A HIPAA compliant translation app is judged by where the patient's words go next.

What the request actually carries

The string you send is rarely just a symptom. In practice it carries the name someone typed, the date of birth from the form, a record number pasted in for context, and the sentence the patient said about their own body. Any one of those identifiers makes the payload protected health information. The sentence on its own usually does too, because it describes a person who walked into your clinic on a particular day.

De-identifying your way out is harder than it looks. The safe harbor method works by removing 18 categories of identifier, including names, medical record numbers, telephone numbers and every date more precise than a year, and it only holds if you have no actual knowledge that what is left could still identify the person. Free clinical text rarely survives that. A note about the Tigrinya speaker who came in with her son after Tuesday night is not de-identified in any useful sense.

The working rule for the build is simple. Treat every string bound for a translation service as protected health information, then ask whether it has to be sent at all. Minimum necessary is a real constraint here. If the phrases your triage desk needs are forty stock sentences, ship them translated and reviewed in advance, and never make the call.

There is one route where the request never happens. Both mobile platforms have on-device translation models that work offline, and the vendor documentation is candid that they are built for casual, simple translation, with English used as a bridge between other language pairs, which costs accuracy. Fine for a sign, wrong for discharge instructions. Reaching those models from a React Native project usually needs a native module, and we have not verified a specific package, so scope it rather than assume it.

What the agreement with that vendor has to cover

Once a vendor processes the text on your behalf it is a business associate, and the contract is not paperwork you file after launch. The Privacy Rule spells out what the agreement has to establish, and the list reads better as a design brief than as legal boilerplate.

It has to set out the permitted and required uses and disclosures, and stop the vendor doing anything with the text that you could not do yourself. It has to require appropriate safeguards. It has to require the vendor to report any use or disclosure the contract does not allow, including breaches of unsecured protected health information. It has to bind the vendor's own subcontractors to the same terms, which matters when the translation runs on somebody else's models. It has to make the information available for access, amendment and an accounting of disclosures. It has to make the vendor's internal records available to the Secretary. And it has to require return or destruction of the information when the contract ends.

Two things follow for the build. The vendor has to be willing, and the large clouds publish which of their services are covered, with the free consumer translation apps nowhere on those lists. And the access, accounting and deletion clauses are only real if your app can find the records again, which means each request needs a log entry you can search by patient. The same question shapes a hipaa compliant messaging app: who else ends up holding the words, and under what contract.

45 CFR 164.504(e), business associate contracts

Machine output is not a qualified interpreter

HIPAA is only half of this. Federal language access rules sit on top, and they are about accuracy rather than privacy. A covered entity has to take reasonable steps to provide meaningful access to each individual with limited English proficiency, and where interpretation is needed it has to offer a qualified interpreter.

The rule names machine translation directly. Where the underlying text is critical to someone's rights, benefits or meaningful access, where accuracy is essential, or where the source is complex, non-literal or technical, the machine translation has to be reviewed by a qualified human translator. Clinical instructions are exactly that kind of text. The rule also closes the workarounds clinics reach for under pressure: an adult who is not a qualified interpreter, or a minor child, can only be used as a temporary measure in an emergency involving an imminent threat to safety.

Video remote interpreting has its own standards, and they are specific: real time full motion video and audio, an image sharp and large enough to show the interpreter's face, clear audio, and training for the people using it. So the honest design for most clinics is a hybrid. The app handles intake, consent, the stock phrases and the record, and a qualified human handles the consultation. That is what a medical interpreter app mostly is: the shortest path to a qualified human, plus proof the exchange happened. What the clinician writes afterwards belongs with the rest of the chart, or in a therapy notes app, not in a translation vendor's logs.

45 CFR 92.201, language assistance services for individuals with limited English proficiency

What the app keeps, and for how long

A translation feature produces records whether you planned them or not: the source text, the returned text, who asked, which patient it concerned, and when. Decide deliberately which of those you store. Each one you keep is protected health information sitting in your database, and each one you drop is a gap the day somebody asks what was actually said.

The Security Rule expects audit controls, meaning mechanisms that record and examine activity in the systems holding this data. Encryption in transit is an addressable specification rather than a flat requirement, which in practice means you implement it and document the reasoning, not that you get to skip it. On a phone the leaks are mundane: a translated sentence sitting on a lock screen, a screenshot in the camera roll, a cached string in a third party keyboard, one device shared across a shift.

Retention is the decision people postpone. A clinic that keeps every translated string forever has quietly built a searchable archive of patient speech that no clinician owns. Keeping the fact that an interpreted exchange happened, who interpreted, and the clinician's own note is usually both safer and more useful than keeping the raw text.