HIPAA-Compliant
Error Tracking

HIPAA-compliant error tracking is non-negotiable for production healthcare apps. But every time Sentry captures an unhandled exception, it packages up the stack trace, the request context, the session data and often the local variable values — then ships it to a third-party server. For most apps, that's fine. For HIPAA-covered applications, it can be an unauthorized disclosure of ePHI.

Why Error Trackers Are a HIPAA Risk

Modern error trackers are designed to capture as much context as possible to help you reproduce bugs. That's exactly the feature that creates the compliance problem. A single captured exception can contain:

Which Error Trackers Offer BAAs?

A Business Associate Agreement is the legal minimum for using a managed error tracking service with PHI-containing applications. Not all vendors offer one:

How to Scrub PHI from Sentry

Even with a BAA, best practice is to scrub PHI before it leaves your application. A BAA is a legal safeguard — scrubbing is technical prevention. Do both.

Python — before_send hook

The before_send hook runs on every event before it is transmitted. Return None to drop the event entirely, or modify the event dict to remove sensitive fields:

import sentry_sdk
import re

def scrub_phi(event, hint):
    """Remove PHI from Sentry events before sending."""

    # Drop events from PHI-heavy endpoints entirely
    request = event.get("request", {})
    url = request.get("url", "")
    if "/patients/" in url or "/medical-records/" in url:
        # Scrub the URL — keep the path structure but remove IDs
        request["url"] = re.sub(r"/patients/\d+", "/patients/[REDACTED]", url)

    # Scrub request body
    if "data" in request:
        request["data"] = "[SCRUBBED]"

    # Scrub query string
    if "query_string" in request:
        request["query_string"] = "[SCRUBBED]"

    # Scrub user context
    if "user" in event:
        user = event["user"]
        if "email" in user:
            user["email"] = "[REDACTED]"
        if "username" in user:
            user.pop("username", None)

    # Scrub extra context
    event.pop("extra", None)

    return event

sentry_sdk.init(
    dsn="https://your-dsn@sentry.io/project-id",
    before_send=scrub_phi,
    # Also configure built-in scrubbing
    send_default_pii=False,  # Critical — disables auto PII collection
)

JavaScript / Node.js — beforeSend hook

import * as Sentry from "@sentry/node";

Sentry.init({
  dsn: "https://your-dsn@sentry.io/project-id",
  sendDefaultPii: false, // Never send default PII

  beforeSend(event) {
    // Scrub request body
    if (event.request) {
      event.request.data = "[SCRUBBED]";
      event.request.query_string = "[SCRUBBED]";
      event.request.cookies = "[SCRUBBED]";

      // Redact PHI patterns from URL
      if (event.request.url) {
        event.request.url = event.request.url
          .replace(/\/patients\/\d+/g, "/patients/[ID]")
          .replace(/mrn=[^&]+/gi, "mrn=[REDACTED]")
          .replace(/dob=[^&]+/gi, "dob=[REDACTED]");
      }
    }

    // Remove user email
    if (event.user) {
      delete event.user.email;
      delete event.user.username;
      delete event.user.ip_address;
    }

    // Remove all extra context (may contain session data)
    delete event.extra;

    return event;
  },
});

Sentry Dashboard — Data Scrubbing Settings

In addition to code-level scrubbing, configure Sentry's server-side data scrubbing as a second layer:

How to Scrub PHI from Datadog

Datadog's APM and Log Management products support obfuscation rules. For error tracking specifically, configure the tracer's obfuscation settings:

# Python (dd-trace)
from ddtrace import config, tracer

# Obfuscate query strings matching PHI patterns
config.trace_http_header_tags = {}  # Don't capture headers

# In ddconfig.yaml or environment variables:
# DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP=mrn=[^&]*|dob=[^&]*|ssn=[^&]*

# For logs, configure log scrubbing rules in datadog.yaml:
# logs_config:
#   processing_rules:
#     - type: mask_sequences
#       name: mask_mrn
#       replace_placeholder: "[MRN_REDACTED]"
#       pattern: MRN-\d+

// Node.js (dd-trace)
const tracer = require('dd-trace').init({
  // Obfuscate sensitive query parameters
  queryStringObfuscation: /mrn=[^&]*/gi,

  // Don't capture request bodies on these routes
  blocklist: ['/patients', '/medical-records', '/prescriptions'],
});

The Nuclear Option — Self-Hosted Sentry OSS

If you need the cleanest possible HIPAA posture and have devops capacity, self-hosted Sentry eliminates the third-party risk entirely. All error data stays on infrastructure you control — no BAA required because you're not sending data to a third party at all.

# Install via Docker Compose (official method)
git clone https://github.com/getsentry/self-hosted.git
cd self-hosted
./install.sh

# Or via Helm on Kubernetes
helm repo add sentry https://sentry-kubernetes.github.io/charts
helm install sentry sentry/sentry \
  --set user.email=admin@yourcompany.com \
  --set user.password=yourpassword

Self-hosted Sentry gives you the same UI and SDK compatibility as Sentry cloud. The trade-off is infrastructure management — you're responsible for backups, updates and availability.

HIPAA Error Tracking Compliance Checklist

Before Sharing Error Logs — Sanitize First

Even with error tracking properly configured, you may sometimes need to share raw logs or stack traces for debugging — with a colleague, a vendor or an AI assistant. Always sanitize first.

FAQ