HIPAA Compliance Implementation for Healthcare SaaS

therapyBOSS is a healthcare SaaS platform for therapy providers and organizations managing therapy services. The platform serves solo practitioners, clinics, therapy staffing companies, and larger healthcare organizations, with workflows designed for physical, occupational, and speech therapists, social workers, office staff, and referral sources.

Since therapyBOSS processes ePHI, HIPAA compliance was a core architectural requirement. The main challenges of managing it were:

Exposure of ePHI During Storage and Transmission

The healthcare SaaS collected, stored, and transmitted sensitive patient information through its web and mobile applications. ePHI had to remain protected both at rest and while moving through the system, including application pages that handled patient information, login credentials, and authorization data.

Unauthorized Access to Patient Information

The client’s application had to ensure that patient information was accessible only to users who needed it for their work. This required both controlling access to ePHI and verifying that users requesting sensitive information had the necessary privileges.

Limited Traceability and Data Integrity

Activities involving patient documentation needed to be attributable and auditable. TherapyBOSS therefore had to provide visibility into access and changes involving ePHI and maintain traceability of patient documentation.

Loss or Unavailability of ePHI

Infrastructure failures, outages, or disasters could make patient data unavailable or lead to its loss. The app therefore needed a way to keep ePHI recoverable even if one physical location failed, with backup copies stored in separate secure environments and accessible to authorized users.

The work focused on protecting ePHI from exposure, restricting access to patient information, maintaining traceability of sensitive records, and keeping healthcare data recoverable during failures.

ePHI Encryption and Transmission Security

We have encrypted all collected and stored ePHI and made it accessible exclusively to authorized individuals with the appropriate security keys. For ePHI stored locally by the offline application, the team used SQLCipher encryption over the SQLite database. The encryption key was stored securely in the iOS Keychain and in EncryptedSharedPreferences using AES-256 encryption on Android. This prevents information in the local database from being accessed outside the application.

For the web application, Romexsoft’s specialists obtained an SSL certificate and encrypted every page that contained or collected PHI, transmitted authorization cookies, or handled user login. Alternative insecure versions of these pages were removed so users could not access the same information through an unprotected connection.

Access Control, Authentication, and Session Protection

To restrict access to ePHI, the specialists implemented authenticated, role-based access control. After authentication, each user was assigned a role, such as therapist, patient, or office user, which defined the level of access available within the application. The backend then performed an authorization check on every request for patient data, verifying the user’s permissions and privileges before returning the requested information.

For person or entity authentication, TherapyBOSS relies on the next verification methods:

• Login credentials. Users can sign in with their login and password on both the web and mobile applications.
• Biometric authentication. Mobile users can enable fingerprint recognition or Face ID for login.
• Additional device verification. When signing in from a device for the first time, users are required to answer security questions or enter a security code sent via SMS.
• Failed login protection. User accounts are blocked after five unsuccessful login attempts with an incorrect password.

Automatic logoff periods were configured according to the requirements of the web and mobile applications. The web application logged users out after one hour of inactivity, while the mobile application used a 24-hour timeout. Mobile screens containing private data, such as password and personal-information screens, closed automatically after one minute without user activity.

Audit Controls and Patient Documentation Traceability

Romexsoft’s specialists implemented audit controls to record security-relevant user activity and maintain traceability of patient documentation. The audit mechanisms included:

• Login activity. Each login attempt is recorded together with the user ID, date and time, IP address, and browser or device type.
• Mobile synchronization. Every attempt to synchronize data to or from the mobile application is logged.
• Patient documentation traceability. As a user edits clinical documentation, a new version is created instead of overwriting the existing record, which allows the change history to be preserved.
• Record modification tracking. Modifiable records stored “last updated on” and “last updated by” information to identify when a record was changed and by whom.
• Deleted record logging. Information about deleted records is retained in the system logs.

ePHI Backup and Disaster Recovery

As TherapyBOSS’s architecture began moving toward AWS, our specialists introduced separate backup mechanisms for different types of application data and established an AWS-based disaster recovery environment.

• Uploaded files. Files uploaded to the application are backed up to the cloud immediately. In the AWS environment, copies are stored in a separate AWS Region to improve resilience.
• Database backups. A real-time database read replica was maintained on AWS, while database snapshots are created daily, stored in Amazon S3, and retained for 30 days.
• Backup encryption. All backups are encrypted using AWS KMS Keys.

These measures provided additional redundancy for ePHI and supported the platform’s backup and disaster recovery procedures.

The implemented safeguards gave TherapyBOSS a stronger technical foundation for handling ePHI in line with HIPAA requirements. The main outcomes included:

• Protected ePHI across application workflows. Sensitive patient information was protected at rest, during offline use, and in transmission, reducing its exposure across the platform.
• Controlled access to patient records. TherapyBOSS could limit ePHI access according to user authorization and the patient information required for a clinician’s work, with additional authentication and session safeguards against unauthorized access.
• Traceable clinical documentation. The platform gained audit controls for activities involving ePHI and application-level traceability for individual patients’ documentation.
• Recoverable ePHI during failures. Healthcare data could be recovered from secured backup environments if one location failed, while the evolving AWS architecture added disaster recovery capabilities.