How to Connect a Claude Code App to a HIPAA-Compliant Backend

Claude Code builds healthcare apps fast. However, the infrastructure it generates by default does not handle patient data compliantly. Claude Code is a coding agent, not a compliance platform. In other words, the two jobs require different tools. Consequently, when a healthcare app built with Claude Code needs to handle protected health information, the data layer needs a purpose-built HIPAA-compliant backend rather than whatever database Claude Code scaffolds by default.

This guide covers why that gap exists, how to connect Claude Code to Knack Health as the HIPAA-compliant data layer, and what the architecture looks like in practice.

Key takeaways

• Claude Code builds healthcare app frontends fast. It does not provide HIPAA-compliant data infrastructure by default.
• Claude.ai and Claude Code in their standard configurations do not sign BAAs. Anthropic’s own documentation confirms this for consumer and standard API plans.
• The solution is a two-layer architecture: Claude Code handles the frontend and application logic, Knack Health handles all PHI storage, encryption, audit logging, and the signed BAA.
• The connection works through Knack’s MCP (Model Context Protocol) server, which gives Claude Code visibility into your Knack data schema at build time. At runtime, the app communicates with Knack via Knack’s runtime API.
• PHI flows directly to Knack Health’s HIPAA-compliant infrastructure and never touches Claude Code’s own environment.

Is Claude Code HIPAA compliant?

Claude Code itself is a coding agent that runs in your terminal and generates application code. Specifically, the compliance question is not really about Claude Code as a tool. It is about where the application it generates stores and processes data.

Anthropic does not currently offer a standard BAA for Claude.ai consumer accounts or the standard Claude API. Healthcare organizations that need a signed BAA for AI features that process PHI need to evaluate Anthropic’s enterprise agreements separately. In practice, therefore, any database, storage layer, or backend service that Claude Code scaffolds by default needs independent HIPAA evaluation before real patient data enters the system.

The code Claude Code writes is yours. The compliance posture of the infrastructure it writes that code for is a separate question. For example, if Claude Code generates an app that writes patient records to a generic database, that database needs its own HIPAA compliance posture regardless of how the code was written.

Why the default infrastructure doesn’t work for healthcare

Specifically, when Claude Code scaffolds a web application, it typically generates standard backend infrastructure: a database connection, API routes, authentication, and storage. That infrastructure works well for most applications. However, for healthcare apps handling PHI, several gaps appear immediately.

No BAA on default database connections

Specifically, standard databases that Claude Code might connect to, such as a basic PostgreSQL instance, SQLite, or a generic cloud database, do not come with a signed BAA. Without a BAA, storing PHI in any of these is a HIPAA violation regardless of how secure the connection is.

No audit logging by default

HIPAA requires logging every access to and change of PHI: who viewed it, who changed it, and when. Standard database setups do not provide this automatically. Consequently, building it correctly from scratch requires significant additional engineering work.

No field-level access controls

HIPAA’s minimum necessary standard requires each staff member to access only the PHI their role requires. Standard application architectures typically enforce access at the route level, not the field level. In practice, implementing true field-level access controls correctly is non-trivial.

No encryption guarantees

Encryption at rest and in transit needs to be verified at the infrastructure level, not just assumed. Additionally, default database setups vary in how encryption is configured and whether it meets accepted standards.

The solution: Claude Code as frontend, Knack Health as HIPAA backend

Instead of configuring default infrastructure for HIPAA compliance, the cleaner approach keeps Claude Code doing what it does best (building the application layer fast) and delegates all PHI handling to Knack Health’s purpose-built HIPAA infrastructure.

How the architecture works

Claude Code builds the frontend and application logic

Claude Code generates your application’s interface, forms, routing, and business logic. The code it writes handles user interaction, data presentation, and workflow orchestration. Importantly, this layer stays in Claude Code’s domain throughout.

