Two rules every builder must know:
Privacy Rule — what counts as PHI, who can access it (covered entities + business associates), patient rights.Security Rule — administrative, physical, technical safeguards (encryption at rest + in transit, audit logging, access controls).For builders:
Synthetic / Synthea data is not PHI → safe for dev + demosReal patient data → covered + you need a Business Associate Agreement (BAA) with anyone handling it (cloud provider, AI vendor)Anthropic offers a BAA for enterprise customers — talk to your account teamReference: HHS HIPAA for Professionals.