HIPAA-compliant hosting for a physiotherapy patient app in New York (2026)

The verdict in three sentences

As soon as an app stores protected health information on behalf of a physical therapy practice, every vendor touching that data must sign a Business Associate Agreement and follow the HIPAA Security Rule. For a 30-therapist network in New York, a realistic budget is 60,000 to 110,000 USD in development, 400 to 1,500 USD a month for HIPAA-eligible hosting and around 5,000 USD for a security risk assessment, over 5 months. The classic trap is prototyping on a cheap host with no BAA and migrating in a hurry, which adds 8,000 to 15,000 USD and 6 to 8 weeks.

Why HIPAA hosting is non-negotiable

An app that records evaluations, home exercise programs, patient-reported pain scores or visit notes handles PHI. The practice is a covered entity; your development agency, your cloud provider, your email and SMS vendors are business associates. Without a signed BAA with each of them, the practice is exposed, and OCR penalties in 2026 range from a few hundred dollars per violation to more than 2 million USD a year per violation category for willful neglect.

There is no official HIPAA certification for hosting. Instead, AWS, Microsoft Azure and Google Cloud offer HIPAA-eligible services under a BAA, and managed providers build on top of them. A BAA covers the infrastructure only: encryption, access control, audit logs and the risk assessment remain your responsibility.

The full project budget

For a physical therapy network, the typical scope includes a clinician workspace (program builder, patient tracking, visit notes), a patient PWA (exercise videos, reminders, pain scale, secure messaging) and a network admin console (de-identified analytics, clinician management).

Development therefore lands between 60,000 and 110,000 USD depending on scope, excluding video production. Security requirements must be designed in from day one: encryption at rest (database and backups) and in transit, MFA for clinicians, audit logs of every record access, de-identified patient IDs in analytics, and a documented data retention and deletion policy.

Two items usually blow the budget. The first is integration with the practice's EMR or billing system: syncing patients from WebPT or a similar platform can add 8,000 to 20,000 USD depending on API access. The second is regulatory status: if the app starts adjusting exercise plans on its own, it may drift toward FDA software as a medical device territory. Keeping the app clinician-driven, as a tracking and patient education tool, avoids that shift.

The 5-month plan: one month of discovery, risk assessment and vendor BAAs, three months of development in two-week sprints, and one month of pilot with 5 therapists and 150 patients before opening to the full network. Security principles for this kind of platform are close to those in our article on NIS2 compliance for a web application.

Mini case study

Daniel, a physical therapist who founded a 30-clinic network across Manhattan and Brooklyn, targets 2,500 active patients. The selected quote: 88,000 USD of development, 5,000 USD for the risk assessment, 6,000 USD to film 120 exercise videos, a total of 99,000 USD. Managed HIPAA hosting costs 1,000 USD a month and application maintenance 1,600 USD a month, 31,200 USD a year.

The business model is a clinician subscription at 89 USD a month. With 30 therapists, that is 32,040 USD a year, which covers operations. The upfront investment is recovered by licensing to other networks: at 120 subscribed therapists, annual revenue reaches 128,160 USD, an operating margin of 96,960 USD, and payback in just over a year. On the clinical side, the network tracks one goal: raising home exercise adherence from 35% to 60%.

FAQ

Is hosting on AWS automatically HIPAA compliant?

No. You must sign AWS's BAA, use only HIPAA-eligible services and configure them correctly. Budget at least 400 USD a month for a serious production setup with backups and logging.

Is a security risk assessment mandatory?

Yes, the HIPAA Security Rule requires a documented risk analysis, and OCR asks for it first after any breach. Expect about 5,000 USD and 2 to 3 weeks with a consultant before go-live.

Do exercise videos need HIPAA hosting too?

Generic videos shown to every patient are not PHI and can sit on a standard CDN. The link between a given patient and their program, however, stays inside the HIPAA environment.

How long until launch?

Plan on about 5 months, including a one-month pilot with 5 therapists and 100 to 150 patients. The pilot avoids reworking journeys once 2,500 patients are enrolled.

Could the app be regulated by the FDA?

It could if it diagnoses or autonomously changes treatment. A clinician-driven tracking tool generally stays outside that scope, avoiding a regulatory process that can exceed 100,000 USD.

Let's scope your project. We will map the clinician workspace, patient app and HIPAA hosting setup with you for a launch in about 5 months. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.