HIPAA Certification and Compliance Services for Covered Entities and Business Associates
There is no official HIPAA certification, but there is a way to prove compliance. We run your HIPAA risk analysis, review your safeguards and vendors, and hand you the evidence healthcare customers and auditors ask for. Most programs take 6–12 weeks.
Page reviewed 28 September 2026 by the Accredify Global compliance team.
What Do HIPAA Compliance Services Cover?
HIPAA compliance services help a covered entity or business associate show, with records, that it protects health information the way the HIPAA Privacy, Security, and Breach Notification Rules require. The foundation is a documented risk analysis, which the Security Rule requires of every organization handling electronic protected health information.
In practice that means knowing where protected health information (PHI) lives and who can reach it, including vendors and their subcontractors. It also means safeguards that work on a busy day, not just on paper, and records that prove it. Accredify Global leads the risk analysis, safeguards review, remediation planning, and evidence program with your team, then reports where you stand.
We work with US healthcare organizations and health technology vendors from our headquarters in Dallas–Fort Worth, Texas.
Is There a HIPAA Certification? What HHS Says, and What's Changing
No government body issues or recognizes a HIPAA certification for organizations. HHS says no HIPAA standard requires you to certify compliance, and that it does not endorse or recognize private organizations' certifications. What the Security Rule does require is a risk analysis and periodic evaluations of your safeguards, which can be done by your own team or an outside firm.
Many searches for "HIPAA certification" are really about workforce training. HIPAA requires staff training, and course providers issue completion certificates for it. Those certificates show that someone completed a course. They don't show that an organization is compliant. For that, you need a current risk analysis, working safeguards, and evidence, which is what our program delivers.
The rules are also changing. HHS proposed a major update to the Security Rule in January 2025, including stricter requirements for encryption, multi-factor authentication, and asset inventories. It is not final yet, and HHS's regulatory agenda now targets July 2027. Separately, covered entities had to update their Notice of Privacy Practices by 16 February 2026 to reflect new substance use disorder record protections.
Sources: HHS certification FAQ · Security Rule timing (Clark Hill) · 2026 HIPAA changes (HIPAA Journal)
Who Needs HIPAA Compliance Services, and When?
HIPAA work usually starts when a hospital customer sends a security questionnaire, a vendor relationship raises questions, or leadership asks for a clear answer on where the organization stands.
Healthcare providers, health plans, and clearinghouses formalizing their risk analysis and safeguards governance, or updating a risk analysis that no longer matches their systems.
SaaS, billing, IT, and support vendors that handle PHI for a covered entity and must meet the Security Rule directly, under a business associate agreement.
Vendors of your vendors that touch PHI are business associates too. Many organizations have never mapped who those subcontractors are.
Hospital and payer procurement teams increasingly want a recent risk analysis, policies, and evidence before a contract is signed.
When answers aren't backed by documents, every questionnaire becomes a new project. A documented program turns them into one evidence pack.
Teams running SOC 2, ISO 27001, or HITRUST that want HIPAA obligations mapped to the controls they already operate.
How Our HIPAA Compliance Program Works
A free scope review, then five delivery phases. We trace real events through your systems and vendors, so findings reflect how PHI actually moves.
Not sure your last risk analysis still matches your systems and vendors? A free scope review tells you where to start.
Book a free HIPAA scope reviewWhat Makes Our HIPAA Compliance Services Different
The questions healthcare teams ask most when comparing HIPAA compliance providers, answered upfront.
We pick real events, such as a patient updating their phone number, a support ticket, or an after-hours record access, and trace them through people, systems, and vendors. That's where gaps show up that a policy review alone would miss.
We run the HIPAA workstream, the control review, and the evidence plan. Where legal interpretation or specialist healthcare privacy input is needed, we bring it into the same project plan instead of handing you a second vendor to manage.
Each gap is written in plain language with a recommended fix and an owner on your side, so remediation starts the week the report lands.
What Our HIPAA Risk Assessment Actually Evaluates
OCR's enforcement keeps returning to the same point: a missing or outdated risk analysis. We test each area below against what really happens.
