Privacy & AI · Health Insurance Portability and Accountability Act
Issued by
US Department of Health & Human Services
Typical timeline
8-12 weeks
Assessed by
Third-party assessment
Validity
Ongoing obligation
Overview
Who needs HIPAA?
- 01Health-tech and digital health platforms
- 02Business associates handling ePHI
- 03Providers, payers and clearinghouses
Requirements
What the auditor looks for.
- 01Risk analysisAn accurate and thorough assessment of risks to ePHI.
- 02SafeguardsAdministrative, physical and technical safeguards under the Security Rule.
- 03Business associate agreementsContracts with every vendor handling ePHI.
- 04Breach notificationProcedures for notifying individuals, HHS and, in some cases, media.
Our approach
From scoping to auditor sign-off.
Customer story
FAQ
Questions, answered.
No. HHS does not certify compliance. Buyers typically accept an independent HIPAA assessment, often delivered alongside a SOC 2 report that includes HIPAA mapping.
Typical timeline: 8-12 weeks, depending on scope, maturity and team availability. We'll give you a firm plan after a two-week scoping and gap assessment.
Yes, that's our specialty. HIPAA shares substantial control overlap with SOC 2 and ISO 27001, so we build one control set and map evidence across all of them.
Next framework
PDPA
End of the thread
A 30-minute call with a senior practitioner. You leave with a plan either way.
We handle audit readiness and auditor coordination. Your SOC reports and ISO certificates are always issued by independent, accredited auditors.