HIPAA Compliance
HIPAA governs how protected health information is handled by US healthcare organisations and the suppliers that serve them.
- Standard
- HIPAA
- Indicative timeline
- 8-14 weeks, depending on scope and readiness
- Discipline
- Compliance & Security
- Assessment type
- Independent third-party assessment
The standard
Overview
HIPAA is United States federal law governing protected health information. The Privacy Rule limits how it may be used and disclosed. The Security Rule requires administrative, physical and technical safeguards for electronic protected health information, through required and addressable implementation specifications. The Breach Notification Rule sets who must be told after an incident and when. The HITECH Act made business associates directly liable, so suppliers are accountable in their own right.
Enforcement sits with the HHS Office for Civil Rights. For a UK organisation the obligations usually arrive through a business associate agreement with a US covered entity. That agreement commits you to specific safeguards, breach reporting timescales and subcontractor terms.
UKCert assesses your handling of protected health information against the Privacy, Security and Breach Notification Rules, starting with the risk analysis the Security Rule requires. There is no government-recognised HIPAA certificate; you receive an independent assessment report against the rules.
Who this is for
- Health technology suppliers serving US providers or payers
- Medical billing, coding and revenue cycle firms
- Clinical research organisations handling US patient data
- Cloud, hosting and support providers with access to ePHI
- Outsourcing and transcription firms under a business associate agreement
What it gives you
Why organisations certify
What a certified HIPAA assessment gives you once the certificate is issued.
Business Associate Ready
Agreements with US covered entities carry specific obligations. An assessment confirms you can meet them before signing, rather than exposing the gap after an incident.
Risk Analysis Complete
The Security Rule requires an accurate risk analysis covering all electronic protected health information. Missing or superficial analysis is the finding most often cited in enforcement.
Access Restricted Properly
Access to protected health information is limited to what each role needs, with authorisation, review and termination steps recorded under the minimum necessary standard.
Breach Duties Clear
Notification duties, the sixty-day outer limit and the separate route for incidents affecting five hundred or more individuals are set out with owners named in advance.
Subcontractors Covered
Downstream suppliers touching protected health information are identified and brought under written agreements, so obligations flow through the chain rather than stopping with you.
US Contracts Supported
American healthcare buyers ask how a non-US supplier meets HIPAA. A documented assessment answers procurement and security review with specifics instead of assurances.
Scope
What the assessment covers
The areas an assessor works through. Your final scope is confirmed in writing before any audit is booked.
- Security Rule risk analysis and risk management plan
- Administrative, physical and technical safeguards
- Privacy Rule uses and disclosures review
- Minimum necessary standard and role-based access
- Business associate agreements and subcontractor flow-down
- Breach notification procedures and incident log
- Workforce training and sanction policy
- Audit controls, encryption and contingency planning
How it runs
The assessment, stage by stage
From first enquiry to certificate. Each stage is agreed with you before it starts.
-
Scope and Data Flows
We establish where protected health information enters, moves and rests across your systems and staff, and confirm whether you act as a covered entity, business associate or subcontractor.
-
Risk Analysis
The Security Rule risk analysis is carried out or reviewed: assets holding electronic protected health information, threats, vulnerabilities, likelihood, impact and current safeguards, all documented.
-
Rule-by-Rule Review
Controls and documents are tested against the Privacy, Security and Breach Notification Rules, including each addressable specification and the reasoning where an alternative has been adopted.
-
Agreements and Training
Business associate agreements, subcontractor terms, workforce training records and the sanction policy are checked against what the rules require them to cover.
-
Remediation Plan
Findings are set out with the citation, the risk and the corrective action, sequenced so the highest exposure and any missing required implementation specification is dealt with first.
-
Assessment Report
You receive an independent report and a written statement describing the assessment performed, which can be shared with US clients during procurement. Reassessment is normally annual.
Questions
HIPAA — frequently asked
Anything here that does not cover your situation, put it to an assessor rather than guessing at it.
Same discipline
Other schemes in Compliance & Security
Certifying against more than one standard?
Where you hold several standards, shared clauses are assessed once in a combined visit rather than as separate audits. Talk it through with an assessor before you decide what HIPAA should sit alongside.