑end while keeping your engineering workflow practical. This guide shows you how to apply encryption, access control, auditability, and governance in Python—then verify your work with a concise checklist.

Quick Checklist

• Encrypt ePHI in transit (TLS) and at rest (AES‑256 or database TDE); manage keys securely to meet ePHI encryption standards.
• Implement Role‑Based Access Control implementation with least privilege and MFA; strictly separate admin and clinical roles.
• Generate tamper‑evident audit logs for every ePHI read/write/export and all admin actions; centralize and retain appropriately.
• Harden sessions with secure cookies, CSRF protection, and session timeout policies (idle and absolute).
• Apply data minimization: collect only necessary fields, de‑identify when possible, and purge data per schedule.
• Achieve Business Associate Agreement compliance with all vendors touching ePHI; define breach notification and responsibilities.
• Run a recurring vulnerability risk assessment; track remediation and maintain a HIPAA incident response plan.

Implement Data Encryption

Encryption protects ePHI across networks and storage. Align implementation choices with ePHI encryption standards, selecting algorithms and key management that are proven and operationally maintainable.

Encrypt data in transit (TLS)

• Terminate TLS with modern ciphers and certificates; redirect all HTTP to HTTPS.
• Set HSTS to prevent protocol downgrades; disable insecure protocols.

from flask import Flask, request, redirect, make_response

app = Flask(__name__)

@app.before_request
def enforce_https():
    if request.headers.get("X-Forwarded-Proto", request.scheme) != "https":
        return redirect(request.url.replace("http://", "https://", 1), code=301)

@app.after_request
def set_security_headers(resp):
    resp.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains; preload"
    resp.headers["X-Content-Type-Options"] = "nosniff"
    resp.headers["X-Frame-Options"] = "DENY"
    return resp

Encrypt data at rest (AES‑256 with authenticated encryption)

• Use AES‑GCM (256‑bit key) to encrypt sensitive columns before writing to the database.
• Store keys outside app code; rotate and revoke with a KMS or HSM; prefer FIPS 140‑2 validated crypto modules in production.

import os, base64, json
from cryptography.hazmat.primitives.ciphers.aead import AESGCM