How to Build a HIPAA-Compliant Health App That Uses Wearable Data

Open Wearables Team · July 21, 2026 · 4 min read

Key Takeaways

HIPAA compliance is an architectural decision, not a feature you add later. The most important choice is where data lives.
Open Wearables is self-hosted: your users' health data stays on your own infrastructure and never passes through a third-party SaaS. This is the foundation of a HIPAA-ready architecture.
The platform uses bcrypt for password hashing, JWT for access tokens, Fernet encryption for provider credentials at rest, and structured access logging. These are documented in the codebase.
For covered entities, Momentum offers enterprise deployment with HIPAA-eligible architecture, encryption at rest and in transit, audit logging, role-based access, and BAA (Business Associate Agreement).
Open Wearables provides the infrastructure foundation. Whether your specific deployment meets HIPAA requirements depends on how you configure and operate it. Consult your legal and compliance team.

Most health app developers encounter HIPAA late: after the architecture is set, after data is flowing, after a compliance review flags the problem. The question is not just "is our app HIPAA compliant" but "where does health data live, who controls it, and can we demonstrate that?"

This article covers what Open Wearables provides at the infrastructure level and what you need to configure yourself to build toward HIPAA compliance.

Why Self-Hosting Matters for Compliance

SaaS health data APIs store your users' data on their infrastructure. You depend on their security controls, their breach notification procedures, and their BAA. If they have a breach, it affects your obligations.

Self-hosted infrastructure means your users' data stays on servers you control. Your security team sets the controls. Your infrastructure determines the audit trail.

Open Wearables is self-hosted by design. When you deploy it, wearable data from Garmin, Polar, Oura, Whoop, and other connected providers flows into your PostgreSQL instance on your infrastructure. It does not pass through Momentum's servers unless you explicitly use Momentum's hosting services.

What Open Wearables Provides

From the Open Wearables codebase:

Authentication and access control:

JWT-based access tokens with configurable expiry (utils/security.py)
bcrypt password hashing for user credentials (utils/security.py)
API key authentication for developer portal access
CORS configuration with explicit origin allowlisting (middlewares.py)

Credential storage:

Provider OAuth credentials (Client ID, Client Secret, access tokens, refresh tokens) are stored using Fernet symmetric encryption from the Python cryptography library (utils/config_utils.py)
Secrets are stored as EncryptedField types in the database, not as plaintext

Access logging:

Structured HTTP access logging via middleware, configurable per environment (middlewares.py)
Production defaults to errors-only logging (ACCESS_LOG_LEVEL=errors)
Full request logging available via ACCESS_LOG_LEVEL=all

Transport security:

Redis TLS support for encrypted in-transit communication to Redis (redis_ssl=True in config)

Self-hosting:

Full deployment via Docker Compose
All services (FastAPI backend, PostgreSQL, Redis, Celery workers) run on your infrastructure

What You Need to Configure

Open Wearables provides the infrastructure foundation. HIPAA compliance requires that you configure and operate it correctly.

Encryption at rest: PostgreSQL does not encrypt data at rest by default. You need filesystem-level encryption on your deployment infrastructure or database-level encryption.
Encryption in transit: HTTPS between clients and your Open Wearables instance requires TLS termination at a load balancer or reverse proxy in front of the application. This is not configured by default.
Audit logging: HTTP access logging captures requests, but application-level audit trails (who accessed which user's data, when, and from where) require additional implementation on top of the base logging infrastructure.
Backup and disaster recovery: Data availability controls, backup policies, and recovery procedures are your responsibility.
BAA: If your application requires HIPAA compliance, you need a Business Associate Agreement with every vendor who handles relevant data on your behalf, including your infrastructure provider. Momentum offers BAAs for enterprise deployments.

Enterprise Deployment

Open Wearables is built and maintained by Momentum. For teams that need enterprise deployment with HIPAA-eligible architecture, encryption at rest and in transit, audit logging, role-based access, and a BAA, Momentum offers this as a commercial service. Details at openwearables.io/pricing.

FAQ

Is Open Wearables HIPAA compliant out of the box?

No. HIPAA compliance is not a product feature, it is an operational posture. Open Wearables provides the self-hosting architecture, credential encryption, access logging, and JWT-based authentication that are prerequisites for HIPAA-ready deployment. Whether your deployment meets HIPAA requirements depends on how you configure and operate the infrastructure, and on the specific requirements of your use case. Consult your legal and compliance team.

Do I need a BAA with Momentum?

If you use Momentum's hosting or implementation services in a context that requires HIPAA compliance, yes. Momentum offers BAAs for enterprise deployments. If you self-host Open Wearables entirely on your own infrastructure without Momentum's involvement, the question shifts to your infrastructure provider.

Does Open Wearables support audit logging?

The platform includes structured HTTP access logging via middleware, configurable per environment. Production defaults to errors-only. Full request logging is available. Application-level audit trails (who accessed which user's data, when) require additional implementation on top of the base logging infrastructure.

Can I deploy Open Wearables on AWS?

Yes. Open Wearables runs on Docker Compose and can be deployed on any cloud provider including AWS, GCP, and Azure. You are responsible for configuring the infrastructure correctly for your compliance requirements. Momentum can assist with enterprise deployments that require this configuration.

Where does wearable data go when a user connects a device?

Data flows from the provider (Garmin, Oura, Whoop, etc.) directly into your Open Wearables PostgreSQL instance on your infrastructure. It does not pass through Momentum's servers unless you use Momentum's hosting services.

Back to all posts