HIPAA
HIPAA compliance you can show a hospital’s security team
Health systems and payers send a security questionnaire and a business associate agreement before they share patient data. We build the risk analysis, safeguards and records behind your answers.
At a glance
TypeUS federal law, no certification
Enforced byHHS Office for Civil Rights (OCR)
Best forBusiness associates and covered entities handling ePHI
Typical readinessDepends on scope and maturity
Overview
What it is
The HIPAA Security Rule requires covered entities and their business associates to protect electronic protected health information (ePHI) with administrative, physical and technical safeguards. The first document OCR asks for in an investigation is the risk analysis required by 45 CFR 164.308(a)(1), and a missing or outdated one is the most frequent finding in its settlements.
There is no official HIPAA certification. Customers accept evidence instead: a current risk analysis, policies, training records, signed BAAs and, more and more often, a SOC 2 report mapped to HIPAA or a HITRUST certification. HHS proposed a major update to the Security Rule in January 2025. It is not final, and we track it so your program is ready if it lands.
You need this if…
- A health system or payer sent you a security questionnaire or a BAA
- You store or process ePHI and have never done a formal risk analysis
- Your risk analysis is more than a year old or doesn’t cover systems you added since
- You want SOC 2 and HIPAA from one control set
The Lightwork Method
How we get you there
01
Scoping
Find where ePHI lives and moves: applications, cloud services, backups, laptops, vendors.
02
Risk analysis
A documented analysis under 164.308(a)(1) with threats, likelihood, impact and named risk owners.
03
Safeguard review
Every required and addressable safeguard checked against what you actually run.
04
Remediation
Close gaps in access control, audit logging, encryption, contingency planning and training.
05
Business associates
BAA inventory, subcontractor flow-downs and breach notification terms.
06
Ongoing compliance
Annual risk analysis refresh, policy reviews and incident drills.
Deliverables
What you walk away with
- HIPAA risk analysis and risk management plan
- Safeguard gap report mapped to 45 CFR 164.308–316
- Policies and procedures, including breach notification
- Workforce training and sanction records
- BAA register and vendor reviews
- Answer library for health-customer questionnaires
Timeline & pricing
Pricing depends on where ePHI lives and how many systems are in scope. Contact us for a fixed-price proposal.
A first risk analysis and safeguard review usually takes a few weeks. Remediation time depends on what the analysis finds.
We will give you a realistic timeline after scoping.
Can you certify us as HIPAA compliant?
Nobody can. HIPAA has no official certification, and a “HIPAA certified” badge is a vendor’s own label. We help you build and document compliance, and point you to SOC 2 or HITRUST when customers want independent assurance.
HIPAA, SOC 2 or HITRUST?
HIPAA is the legal obligation. A SOC 2 report mapped to HIPAA and a HITRUST certification are ways to prove you meet it. Many health-tech companies start with a HIPAA risk analysis and SOC 2, then add HITRUST when a large health system requires it.
What would the proposed Security Rule change?
The January 2025 proposal would drop the “addressable” category, require MFA and encryption with narrow exceptions, a written technology asset inventory and network map, and an annual compliance audit. HHS has moved its target for final action to 2027. If you are starting now, building to the proposal costs little extra.
Does HIPAA apply to us if we never see patient records?
If you create, receive, store or transmit PHI on behalf of a covered entity, you are a business associate, even if the data is encrypted and you never look at it. Hosting and backup providers are included.
Bring your next audit into the light.
Book a free 30-minute consultation. We will map where you are, what your customers need and the fastest path to get there.