HIPAA compliance for healthcare and healthtech teams.

We map where your electronic protected health information (ePHI) is stored, processed and shared, help you close the gaps, and document the evidence to prove it.

Get a HIPAA risk assessmentBook a free consultationHow the program works
US healthcare providers:
a Security Risk Assessment and a roadmap to fix the gaps.
Healthtech and IT vendors:
BAA review and questionnaire-ready evidence.
  • Scope agreed in writing up front
  • Access control, audit logs and encryption reviewed across systems holding patient data
  • Business Associate Agreements (BAAs) reviewed for every vendor that touches patient data
  • Evidence built for hospital security questionnaires and assessors
HIPAA, in plain words

What is HIPAA, and what does it protect?

HIPAA, the Health Insurance Portability and Accountability Act, is the US federal law that sets the minimum standard for protecting patient health information. It applies to healthcare providers, health plans and clearinghouses, and to the vendors that handle patient data for them. The Office for Civil Rights (OCR) at the US Department of Health and Human Services (HHS) enforces it.

Who the patient is

  • Name
  • Address
  • Birth or admission dates
  • Phone & email
  • Medical record & account numbers
  • Device IDs & IP addresses

Their health or care

  • Diagnoses & conditions
  • Treatment & prescriptions
  • Lab & imaging results
  • Appointments & visit notes
  • Insurance & billing

PHI

Protected Health Information

Health information that can be tied to a specific person, when a covered entity (a provider, health plan or clearinghouse) or a business associate (a vendor working on its behalf) holds it. The same data held outside that relationship is not PHI under HIPAA.

Stored or sent electronically, it is electronic PHI (ePHI). Most software teams handle ePHI.

The three HIPAA rules

  1. Privacy Rule

    Sets who may use and share PHI, and for what purpose. It applies a minimum necessary standard: use or share only what the task needs. Treatment disclosures between providers, disclosures to the patient or that the patient authorizes, disclosures required by law and disclosures to HHS are the exceptions.

  2. Security Rule

    Requires administrative, physical and technical safeguards for ePHI, built on a documented risk analysis. Some specifications are required. Others are addressable: you either implement them, or document why they are not reasonable and what you did instead.

  3. Breach Notification Rule

    Applies when unsecured PHI is breached. Affected individuals must be told without unreasonable delay, and no later than 60 days after discovery. Breaches affecting 500 or more people are reported to HHS in that same window; smaller ones go in a yearly log. A vendor tells its client first, often sooner under their contract.

ePHI

Where ePHI usually lives

  • Production databases
  • Backups & snapshots
  • Application logs
  • Exports & reports
  • Email & messaging
  • Support tickets

Logs, exports, backups and support tools hold patient data too, and are the places most easily left out of scope. Discovery, the first phase of our program, maps each of these for your systems.

Read the full HIPAA compliance guide: the three rules in depth, BAAs and HIPAA in the cloud
Who it applies to

Who needs to comply with HIPAA?

HIPAA reaches two groups: covered entities, and the business associates that create, receive, maintain or transmit protected health information (PHI) on their behalf. Each handoff of PHI to a vendor needs a Business Associate Agreement (BAA), and each party needs its own safeguards.

01 · Covered entities

Hold the patient records

  • Hospitals, clinics and physicians
  • Pharmacies and dentists
  • Health plans and insurers
  • Healthcare clearinghouses

Regulated first, and must sign a BAA with every vendor that touches PHI.

BAABound to covered entities by a business associate agreement.

02 · Business associates

Handle PHI for them

  • SaaS and app platforms
  • Cloud and hosting
  • Billing and claims
  • IT, analytics and consultants

Directly liable under HIPAA, and bound to each client by a BAA.

Subcontractor BAABound to business associates by a subcontractor agreement.

03 · Subcontractors

Your own vendors with PHI access

  • Hosting and storage
  • Support and messaging tools
  • Analytics services

Need a BAA with you, and carry the same obligations.

If you create, receive, store or send patient data for a hospital, clinic or health plan, you are a business associate.

HIPAA follows the data, not the vendor’s address: a non-US company handling PHI for a US covered entity is a business associate. If consumers give your app their health data directly, with no covered entity involved, HIPAA may not apply, though the Federal Trade Commission’s Health Breach Notification Rule and state privacy laws can.

