Custom Frontends for HIPAA Apps
What changes when you build a HIPAA app with a custom frontend on Knack. Keep protected health information in Knack, out of your frontend builder's storage, and review anything that sends data elsewhere.
What You'll Learn
When you build a HIPAA app with a custom frontend on Knack, a few things change compared to a standard build. This article covers where protected health information (PHI) should live, what to keep out of your frontend builder, which Knack settings to turn on, and which features to review before real data arrives. It links to Knack's HIPAA Compliance section for the details.
Compliance decisions are yoursKnack provides the HIPAA plan, the Business Associate Agreement (BAA), and the security settings. Your organization decides how to use them. See Your Responsibilities as a Covered Entity.
How the Pieces Fit in a HIPAA App
In a custom frontend build, Knack and your frontend builder do different jobs.
| Knack | Your frontend builder and host | |
|---|---|---|
| Holds | Your data, users, and access rules | Your app's screens and code |
| PHI | Stored here, under your BAA with Knack | Passes through on the way to the screen, never stored |
| Security | Access rules, sign-in, 2FA, record history | How screens look and what they show |
The goal is simple: PHI is stored in Knack, and nowhere else.
Use Test Data Until Your BAA Is Signed
Build and test with made-up data. Bring real PHI in only after your Knack HIPAA plan and BAA are in place.
When you're ready for real data, import it through the Knack Builder rather than through your frontend builder or AI tool. You stay in control of what's sent, and nothing passes through another service. See Business Associate Agreements.
Keep PHI Out of Your Frontend Builder's Storage
Frontend builders often come with their own database, file storage, and sign-in. Lovable has Lovable Cloud. Base44 has its own database. If your frontend builder or host doesn't offer you a BAA, PHI shouldn't be stored there.
- Lovable: Lovable Cloud turns on by default. Tell Lovable not to use it in your first prompt. See Connecting Lovable to Knack: Complete Setup Guide.
- Base44: apps can be published with Public visibility by default. Check your app's visibility and run Base44's security scan. See Migrating an Existing Base44 App to Knack.
- Any frontend builder: check for copies of records, uploaded files, sign-in accounts, and logs stored outside Knack.
Moving an app you already built? Clear the old backend after your data is in Knack. See Connecting Knack to an Existing Lovable App.
Turn On Knack's Security Settings
These settings protect your data no matter how your screens are built. Most take a few minutes and need no changes to your frontend.
- Set up access rules and turn on enforcement
- Require two-factor authentication for your users
- Turn on record history
- Deactivate users as soon as they leave
See Security Basics for a Custom Frontend and HIPAA Security Settings.
Your screens aren't your securityHiding records on a screen doesn't stop someone from reaching them. Knack's access rules do. Confirm Knack is enforcing them with Checking That Your Access Rules Actually Work.
Review Anything That Sends Data Out
Emails, texts, notifications, AI features, and connections to outside services all send data out of your app. Before any of them carries PHI, you need a BAA with that service.
If a feature doesn't need PHI, leave it out. A notification that says "A new visit was added. Sign in to view it." works without sending patient details.
- Building a new app: plan these features before you build them.
- Moving an existing app: list every feature that sends data before you migrate. See Before You Migrate: Reviewing Your App's Features.
- Using Knack Flows: see Flows and Third-Party Compliance.
Moving Your App onto a HIPAA Plan
If you started on a standard Knack plan, your app moves to Knack's HIPAA environment. Plan for it before your users rely on the app. See Migrating to the HIPAA Environment for what to expect.
If your app moved to the HIPAA environment before July 1, 2026, your custom frontend needs to send requests to usgc-api.knack.com instead of api.knack.com. Apps that moved on or after July 1, 2026 don't need to change. Ask your frontend builder which address your app uses, and see HIPAA and the Knack API.
After the move, sign in to your published app as each role and confirm everything still works.
Building for More Than One Business
If your app serves several independent practices or clients, each business's PHI needs to stay separate. That changes how you set up Knack and which plan fits. Talk to Knack about plan options before you build. See Multi-Tenant Apps with a Custom Frontend: Choosing the Right Setup.
HIPAA Checklist for Custom Frontends
- Knack HIPAA plan and BAA in place before real PHI
- Test data only until then
- Real data imported through the Knack Builder
- No PHI stored in your frontend builder's database, files, sign-in, or logs
- Access rules set and enforcement on
- Two-factor authentication required
- Record history on
- Every email, notification, AI feature, and outside service reviewed
- A BAA with any service that receives PHI
- Sign-in and access tested as each role on your published app
For the full list, see the HIPAA Best Practices Checklist.
Next Steps
- HIPAA Compliance Overview: See how Knack supports HIPAA apps.
- What Counts as PHI: Identify which fields in your app hold PHI.
- Security Basics for a Custom Frontend: Set up the Knack security settings every custom frontend should have.
Updated 3 days ago