Menu
HIPAA
Bottom line
HIPAA is a US federal law, not a certification. No HIPAA certificate exists; compliance is a continuous legal obligation enforced by HHS Office for Civil Rights. Third-party risk assessments run $4K–$60K over 2–8 weeks for covered entities and business associates.
One of 10 compliance framework explainers we maintain.
Key facts
- Controls
- 3 rules (Privacy, Security, Breach Notification). Security Rule: 18 standards and 36 implementation specifications across Administrative, Physical, and Technical safeguards.
- Recertification cycle
- Continuous legal obligation (no expiry)
- Ongoing oversight
- OCR complaint-driven investigations and periodic audit programs
- Common gap categories
- Risk analysis (§164.308(a)(1)); Access controls (§164.312(a)); Audit controls (§164.312(b)); Business Associate Agreements (§164.308(b)); Workforce training (§164.308(a)(5))
- Related standards
- HITRUSTNIST SP 800-66HITECH ActSOC 2
What is HIPAA?
A US federal law (enacted 1996, with the HITECH Act in 2009 and Omnibus Rule in 2013; Security Rule overhaul proposed January 2025) administered by HHS Office for Civil Rights, scoped to covered entities and business associates that handle protected health information (PHI).
Is HIPAA a certification or an attestation?
There is no HIPAA certification. OCR issues no certificate and no accreditation body confers one. Compliance is a continuous legal obligation demonstrated through risk analyses, policies, and controls. Organizations undergo third-party assessments, not certifications.
Who needs HIPAA?
Any software vendor, cloud provider, or service company that handles, stores, or transmits PHI on behalf of a healthcare provider, health plan, or clearinghouse. Triggered by a Business Associate Agreement (BAA) requirement.
What does HIPAA cost and how long does it take?
Range
$4K–$60K assessment / 2–8 weeks
Third-party risk assessment $4K–$60K over 2–8 weeks. Total first-year compliance build (policies, controls, tools) typically $10K–$50K for mid-size companies.
Source: HHS OCR: HIPAA Audit Program ↗
One thing to watch
HITRUST is the closest market analog to a formal HIPAA certification and is a separate, optional framework. Vendors who say they are HIPAA certified usually mean HITRUST.
Sources
Last verified 2026-05-13. Found a stale or wrong source? Email hello@soc2auditors.org.