How the program works

How a HIPAA compliance program works

Six phases, each with a named output and a clear ask of your team. The security risk assessment (SRA) covers the first two phases. The HIPAA compliance program runs all six.

  1. Discover

    Discovery & current-state assessment

    We confirm how HIPAA applies to you, build a PHI inventory of every place protected health information (PHI) is stored, processed and shared, map how it flows, and rank each gap against the Privacy, Security and Breach Notification Rules.

    • Current-state assessment
    • PHI inventory
    • Data-flow mapping
    • Gap ranking
    You get
    PHI inventory, data-flow map and gap register.
    You provide
    A kickoff with your engineering and compliance owners, a list of the systems and vendors touching patient data, existing policies, and configuration walkthroughs with your engineers.
  2. Assess

    Security risk assessment (SRA)

    The documented review HIPAA requires: we identify reasonably anticipated threats and vulnerabilities to electronic PHI (ePHI) across apps, databases, cloud, endpoints, backups and third parties, score each risk by likelihood and impact, and plan its treatment.

    • Risk methodology
    • Threats & vulnerabilities
    • Risk scoring
    • Treatment plan
    You get
    Security risk assessment report and risk treatment plan.
    You provide
    An owner for each risk, and decisions on how each one is treated.
  3. Document

    Policies & procedures

    Privacy and security policies written for how you operate, an incident response procedure with named roles, and Business Associate Agreement (BAA) templates with a process to track every signed agreement.

    • Privacy policies
    • Security policies
    • Incident response
    • BAA management
    You get
    Privacy and security policies, incident response plan and BAA templates.
    You provide
    Sign-off on drafts, and the people who will own each procedure.
  4. Implement

    Technical safeguards

    We put the technical safeguards in place with your engineers, across every system that holds ePHI: who can reach it, how it is protected, and a record of every access.

    • Multi-factor authentication
    • Access control
    • Encryption
    • Audit logging
    You get
    Access control, encryption and audit logging live, with the evidence to show it.
    You provide
    Engineering time for the changes, and access to review or configure them.
  5. Train

    Training & awareness

    HIPAA training matched to each role, security awareness for everyone, and phishing simulations, all recorded so an assessor can check who completed what.

    • Role-based training
    • Security awareness
    • Phishing simulations
    • Training records
    You get
    Role-based training records and phishing test results.
    You provide
    Staff time for training, and a list of the roles that handle patient data.
  6. Validate

    Testing & validation

    We test that it all holds: penetration testing, a check of each policy against how you actually work, a mock audit, and fixes for whatever they find.

    • Penetration testing
    • Policy validation
    • Mock audit
    • Remediation
    You get
    Penetration test results, mock audit report and remediation log.
    You provide
    Testing windows agreed in advance, and engineering time to fix the findings.

No one-size timeline: it depends on how many systems and vendors touch patient data. You get a firm timeline in writing before work starts.

Deliverables

What you receive

Everything the program produces lands in one evidence binder. Each item is paired with the questionnaire or assessor question it answers.

Each gap comes with the specific fix and a walkthrough with your engineers. We verify each fix and update the report, so closure is documented.

HIPAA certification

HIPAA has no official certification. This binder is your evidence of compliance, not a certificate.

  1. 01, Discover phase: Scope & applicability assessment

    Whether you act as a covered entity or business associate, and which systems, data flows and vendors are in scope.

  2. 02, Discover phase: Gap report & remediation roadmap

    Each gap against the Privacy, Security and Breach Notification Rules, ordered by risk, with an owner.

  3. 03, Discover phase: Vendor & BAA register

    Every vendor that touches patient data, what it handles, and the status of its Business Associate Agreement (BAA).

  4. 04, Assess phase: Risk analysis, register & treatment plan

    Every identified risk to electronic protected health information (ePHI), rated by likelihood and impact, with an owner and a treatment decision.

  5. 05, Document phase: Policies & procedures

    Privacy notices and security policies covering access control, encryption, backup and recovery, and vendor management, written for how you operate.

  6. 06, Document phase: Incident & breach response plan

    Detection, investigation, containment, breach assessment and notification steps, with named roles.

  7. 07, Implement phase: Safeguard & access-control evidence

    Configurations, access reviews and logs showing the technical safeguards are live and working.

  8. 08, Train phase: Training records

    Role-based training and security awareness completions, plus phishing simulation results, dated and attributed.