Knack Health handles all PHI

Every piece of patient data your app generates, including form submissions, patient records, clinical notes, and identifiable health information, routes directly to Knack Health’s HIPAA-compliant backend. As a result, PHI flows straight to Knack’s encrypted, audited, BAA-covered data layer and never touches Claude Code’s generated infrastructure. The compliance boundary stays clean: Claude Code is your application layer, Knack Health is your data layer.

MCP connects Claude Code to your Knack schema at build time

Knack Health provides an MCP (Model Context Protocol) server that Claude Code can connect to during development. Once configured, Claude Code gains visibility into your Knack data schema and generates application code that maps directly to your real Knack fields and data structures. Consequently, the frontend code and the compliant data layer stay in sync as your app evolves.

Knack’s runtime API handles data operations

At runtime, your Claude Code application communicates with Knack Health via Knack’s runtime API. Record operations, including creating patient records, reading intake submissions, updating statuses, and deleting records, go through this API connection. PHI stays in Knack Health’s infrastructure throughout.

What Knack Health provides on the backend

Knack Health provides the full technical safeguard layer the Security Rule requires:

A signed BAA included on every HIPAA plan

Specifically, Knack Health includes a signed BAA with every HIPAA plan. You do not negotiate it separately. The BAA covers all PHI stored in Knack Health’s infrastructure.

Encryption at rest and in transit

Knack Health encrypts all patient data at rest and all transmissions between your Claude Code frontend, Knack’s backend, and users in transit. This is platform-level infrastructure. Your team does not configure it separately.

Record change logs on every field

The platform automatically logs every access to and change of a patient record: the user, the timestamp, and the specific values that changed. Consequently, this satisfies HIPAA’s audit control requirement without additional engineering work.

Role-based access controls at the field level

You define which user roles can see which fields in the Knack data schema. The platform enforces these permissions across every API call and form interaction, implementing the minimum necessary standard at the data layer rather than in application code.

HIPAA-ready infrastructure on every HIPAA plan

Knack Health designs its infrastructure for healthcare data from the platform level up. In other words, compliance is not configured on top of a general-purpose platform. It is built in.

How to set up the Claude Code and Knack Health integration

Here is the general shape of the setup. Exact steps may vary as the integration evolves, so treat this as a process guide and verify current configuration steps with the Knack Health team.

Define your data schema in Knack Health

First, set up your patient data structure in Knack Health’s visual builder: the objects, fields, and relationships your app needs. This becomes the HIPAA-compliant source of truth for all PHI your app handles.

Configure Knack’s MCP server in your Claude Code environment

Next, connect Knack’s MCP server to your Claude Code setup. Once configured, Claude Code can read your Knack schema and generate application code that maps correctly to your data model.

Generate your application code with Claude Code

With the MCP connection in place, Claude Code can generate frontend components, forms, and API calls that reference your actual Knack data structure rather than a generic scaffold. The generated code interacts with Knack via the runtime API.

Configure runtime API calls for data operations

Specifically, set up your application’s data operations to route through Knack’s runtime API. Patient record creation, retrieval, updates, and deletion all go through this connection, keeping PHI in Knack’s compliant infrastructure.

Sign your BAA and confirm your HIPAA plan before going live

Before any real patient data enters the system, confirm you are on a Knack Health HIPAA plan with a signed BAA in place. Knack Health includes the BAA on every HIPAA plan. You do not need to request it separately.

Test the compliance boundary before going live

Specifically, verify that PHI flows to Knack Health’s infrastructure and not to any other storage your Claude Code application may have scaffolded. Confirm that audit logging captures the expected events and that role-based access controls work as configured.

If your Claude Code prototype already has patient data

If you have already been testing with real patient data in a default Claude Code backend, however, stop adding PHI to that environment immediately. Document the exposure period and consult with a HIPAA compliance officer or healthcare attorney about whether breach assessment or notification is needed. Knack Health’s team can help migrate your existing data models and records into a HIPAA-compliant environment before you resume production use.