The Office of Civil Rights released a fact sheet addressing the application of HIPAA to developers of Health Applications. OCR takes the position that a health app developer is a business associate of a health plan because it creates, receives, maintains, or transmits protected health information.
The Health App Guidance (which can be found by clicking here) sets forth 6 different scenarios and describes if HIPAA would apply to the developer as a business associate. The guidance also poses questions for developers to consider in determining if they are subject to HIPAA as a business associate.