In HeathTech apps, it’s often the case that you’re dealing with private or health-related data. This requires compliance with regulations, such as HIPAA in the United States. These regulations force you to handle sensitive data in a well-defined manner, so only specific people can read it, and if they do, it should be logged for later auditing.

Azure API Management (APIM) is a powerful platform that enables you to publish and scale APIs while ensuring they are secured. One of the great features of Azure APIM is that you can add plugins and transforms to your APIs without any code change or restarts. These capabilities are deployed using XML Policies which are a collection of statements.

Like any online service, your API users expect high availability and good performance. This also means one customer should not be able to starve another customer’s access to your API. Adding rate limiting is a defensive measure which can protect your API from being overwhelmed with requests and improve general availability. Similarly, adding quota management also ensures customers stay within their contract terms and obligations ensuring you’re able to monetize your API.

The Health Insurance Portability and Accountability Act, or HIPAA for short, is a set of laws around handling health-related data in information systems. It defines safeguards, which are rules you have to follow when handling health data for your customers. There are three safeguard categories: All three categories have to be handled correctly if you want your API to be HIPAA compliant. In a companion article we covered those key requirements and how to build HIPAA complaint API platforms.