Hire HIPAA compliant software developers in 2026: vetting, PHI access

TL;DR

To hire HIPAA compliant software developers in 2026, decide who controls the engineers and what PHI they can reach before you screen anyone. HHS recognizes no private HIPAA certification, so you vet evidence, not badges.

• Staff augmentation: engineers under your direct control can count as your HIPAA workforce, trained and sanctioned under your policies. Whether the staffing firm also needs a BAA depends on whether it handles PHI itself.
• Dedicated team: the vendor directs the people, so it is your business associate and needs a BAA plus its own Security Rule program.
• Offshore teams are allowed: HIPAA has no requirements specific to PHI held outside the US, but your risk analysis has to cover the location.
• Business associates accounted for 35.8% of the 710 large healthcare breaches in 2025, per the HIPAA Journal.

No developer is HIPAA certified

HHS says it "does not endorse or otherwise recognize private organizations' 'certifications'" for the Security Rule. A resume that says "HIPAA certified" tells you about a course, not about the systems the person has built.

The risk sits with vendors. The HIPAA Journal counted 710 large healthcare data breaches in 2025, exposing the health information of at least 61,556,256 people. Business associates reported 128 of them, and 35.8% of the year's breaches occurred at business associates. Every engineer you bring in from outside sits somewhere in that chain.

The Security Rule update now lands in July 2027

HHS proposed its Security Rule overhaul on December 27, 2024. The fact sheet lists three changes that touch hiring directly:

• Business associates would verify, at least every 12 months, that their technical safeguards are deployed, through a written analysis by a subject matter expert and a written certification.
• Certain regulated entities would be notified within 24 hours when a workforce member's access to ePHI is changed or terminated.
• Multifactor authentication and encryption of ePHI at rest and in transit would be required, with limited exceptions.

The HIPAA Journal reported in July 2026 that final action now shows July 2027. Any vendor contract you sign this year will still be running when it arrives, so write those three duties into it now.

How we built this guide

The definitions come from the HIPAA rules and HHS guidance, read November 5, 2026. Breach figures come from the HIPAA Journal. We also read the guides that rank for this question. SpeedMVPs compares freelancers, agencies and studios with its own rate estimates and 4 FAQs. Supersourcing walks through scenario interview probes and a staged onboarding, with 7 FAQs. Neither separates the HIPAA status of an augmented engineer from that of a vendor team, which is the decision that sets everything else.

Mercury Development sells both staff augmentation and dedicated teams, so read the recommendations as a vendor's view. This is operational guidance, not legal advice. Ask counsel to confirm the HIPAA role for your contracts.

Staffing models at a glance

Our engagement models guide covers how each one is priced.

Staff augmentation: engineers under your control

HIPAA defines workforce as employees, volunteers, trainees and other persons whose conduct, in the performance of work for a covered entity or business associate, "is under the direct control" of that entity, "whether or not they are paid" by it. An augmented engineer who works in your repositories, under your lead, on your accounts, usually fits.

That shifts the work to you. Per the HHS Security Rule summary, you must make sure workforce members who work with ePHI have appropriate authorization, supervision and access, train them on your policies, and apply sanctions when they break them. Give each augmented engineer your onboarding, your laptop standard and your audit trail, exactly as you would an employee.

The staffing firm is a separate question. If the firm itself creates, receives, maintains or transmits PHI for you, through its own systems, managers or support staff, it is a business associate. Sign the BAA whenever there is doubt.

Dedicated teams: the vendor is your business associate

A dedicated team works on your product, but the vendor hires, directs and replaces the people. Their workforce is the vendor's. The vendor is your business associate, and under the Security Rule it must get written assurances from any subcontractor that touches ePHI. Ask for the list of subcontractors before you sign.

Your job moves from supervising people to verifying a program. Ask the vendor for its risk analysis, its training records, how it provisions and removes access, and how it would meet the proposed annual verification. A dedicated team is right when you lack the engineering managers to direct augmented engineers day to day.

At Mercury Development, engineers work full time in our development lab, with at least 3 years of experience, managers and team leads 7+, and we can change a team's structure within 2 weeks of a request. Our claims system for Precision Practice Management has had a continuous team since 2006 and is on its fourth major release. We build to HIPAA and GDPR requirements.

Offshore engineers and PHI

Offshore access is allowed. HHS's cloud computing guidance says the HIPAA rules "do not include requirements specific to protection of electronic protected health information" processed or stored outside the US, and that the risks "may vary greatly depending on its geographic location."

So the location goes into your risk analysis, not into a ban. Three controls make an offshore team defensible: no PHI on engineers' devices, access only through your managed environment, and a BAA that names the offshore entity as a subcontractor. Your own customers' contracts may add US-only terms on top of HIPAA. Check them before you staff.

Vetting questions that separate experience from vocabulary

A candidate who has handled PHI answers with systems, not acronyms. Ask:

1. Where in your last healthcare system was PHI encrypted at rest, and who held the keys?
2. How did audit logging record who viewed a patient record, and who reviewed the logs?
3. What happened when a patient name showed up in an error tracker or a log line?
4. Which vendors in the stack needed a BAA, and which did you keep away from PHI instead?
5. How did you get realistic test data without production PHI?

Then run a short paid exercise: design access control and audit logging for one patient record endpoint. Score the design, not the vocabulary.

PHI access: synthetic data first, production by exception

Most development needs no PHI at all. HHS recognizes two ways to de-identify data: Expert Determination and Safe Harbor, which removes 18 categories of identifiers. Build environments on synthetic or de-identified data, and keep production behind a request that names the person, the reason and the time limit.

Grant access by role, as the Security Rule's information access management standard asks: access to ePHI "only when such access is appropriate for the user or recipient's role." An engineer debugging a payment screen does not need diagnosis codes. Log every production session and review the log, because the rule requires mechanisms "to record and examine activity" in systems holding ePHI.

The first-week onboarding checklist

• Signed BAA with the vendor, and with any subcontractor that touches PHI.
• Security and privacy training under your policies, recorded with a date.
• A named account per engineer with multifactor authentication. No shared logins.
• A managed device or virtual desktop, with no PHI stored locally.
• Access to synthetic and de-identified environments only.
• An offboarding step that removes access the same day the engineer leaves.

What our healthcare pipeline shows

These shares come from healthcare and telehealth companies that evaluated custom development with us. A theme counts only when at least three companies raised it independently.

Around 15% said their product had to satisfy privacy, security, data residency and sometimes medical device rules at once. Around 10% wanted delivery schedules that accounted for client-side dependencies, such as approvals, with accountability if dates slipped.

Access was the recurring friction. Some buyers could not give a vendor legacy source code or staging access during discovery because of internal policy, which limited what could be assessed before the contract. Decide what an outside engineer may see before the first call, and the estimate gets better.

Decide the access model before you read a resume

The engineer's skill matters less than the access model they arrive into. A strong developer on a shared login with production PHI is a risk. An average developer on a named account, synthetic data and a logged path to production is not.

So write the access map first: which systems hold PHI, which roles reach them, who approves exceptions, how access ends. Then pick staff augmentation if you can direct and supervise the people, or a dedicated team if you need the vendor to run the program. Hire to that map.

Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The pipeline records behind this article's healthcare buyer section sit in the operations he oversees.

Hiring engineers for PHI work? Start with the access map

Tell us which systems hold PHI and how many engineers you need. We will propose staff augmentation or a dedicated team, with the access each role gets and the agreements each model needs.