Technology guide
APIs and HIPAA
Protect PHI at the boundaries where applications authenticate, transmit, log, transform, and authorize data.
Reviewed August 2026
Key considerations
- APIs can expose PHI through payloads, errors, traces, caches, and developer tools.
- Authentication, authorization, input validation, rate limits, auditability, and transport security work together.
- Document consumers, scopes, secrets, and data retention.
Questions to ask
- Which callers can request which fields and actions?
- Do logs and error paths contain PHI or secrets?
- How are tokens, keys, scopes, and revoked integrations managed?