← ComplianceUS regulation

Patient data
is not a thing
you improvise.

HIPAA at a glance
Type
US federal law — enforced by HHS OCR
Certification
None exists officially. Be sceptical of sellers
Applies to
Covered entities and their business associates
Core rules
Privacy, Security, Breach Notification
Mandatory
A documented, current risk analysis
What it actually is

HIPAA, without the sales gloss.

HIPAA is United States federal law protecting individually identifiable health information. It binds covered entities — providers, plans and clearinghouses — and, just as importantly, their business associates: the software vendors, hosting providers and processors who touch protected health information on their behalf. If you sell software to a hospital, this is you.

There is no government HIPAA certification and no official certificate. Anyone selling you one is selling their own opinion. What genuinely exists is a compliance programme built against the Security Rule's administrative, physical and technical safeguards, the Privacy Rule's use and disclosure limits, and the Breach Notification Rule — plus independent third-party validation that your programme meets them.

The Security Rule requires a documented risk analysis, and it is the first thing regulators ask for after an incident. Most enforcement actions we read about are not exotic attacks; they are organisations that never did the risk analysis, or did one once and filed it away.

When you need it

Any one of these is enough.

  • A hospital, payer or provider has sent you a Business Associate Agreement
  • You are building health software that touches patient data
  • A customer's security review has asked how you meet the Security Rule
  • You had an incident and need to know your breach notification duties
  • You are a business associate who signed a BAA without a programme behind it
How long it takes

The route to HIPAA.

Typical spans for a company starting from a normal engineering baseline. Your scoping call replaces these with real dates.

Weeks 1–2
Scope & data mapping
Where PHI enters, lives, moves and leaves. You cannot safeguard data you cannot locate.
Weeks 2–4
Security Rule risk analysis
The mandatory one. Documented to the standard a regulator would expect to see after an incident.
Weeks 4–10
Safeguards & policies
Administrative, physical and technical safeguards implemented. Policies, BAAs and workforce training issued.
Weeks 10–14
Validation
Independent third-party assessment against the rules, so you have something to hand a customer.
Ongoing
Maintain
Risk analysis refreshed, training renewed, BAAs tracked, incidents triaged against the notification clock.
What lands in your hands

Deliverables, not a slide deck.

PHI data map

Every system, flow and sub-processor that touches protected health information.

Security Rule risk analysis

Documented, current, and written to survive regulator scrutiny.

Risk management plan

Findings ranked, owners assigned, remediation tracked to closure.

Policy & procedure set

Privacy, Security and Breach Notification, plus sanctions and workforce clearance.

BAA templates & register

Agreements for both directions, and a register of who you have signed with.

Independent validation

Third-party assessment and attestation letter you can send to customers.

Packages

Three ways in.

Readiness
Scoped on the call
one-off

You need to know exactly how far you are, and what it will cost to close the gap.

  • Scoping workshop — systems, people and data in scope
  • Gap assessment against every applicable control
  • Written policy pack, tailored, not templated
  • Evidence map: what to collect, from where, how often
  • Remediation plan with owners and dates
  • Readout with your leadership team
Talk it through
Certification
Most chosen
Scoped on the call
to report

You have a deal, a customer or a board deadline and you need the report in hand.

  • Everything in Readiness
  • Hands-on control implementation with your engineers
  • Evidence collection run by us, not homework for your team
  • Auditor selection from our partner panel, plus fee negotiation
  • We sit in the audit and answer the auditor's questions
  • Findings triaged and closed through to clean report
Start here
Managed
$3,000
from · per month

You are certified and you want to stay that way without hiring a compliance team.

  • Everything in Certification
  • Continuous control monitoring and evidence capture
  • Annual surveillance audits and re-certification managed end to end
  • Vendor and sub-processor risk reviews
  • Security questionnaires and customer due-diligence answered for you
  • Named compliance lead on your Slack
Talk it through

Every engagement is quoted as two separate numbers: our fee, and the external auditor's fee. We negotiate theirs on your behalf and never bundle the two into one price.

HIPAA questions

Straight answers.

Is there such a thing as HIPAA certification?
Not officially. HHS does not certify, endorse or accredit anyone for HIPAA, and no certificate confers compliance. What is real and useful is a documented compliance programme plus independent third-party validation that it meets the Security and Privacy Rules. That is what we deliver, and we will not dress it up as something it isn't.
We are a software vendor, not a hospital. Does HIPAA apply?
Almost certainly yes, as a business associate. If you create, receive, maintain or transmit protected health information on behalf of a covered entity, the Security Rule applies to you directly and you will be asked to sign a Business Associate Agreement. Signing a BAA without a programme behind it is a liability, not a formality.
What is a risk analysis and do we really need one?
It is a documented assessment of risks to the confidentiality, integrity and availability of the PHI you hold. It is explicitly required by the Security Rule, not optional, and it is the first document requested when something goes wrong. It also has to be kept current — a risk analysis from three years ago and two architectures back does not count.
How does HIPAA relate to SOC 2?
They overlap heavily in the technical controls and barely at all in obligation. SOC 2 is a voluntary report your customers ask for; HIPAA is law that applies whether anyone asks or not. Many of our health-tech clients run both together, because the control work is shared and the SOC 2 report becomes the artefact they hand to procurement.
Can you help after a breach?
Yes. Breach notification runs on a legal clock, and the assessment of whether an incident is a notifiable breach needs to be documented properly. Tell us on the call if this is live and we will treat it as urgent rather than putting it through a normal scoping cycle.
Often needed alongside

Rarely just one framework.

Attestation report

SOC 2

The report North American enterprise buyers ask for before they sign. Type I proves your controls are designed right; Type II proves they actually ran.

SaaS and B2B software selling into US enterprise
SOC 2 in detailCertification

ISO 27001

The international standard for running an information security management system. The certificate European and global enterprise buyers recognise on sight.

Companies selling internationally, especially into Europe
ISO 27001 in detailEU regulation

GDPR

The EU's data protection regulation. It applies by where your users are, not where your company is — which catches more companies than expect it.

Anyone with users, customers or staff in the EU or UK
GDPR in detail

Get HIPAA scoped properly.

Thirty minutes, a founder on the line, and an honest read on scope, sequence and the date you can realistically promise your customer.

Book a scoping callcontact@binaryvlue.com