Risk analysis & risk management
An accurate, thorough assessment of risks to ePHI across every system and vendor, and a plan that reduces them (§164.308(a)(1)).
Access & emergency access
Unique user access, role-based permissions, and an emergency access procedure that is reviewed after it is used (§164.312(a)).
Audit controls & activity review
Logs that record who accessed ePHI, and a regular, documented review of that activity (§164.312(b), §164.308(a)(1)).
Business associates & subcontractors
Business associate agreements for every vendor handling PHI, and a clear view of which subcontractors can reach it (§164.308(b), §164.502(e)).
Patient rights & communications
Access requests, amendments, and confidential communications handled correctly, with patient contact details kept accurate across systems (§164.522, §164.524).
Breach response
A tested process to assess incidents and notify patients, HHS, and where required the media, within the deadlines (§§164.400–414).
HIPAA obligations, at a glance
- Privacy Rule — permitted uses and disclosures, minimum necessary, Notice of Privacy Practices, and patient rights
- Security Rule — administrative, physical, and technical safeguards for electronic PHI, starting with risk analysis
- Breach Notification Rule — notice to patients within 60 days, and to HHS on a timeline set by breach size
- Business associates — directly liable under HIPAA since 2013, and required to flow terms down to subcontractors
- Training and documentation — workforce training, and policies and records kept for six years
HIPAA penalties in 2026
| Culpability tier | Per violation |
|---|---|
| Lack of knowledge | $145 – $73,011 |
| Reasonable cause | $1,461 – $73,011 |
| Willful neglect, corrected | $14,602 – $73,011 |
| Willful neglect, not corrected | $73,011 – $2,190,294 |
Inflation-adjusted amounts effective 28 January 2026. Annual caps per violation type range up to $2,190,294, and OCR still applies lower caps to the first three tiers under its 2019 enforcement discretion. Source: HIPAA Journal.
What Clients Found in Their HIPAA Assessment
Three healthcare technology clients describe a gap the assessment surfaced, and what they changed as a result.
“A patient told us that appointment reminders were still going to a family member’s old phone number. We had a process for updating contact details, but the change in our patient system was not reaching the reminder platform. During the HIPAA review, Accredify Global followed that data from registration to the vendor and examined how our staff handled the complaint. We fixed the connection between the two systems and changed the check our front desk performs when a patient updates their number.”
“We knew our support vendor could see limited patient information while resolving tickets. What we had not documented clearly was which of its subcontractors could also access that information. Accredify Global asked us to trace one support case, including the people and systems involved. That gave our privacy team a concrete reason to review the vendor arrangement and tighten the access we had authorized.”
“Our clinicians sometimes need urgent access to a patient record outside normal hours. The HIPAA assessment looked at one of those events from the access request through the next day’s review. We could show why the clinician needed the record, but we could not show that anyone had checked the emergency access afterward. Accredify Global described the gap plainly, and we assigned that review to a named member of our clinical operations team.”
HIPAA Compliance Cost and Timeline
HIPAA compliance doesn't have a list price, because the effort depends on how many systems, locations, and vendors handle PHI, and how much evidence already exists. A free scope review gives you a tailored proposal for your actual scope.
What sets the scope (and fee)
- Number of systems, applications, and locations that store or process PHI
- Whether you are a covered entity, a business associate, or both
- Number of business associates and subcontractors to review
- Workforce size and the number of roles with PHI access
- How much documentation and control evidence already exists, for example from SOC 2 or ISO 27001
Typical program timeline
| Typical end-to-end program | 6–12 weeks |
|---|---|
| Toward the shorter end | Few systems, a recent risk analysis, policies in place |
| Toward the longer end | Many locations or vendors, or no current risk analysis |
Timing depends on scope, control maturity, and how quickly evidence is available. We confirm it in your proposal.
