HIPAA Compliant Datastores: What Developers Need to Know

Health Insurance Portability and Accountability Act (HIPAA) Security Rules dictate administrative, physical, and technical safeguards for PHI. For developers building SaaS or portal systems, the technical safeguards are the primary focus area: access controls, audit controls, integrity, and transmission security.

HIPAA Security Rules

Simply hosting your database on AWS or Google Cloud does not automatically make it compliant. While cloud providers guarantee hardware security and offer BAA agreements, developers must configure database schemas, credential access pathways, and audit trails correctly to prevent security incidents.

Encryption & Key Management

All PHI must be encrypted. Use AES-256 for data at rest, and keep decryption keys physically isolated from the datastore. Rotate keys periodically and implement automatic token revocation for application connections.

Audit Logging Database Schema

HIPAA compliance requires that every read, write, and deletion of patient record is permanently logged, timestamped, and traceable to a specific authenticated user. Here is an example of an audit log SQL schema designed for immutability:

CREATE TABLE patient_phi_audit_log (
    log_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    actor_user_id VARCHAR(100) NOT NULL,
    patient_id VARCHAR(100) NOT NULL,
    action_type VARCHAR(20) CHECK (action_type IN ('READ', 'CREATE', 'UPDATE', 'DELETE')),
    accessed_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
    changed_fields JSONB, -- Tracks exactly which fields were read/edited
    client_ip INET NOT NULL,
    CONSTRAINT audit_log_immutability CHECK (action_type IS NOT NULL)
);

-- Ensure this table is append-only and cannot be altered by normal DB users
REVOKE UPDATE, DELETE ON patient_phi_audit_log FROM application_role;

Developer Best Practices

• Always sign a BAA (Business Associate Agreement) with your database and cloud hosting providers.
• Enable column-level encryption for highly sensitive fields (e.g. social security numbers, mental health notes).
• Conduct quarterly external penetration testing and automated vulnerability scans of your APIs.
• Restrict direct database access; developers should never view production PHI directly.