CLIA, HIPAA and BAAs: what digital health teams actually need
A plain-language breakdown of the three regulatory concepts that decide whether your lab integration can ship, including what a BAA covers and what it does not.
Three acronyms decide whether your lab feature ships: CLIA, HIPAA and BAA. They are often conflated, and the confusion produces two expensive failure modes — shipping without the paperwork, or stalling for months on controls that were never required.
CLIA governs the laboratory, not your app
The Clinical Laboratory Improvement Amendments regulate laboratories that perform testing on human specimens for health assessment. The certificate belongs to the laboratory, is issued per specialty, and comes with proficiency testing, inspection and personnel requirements.
What this means for you: if you route specimens to a laboratory, confirm that laboratory holds a current CLIA certificate for the tests you are ordering. Ask for the certificate number and check that the specialties match. The number should appear on the report you show to users.
What it does not mean: CLIA does not certify your software. Building a dashboard does not require a CLIA certificate. It does mean you cannot claim your product “is CLIA certified” — the laboratory is.
HIPAA applies when PHI is involved — and PHI is broad
Protected health information is health information combined with an identifier, held by or for a covered entity. A lab result plus a name is PHI. A lab result plus a user ID that you can link back to a person is also PHI.
If you are a covered entity (provider, payer, clearinghouse) or a business associate of one, HIPAA’s Security Rule applies to you: access control, audit trails, encryption, incident response, workforce training.
If you are a consumer app that is not a covered entity, HIPAA may not apply to you directly — but your laboratory partner will still demand contractual safeguards, and state law or your own privacy policy may impose stricter obligations. “HIPAA does not apply to us” is a legal conclusion, not a design principle.
What a BAA actually covers
A Business Associate Agreement is a contract required by HIPAA when a business associate handles PHI on behalf of a covered entity. It commits the associate to:
- Use PHI only for the permitted purposes
- Apply appropriate safeguards
- Report breaches
- Ensure subcontractors agree to the same terms
- Return or destroy PHI at termination
A BAA is not a security certification. Signing one does not make a system compliant; it allocates responsibility. The technical controls still have to exist.
Practically, in a lab integration there are usually two BAAs in the chain: one between you and your customer (if you are a business associate), and one between you and the laboratory infrastructure provider.
The controls that actually matter
Auditors and security questionnaires converge on a short list. Get these right before you scale:
| Control | What it looks like in practice |
|---|---|
| Encryption in transit | TLS 1.2+, HSTS, no plaintext fallback |
| Encryption at rest | AES-256, per-object keys for documents |
| Access control | Role-based, least privilege, environment-scoped API keys |
| Audit logging | Append-only, records actor/action/resource/time |
| Breach response | Documented runbook, 72-hour notification path |
| Vendor management | Sub-processor list, DPAs, annual review |
Notice what is not on that list: blockchain, “military-grade” encryption claims, or a SOC 2 badge. A SOC 2 Type II report is useful evidence that controls operate over time — it is not a substitute for having them.
GDPR, if you have EU or UK users
GDPR adds a different axis: lawful basis, data subject rights, and transfer rules. For health data the practical requirements are a Data Processing Agreement with each processor, regional data residency where feasible, a published sub-processor list, and a workflow to answer access and erasure requests.
One tension worth planning for: GDPR erasure versus medical record retention. Laboratory records must be retained for years under the rules that apply to the performing laboratory. The resolution is to delete what is not legally required and document the retention basis for what remains.
A checklist you can act on this week
- Ask each laboratory for its CLIA certificate number and covered specialties.
- Confirm whether you are a covered entity or business associate — get this in writing from counsel.
- Execute a BAA before the first real order, not after.
- Enable encryption, role-based access and audit logging before your first PHI record exists.
- Publish a sub-processor list and keep it current.
None of this requires a compliance department. It requires deciding, once, that the paperwork ships with the feature instead of after it.