HIPAA has no certificate, only rules you keep proving you follow.

HIPAA is a US law. The part most companies mean when they say HIPAA is its set of health-data regulations, drafted by HHS, short for the federal Department of Health and Human Services. They set out who may see health information, how electronic health data has to be protected, and what follows when it leaks.

Spelled out: Health Insurance Portability and Accountability Act of 1996.

HIPAA attaches to relationships, not to data alone. Its duties fall on covered entities, meaning health plans, healthcare clearinghouses and any provider that bills electronically in standard transactions, and on the business associates working for them. A fitness app selling straight to consumers may hold sensitive health data and still fall outside HIPAA, while an Indian software company that builds a portal for a US hospital falls inside it. Getting that question right decides whether you need a business associate agreement, a risk analysis and the rest. Enforcement belongs to OCR, the Office for Civil Rights inside HHS, which acts on complaints, investigations and compliance reviews and can impose civil money penalties. There is no official certification: HHS does not certify or endorse any company as compliant, so a vendor badge is a marketing claim, not a government finding.

45 CFR Parts 160, 162 and 164

The regulations: general provisions, transaction standards, and the privacy, security and breach rules.

A US customer's security review

Questions about your risk analysis, safeguards and BAA usually arrive together.

The business associate agreement

The contract through which HIPAA duties reach a vendor.

OCR resolution agreements

Published settlements that show what enforcement looks like in practice.

HITECH Act

A 2009 law that strengthened HIPAA: it made business associates directly liable, added breach notification and raised penalties. It amends HIPAA rather than replacing it.

HITRUST

A private framework and certification programme. Useful as evidence, but it is not HIPAA and is not run by the government.

• Work out whether you are a covered entity, a business associate, or neither, for each product line.
• If you are in scope, start with the required security risk analysis; most other work follows from it.
• Keep written policies and records for six years, as the rules expect.
• Treat any HIPAA badge or certificate you are offered as private assurance, not an HHS approval.

• GuideThe HIPAA compliance guideThe rules, who they cover, and what compliance takes in practice.
• GuideBuilding a HIPAA programme, step by stepA sequence that gets safeguards in place and documented.
• GuideHIPAA penalties and enforcementHow OCR enforces, the penalty tiers, and what lowers them.

Sources: Health Insurance Portability and Accountability Act of 1996; 45 CFR Parts 160, 162 and 164; HITECH Act as summarised by HHS; HHS and OCR guidance on covered entities, business associates and enforcement.