Ship Safe: A Vibe Coder's Guide to HIPAA & FDA Compliance for Health Apps

The handbook for vibe coders shipping a real health app.

Vibe coding put a working health app in reach of anyone who can describe one. The regulators it answers to did not get easier.

Ship Safe is the field guide for builders who want to ship without getting blindsided by a HIPAA fine or an FDA letter. Twelve chapters cover the rules that apply, the AI tools that will and will not sign a Business Associate Agreement, the architectural decisions that decide whether your app is a medical device, and the incident response plan you need before you have an incident.

About 10,000 words across 12 chapters. Reads in an evening. Gets used for years.

Inside the book

Part I. What HIPAA actually requires. Whether your app touches PHI, what kind of regulated entity that makes you, and what the Privacy, Security, and Breach Notification Rules each require in practical terms.

Part II. AI tools and HIPAA. Why AI-generated code fails HIPAA by default, which AI platforms will sign a BAA in 2026, and how to read the BAA landscape across LLM APIs, databases, hosting, email, SMS, voice, and speech vendors.

Part III. FDA and your app. The current Software as a Medical Device framework, the four-part Clinical Decision Support exemption test, and the Predetermined Change Control Plan that lets you update AI models after shipping.

Part IV. Building compliance in. Five technical safeguards from 45 CFR 164.312 written as code patterns, a 20-question pre-launch self-audit, and the difference between an app that passes its demo and one that passes its first real audit.

Part V. Operating after launch. Working with healthcare institutions when you get one as a customer, and the minimum viable incident response plan to have in the repo before you need it.

Who it is for

• Solo founders building a health product on a modern stack.
• Developers asked to add a HIPAA-compliant feature to an existing app.
• Designers and PMs who need to understand what the engineers are deciding.
• Physician-builders who can read code but have never thought through a BAA.
• Anyone who has typed a one-line prompt and gotten back a "HIPAA-compliant patient portal" they cannot quite trust.

Who wrote it

Khalid Nawab, MD, MPS-AI. Hospitalist physician with a Master of Professional Studies in Applied AI and a publication record in high-impact peer-reviewed journals. Builds health tools as a vibe coder, the same way you do.

The book is written from the builder's chair, not the auditor's. It calls out where AI tools will betray you, which vendors will and will not sign a BAA in 2026, and what the rule actually says when you cut through the consultant copy.

What this Kindle edition includes

The full text of the book in Kindle format. The companion templates, fillable checklist, BAA tracker spreadsheet, and printable reference cards ship separately as a bundle for builders who want to put the book straight to work. Look up the Ship Safe bundle on the author's site for those.

This book is reference material, not legal advice. For decisions with real money or real patient data on the line, consult a healthcare-regulatory attorney.