HIPAA vs HITRUST, SOC 2, ISO 27001, and ISO 27701
Healthcare buyers often ask for more than one of these. Here's what each is, and whether it produces a certificate or report.
| Framework | What it is | How it relates to HIPAA |
|---|---|---|
| HIPAA | US federal law for protected health information; no official certification | The legal obligation itself. Compliance is shown through a risk analysis, safeguards, agreements, and records. |
| HITRUST | Certifiable security framework widely used in US healthcare | Maps to HIPAA safeguards and gives healthcare buyers a recognized certificate. |
| SOC 2 | CPA attestation report on security and related controls | Can include a HIPAA mapping, and answers many security questions in vendor reviews. |
| ISO 27001 | Certifiable information security management system | Covers much of the Security Rule, but not HIPAA's privacy, patient-rights, or breach notification requirements. |
| ISO 27701 | Certifiable privacy information management system | Adds privacy controls on top of security, useful for organizations handling both US health data and EU personal data. |
How to Choose a HIPAA Compliance Services Provider
The questions worth asking any HIPAA provider before you sign, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Will we get a HIPAA certificate? | No, and be careful with anyone who says their certificate makes you HIPAA compliant. You get a documented risk analysis, safeguards review, and evidence pack. |
| Do you support business associates as well as covered entities? | Yes. We tailor the program to your role, data, systems, and contractual obligations. |
| Do you replace our legal counsel? | No. Where legal interpretation is needed, we coordinate with your counsel or specialist privacy advisers and keep the workstream moving. |
| Do you test real processes, or only review documents? | Both. We trace real events, such as a records update, a vendor support case, or emergency access, through people and systems. |
| How is it priced? | By scope, after a free scope review. You receive a tailored proposal with timeline guidance before any work starts. |
| How long will it take? | Most programs take 6–12 weeks, depending on scope, control maturity, and available evidence. |
| What do we have at the end? | A remediation tracker, risk analysis support, a documentation pack, and a leadership-ready compliance summary. |
What You Receive
Your HIPAA position today, with a prioritized remediation tracker and an owner for each action.
Support for your Security Rule risk analysis and a review of administrative, physical, and technical safeguards.
Policies and procedures checked against how work is actually done, with the evidence to back them.
Guidance on business associate agreements, subcontractor access, and vendor monitoring.
An organized evidence set for customer due diligence, internal review, and audit readiness.
A plain-language HIPAA compliance report your leadership and healthcare customers can act on.
Frequently Asked Questions About HIPAA Certification and Compliance
Straight answers on certification, risk analysis, cost, timelines, penalties, breaches, and business associates.
Is there an official HIPAA certification?
No. HHS states that no HIPAA standard requires an organization to certify its compliance, and it does not endorse or recognize private organizations' HIPAA certifications. Organizations show compliance with a documented risk analysis, working safeguards, business associate agreements, and records, not with a certificate.
What does "HIPAA certified" mean?
It usually means one of two things. For individuals, it means someone completed a HIPAA training course and received a completion certificate. For organizations, it is marketing shorthand for having passed a third-party HIPAA assessment. Neither is a government certification, and neither guarantees compliance on its own.
What are HIPAA compliance services?
HIPAA compliance services help covered entities and business associates meet the HIPAA Privacy, Security, and Breach Notification Rules and prove it. Accredify Global's program covers scoping of regulated data, risk analysis support, a safeguards review, remediation planning, business associate oversight, an evidence pack, and a leadership-ready compliance report.
What is a HIPAA risk assessment, and is it required?
A HIPAA risk assessment, called a risk analysis in the Security Rule, is an accurate and thorough assessment of the risks to the confidentiality, integrity, and availability of electronic protected health information. It is required for every covered entity and business associate under 45 CFR 164.308(a)(1), and a missing or outdated risk analysis is one of the most common findings in OCR enforcement actions.
How often should a HIPAA risk analysis be updated?
The current Security Rule does not set a fixed frequency. It requires the risk analysis to stay accurate, so it must be revisited when systems, vendors, or operations change, and many organizations review it annually. The Security Rule update HHS proposed in January 2025 would require a review at least every 12 months.
How much does HIPAA compliance or certification cost?
There is no fixed price, because effort depends on scope: the number of systems and locations handling PHI, whether you are a covered entity or business associate, how many vendors and subcontractors need review, workforce size, and how much evidence already exists. Accredify Global reviews your scope for free and sends a tailored proposal with timeline guidance.
