Frameworks / HIPAA

HIPAA safeguards for companies that handle patient data.

The HIPAA Security Rule applies to covered entities and to their business associates: the vendors that create, receive, maintain, or transmit electronic protected health information for them. There is no official HIPAA certification. Companies show compliance through their safeguards, a documented risk analysis, and often an independent assessment.

164.308

Administrative safeguards

164.310

Physical safeguards

164.312

Technical safeguards

60 days

Outer limit for breach notification

Sources: 45 CFR Part 164, Subparts C and D; HHS guidance. Status as of October 2026.

How we help

Safeguards in your systems, with the records to show it.

We start with the risk analysis the rule requires, then put the safeguards it points to into your systems: access control, audit logging, integrity and transmission protections, encryption, contingency planning, and workforce procedures. Addressable specifications are not optional. You implement each one, or you document why it isn’t reasonable and appropriate and put an equivalent alternative in place where one exists.

When a customer wants third-party assurance, we prepare you for an independent assessment, or for a SOC 2 report with HIPAA mapped into it, performed by a firm you choose.

The Security Rule

What the rule requires.

Administrative

§ 164.308 · 9 standards

Physical

§ 164.310 · 4 standards

Technical

§ 164.312 · 5 standards

Documentation

§ 164.316 · 2 standards

Administrative§ 164.308 · 9 standards

Physical§ 164.310 · 4 standards

Technical§ 164.312 · 5 standards

Documentation§ 164.316 · 2 standards

45 CFR Part 164, Subpart C (§§ 164.308–164.316). One cell per standard; select any standard for its definition.

HHS proposed an update to the Security Rule in January 2025. As of October 2026 it has not been finalized, and HHS lists it as a long-term action with a target of July 2027. The current rule remains in force.

Common questions

HIPAA questions.

Is there a HIPAA certification?

No. HHS does not endorse or recognize private “HIPAA certifications.” What customers can review is your risk analysis, your policies, and an independent assessment of your safeguards.

Does HIPAA apply to us as a vendor?

If you create, receive, maintain, or transmit electronic protected health information for a covered entity, you are a business associate. The Security Rule applies to you directly, and you will sign a business associate agreement.

What happens after a breach?

Covered entities notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Business associates notify the covered entity on the same timeline. We help you build the incident process that makes that possible.

Does SOC 2 cover HIPAA?

Partly. Many SOC 2 controls support Security Rule safeguards. HIPAA also requires things a SOC 2 alone does not address, such as the documented risk analysis and business associate agreements.

Healthcare customer asking about HIPAA?

On a scoping call we’ll tell you what the rule requires of you and what your customer will want to see.

Book a scoping call