  9. 09, Validate phase: Penetration test & mock audit results

    Penetration test results, the mock audit report and a remediation log showing each finding closed.

Illustrative example, not client data

What one risk register entry looks like

Risk
Database snapshots stored without encryption
Systems
Production database backups in the cloud account
Likelihood / impact
Medium / High
Owner
Head of Engineering
Treatment
Enable encryption at rest; limit snapshot access to two named admins
Evidence
Encryption setting export and a dated access review record
Common misconceptions

Four common HIPAA misconceptions

Each one is common, reasonable, and the reason gaps show up late.

Assumption 01

Assumption: Our cloud provider is HIPAA compliant, so we are.

What actually applies

The provider’s compliance covers its own part. Your configuration, access controls and data handling stay your responsibility. If you are a business associate, the provider is your subcontractor, so you need a Business Associate Agreement (BAA) with it, tracked in your vendor and BAA register.

Assumption 02

Assumption: We have SOC 2 or ISO 27001, so we’re covered.

What actually applies

System and Organization Controls 2 (SOC 2) and ISO/IEC 27001 give you a head start, but HIPAA adds requirements of its own: a risk analysis focused on patient data, BAAs with each vendor that touches it, breach procedures, and limits on how protected health information (PHI) is used. We map your existing controls so you don’t do the work twice.

Assumption 03

Assumption: It’s only a breach if data was stolen.

What actually applies

Any use or disclosure the rules don’t permit, involving unsecured PHI, is presumed to be a breach, unless a documented risk assessment shows a low probability that the data was compromised. PHI encrypted to the standard HHS sets is not “unsecured”, so it falls under the safe harbor and does not trigger notification. That is why encryption evidence matters.

Assumption 04

Assumption: All health data in our app is HIPAA data.

What actually applies

Not necessarily. HIPAA covers PHI handled by or for a covered entity. Health data that consumers give your app directly, outside that relationship, may fall outside HIPAA, though the Federal Trade Commission’s Health Breach Notification Rule and state privacy laws can still apply. The scope assessment separates the data flows HIPAA covers from those it doesn’t.

Heard one of these from your team or a vendor? A HIPAA risk assessment shows what actually applies to you.

Get a HIPAA risk assessment

What you can hold us to.

We don't publish client logos or case studies; we keep our clients' security posture private. These are the commitments we make instead.

Our commitments

  • Experienced practitioners lead

    Every engagement is led by experienced practitioners.

  • Peer review

    Every deliverable is peer-reviewed before it reaches you.

  • Written scope and change control

    You know what is covered, and what happens if scope changes, before work starts.

  • Controls your team can run

    Policies and controls built for how you operate, that your team can maintain after we leave.

As a healthcare provider, HIPAA compliance is non-negotiable. Auditify Security's team helped us understand the complexities of HIPAA regulations and provided valuable support in securing our systems.
David MarkHealthcare IT Director

Want to speak to a client? Ask for a reference while we scope your work and we'll arrange it directly.

Ask for a reference

HIPAA questions buyers ask

Is there a HIPAA certification?

No. HIPAA has no official certificate.

No government body certifies HIPAA compliance, and any “HIPAA certified” badge is a private claim. HIPAA is an obligation you meet and can prove: with a documented risk assessment, written policies, safeguards in operation, training records and signed Business Associate Agreements (BAAs). Our binder organizes that evidence so an assessor or hospital can review it.

Didn't see your question? Ask us
HIPAA guide library · 17 guides

HIPAA, and where it meets other frameworks.

Our in-depth HIPAA guide, plus the guides that answer what buyers ask next: how SOC 2 and GDPR relate to HIPAA, and how breach clocks compare.

Browse every compliance guide in the Resources library
Next steps

Know where your patient data is, and what you can prove.

  1. Send the basics

    Which systems handle patient data, which vendors touch it, and roughly how big your team is.

  2. We scope the work

    We respond within 24 hours, then agree the scope with you in writing.

  3. Your HIPAA risk assessment

    You get a written security risk assessment and a remediation roadmap, ordered by risk.

Get a HIPAA risk assessmentBook a free consultation
US healthcare providers:
a Security Risk Assessment and a roadmap to fix the gaps.
Healthtech and IT vendors:
BAA review and questionnaire-ready evidence.

We assess and document your HIPAA program. We do not give legal advice; ask your counsel to confirm how the law applies to your contracts.