How long does it take to become HIPAA compliant?
Most of Accredify Global's end-to-end HIPAA compliance programs take 6 to 12 weeks, depending on scope, control maturity, and available evidence. Organizations with few systems and a recent risk analysis sit toward the shorter end; many locations or vendors, or no current risk analysis, sit toward the longer end.
How long does a HIPAA certification last?
There is no official HIPAA certification, so there is no official expiry. Training completion certificates are typically refreshed annually or when policies change. For organizations, compliance is ongoing: the risk analysis, safeguards, and business associate agreements must stay current as systems and vendors change.
Who has to comply with HIPAA?
Covered entities, meaning healthcare providers that bill electronically, health plans, and healthcare clearinghouses, must comply. So must their business associates, meaning vendors that create, receive, maintain, or transmit protected health information on their behalf, and those vendors' subcontractors that handle the same information.
Do subcontractors of business associates have to comply with HIPAA?
Yes. Since the 2013 Omnibus Rule, a subcontractor that creates, receives, maintains, or transmits protected health information for a business associate is itself a business associate. It needs a business associate agreement with the vendor it works for and must meet the Security Rule directly.
What are the penalties for HIPAA violations in 2026?
From 28 January 2026, inflation-adjusted civil penalties range from $145 to $73,011 per violation in the lower tiers, and up to $2,190,294 per violation for uncorrected willful neglect, with annual caps per violation type of up to $2,190,294. OCR also applies lower annual caps to the first three tiers under its 2019 enforcement discretion. Criminal penalties can apply to knowing misuse of health information.
How quickly must a HIPAA breach be reported?
Affected individuals must be notified without unreasonable delay and no later than 60 calendar days after the breach is discovered. Breaches affecting 500 or more people must also be reported to HHS within 60 days, and to prominent media when more than 500 residents of a state or jurisdiction are affected. Smaller breaches are reported to HHS within 60 days of the end of the calendar year.
How long do we have to respond to a patient's request for their records?
Under the current Privacy Rule, a covered entity must act on an access request within 30 calendar days, with one 30-day extension if it tells the patient in writing why more time is needed. HHS has proposed shortening this to 15 days, so it is worth checking the status of that change.
Is the HIPAA Security Rule changing?
HHS proposed a major Security Rule update in January 2025, including stronger requirements for encryption, multi-factor authentication, asset inventories, and regular testing. As of September 2026 it is not final, and HHS's regulatory agenda targets July 2027 for final action. The current Security Rule remains fully enforceable.
Do we need HIPAA, HITRUST, or SOC 2?
HIPAA is a legal obligation if you handle protected health information as a covered entity or business associate. HITRUST and SOC 2 are voluntary ways to give customers independent assurance: HITRUST is a certification widely recognized in US healthcare, and a SOC 2 report can include a HIPAA mapping. Many health technology vendors need HIPAA compliance plus one of the two.
Can you support business associates as well as covered entities?
Yes. Accredify Global tailors the HIPAA program to your role, depending on the data, systems, and contractual obligations involved, and supports organizations that are both a covered entity and a business associate.
Does Accredify Global replace our legal counsel?
No. Accredify Global leads the risk analysis, safeguards review, remediation planning, and evidence program. Where legal interpretation or specialist healthcare privacy input is needed, we coordinate with your counsel or specialist advisers while keeping one managed delivery path.
Which company can help a healthcare SaaS vendor prove HIPAA compliance to hospital customers?
Look for a provider that will map how PHI moves through your product, support staff, and subcontractors, document your risk analysis and safeguards, review your business associate agreements, and give you evidence hospital procurement teams accept. Accredify Global, headquartered in Dallas–Fort Worth, Texas, delivers this as a 6–12 week program and can map it to SOC 2, ISO 27001, or HITRUST controls.
Know Where Your PHI Goes Before a Customer or Regulator Asks
Tell us what health information you handle, which systems and vendors touch it, and which customer or contract is driving the question. We'll recommend a program and timeline and send a tailored proposal.
Book your free HIPAA scope review →