hipaa-rails

HIPAA for Rails

HIPAA is a US law governing how Protected Health Information (PHI) is handled. The technical safeguards (Security Rule) translate to engineering controls in your Rails app. This skill encodes those controls. It does not replace legal counsel — get a healthcare-attorney-reviewed compliance program before going live with PHI.

The opinion

Don't build a HIPAA app casually. The compliance burden is real (BAAs with every vendor, audit logs that survive deletion, 6-year retention, breach notification within 60 days). If you can avoid storing PHI by integrating with a covered provider (e.g., Health Gorilla, Akute, Redox, Particle Health), do that instead. If you must store PHI: encrypt at rest with Active Record Encryption, audit-log every PHI access, restrict by role, BAA with AWS / GCP / your DB host, and get a compliance vendor (Drata / Vanta / Compaas) before launch.

What's PHI?

The 18 HIPAA identifiers, when combined with health information:

1. Name
2. Address (more specific than state)
3. Dates (birth, admission, discharge — except year)
4. Phone
5. Fax
6. Email
7. SSN
8. Medical record number
9. Health plan beneficiary number
10. Account number
11. Certificate / license number
12. Vehicle ID / VIN
13. Device ID / serial
14. URL
15. IP address
16. Biometric ID (fingerprint, voiceprint)
17. Full-face photo
18. Any other unique identifying number / characteristic / code

Plus: health information itself (diagnoses, treatment, payment for treatment).

PHI in your DB → HIPAA applies.

Pattern 1: Encrypt PHI at rest

# Rails 7+ Active Record Encryption
class Patient < ApplicationRecord
  encrypts :ssn, deterministic: false  # non-deterministic; can't query directly
  encrypts :date_of_birth, deterministic: false
  encrypts :medical_record_number, deterministic: true  # need to look up — deterministic
  encrypts :diagnosis_notes  # default non-deterministic; encrypted blob
end

Setup:

bin/rails db:encryption:init
# Adds active_record_encryption.* to credentials.