Building to the HIPAA Security Rule bar on a free-tier stack
Health data attracts a particular kind of vendor pitch: buy this platform and you become compliant. The HIPAA Security Rule does not work that way. It is a list of safeguards, most of them ordinary engineering, and the platform's role is narrow — it must be willing to sign a Business Associate Agreement, and it must be configured correctly. Everything else is yours.
Here is the whole list as it actually lands on a small engineering team, and what satisfies each item on infrastructure that costs nothing at rest.
1. A signed BAA, upstream and downstream
Google Cloud and Firebase are HIPAA-eligible and will sign a BAA covering the specific services on the eligible list — and only those. This is the step people skip and it is the one that is binary: without the agreement in place, every other control you build is irrelevant, because you are not permitted to process the data at all. Check the eligible-services list against your architecture before you write anything, because a single ineligible service in the path invalidates the arrangement.
Downstream matters too. If a third party can see the data, that third party needs an agreement of its own, which in practice means the answer to "can we add analytics to this screen" is usually no.
2. Access control, and the word "minimum necessary"
Unique identity per user, and each identity able to reach only the records their job requires. This is the same problem as tenant isolation and it has the same answer: put the decision in the database layer, keyed on a signed claim, so it holds even when the interface is wrong. A role that can see every record because it was easier to build is a finding waiting to be written up.
3. Audit controls
You must be able to say who touched what, and when. Not a debugging log — a deliberate, append-only record of access to protected records, retained. Note the tension with the next item: the audit trail records that a record was accessed, by whom, never a copy of its contents.
4. PHI never lands anywhere it was not meant to
This is the control that is most often broken by accident, and it is broken in logs. An error handler that serialises the request body, a crash reporter that captures state, an analytics event with a name in it — each one takes protected data and copies it somewhere with different access rules and a different retention policy. Screen it server-side and refuse it, rather than trusting every future caller to remember.
The same rule kills a popular feature idea: routing anything containing health information through an external model or translation API. If the vendor will not sign, the data does not go.
5. Encryption in transit and at rest
TLS everywhere, HSTS on, HTTP redirected rather than served. At rest, the platform handles it — Google Cloud encrypts by default — which is one of the few places you genuinely inherit a control rather than build it.
6. Integrity and authentication of the person
Records must be protected from improper alteration, which is where immutable server-owned fields and archive-instead-of-delete earn their keep. And authentication needs to be real: leaked-password detection, a password policy, and time-based one-time-password two-factor for any administrative role. Never SMS as the second factor — a SIM swap is not a theoretical attack, and the number is usually the account recovery channel as well.
7. A breach notification path that exists before you need it
Written down, with the timelines, before an incident rather than during one.
8. Retention, and a deletion path that deletes
Including uploads. A deletion feature that removes the database record and leaves the file in storage is worse than no deletion feature, because it reports success.
What this costs
Nothing, at the scale most products start at. Firestore Security Rules are free to evaluate. Custom claims are free. TLS and HSTS are free. An append-only audit collection costs one small write per access event, which is the only line item that grows, and it grows with staff activity rather than with traffic. The expensive part of HIPAA is not the infrastructure. It is deciding early that the interface will never be the thing standing between a stranger and a medical record, and then not making exceptions to that under delivery pressure.
Compliance is not a product you buy. It is a set of decisions you make before the first screen exists, and then keep.
Written by Liana Grigory, also written Liana Grigoryan — entrepreneur, technology founder and U.S. Army veteran in Los Angeles. More at Writing.