Compliance walkthrough
How to comply with HIPAA: video walkthrough
A walkthrough of building a HIPAA compliance programme for covered entities and business associates: there is no certificate at the end, so the programme and its evidence have to be right.
Key takeaways
- HIPAA is a US law; there is no HIPAA certification to obtain.
- Business associates handling PHI for US clients have obligations of their own, wherever they are located.
- A written risk analysis of every system holding ePHI is the foundation of the Security Rule programme.
- Business associate agreements and workforce training are part of the evidence.
- Compliance is judged by the regulator and your customers' auditors, not by the consultant.
HIPAA is a US law, and business associates are inside it
HIPAA, the Health Insurance Portability and Accountability Act of 1996, is the US federal law under which the Department of Health and Human Services sets national standards for the privacy and security of individually identifiable health information. Its rules, enforced by the HHS Office for Civil Rights, decide how protected health information may be used and disclosed, how electronic PHI must be safeguarded and what must happen when PHI is breached.
HIPAA is not written for hospitals alone. A service provider that creates, receives, maintains or transmits PHI for a US health plan, provider or clearinghouse becomes a business associate with obligations of its own, wherever its office is: a BPO in the Philippines, a billing company in India or a SaaS platform in the UAE. This short film walks through the compliance programme those organisations build.
How a HIPAA programme is put together
First establish your status and the PHI in scope: covered entity or business associate, which clients and contracts, which services, sites, systems and vendors touch PHI. A gap analysis then compares your policies, safeguards, agreements and records with the Privacy, Security, Breach Notification and Enforcement Rules and agrees actions, owners and dates.
The centre of the programme is a documented risk analysis of every system holding electronic PHI, followed by a risk management plan and the administrative, physical and technical safeguards it calls for, together with policies, business associate agreements and workforce training. The Security Rule's periodic evaluation, an internal audit against each rule and a management review then show what still needs fixing. Because no HIPAA certificate exists, compliance is demonstrated to your customers, to any third-party assessor you choose and, if it ever comes to that, to the regulator.
Sterling's expert and experienced consultants build the programme and its evidence with your operations, IT and compliance teams under Sterling OS™, with the records held in Effivity.
HIPAA at a glance
- Purpose
- Protecting individually identifiable health information in the United States: how it may be used and disclosed, how it is secured, and what happens when it is breached
- Relevant to
- US health plans, providers and clearinghouses, and every business associate handling their PHI: BPO and contact centres, billing and coding, SaaS and cloud providers, IT services and analytics, wherever they are located
- Edition
- 45 CFR Parts 160 and 164: the Privacy, Security, Breach Notification and Enforcement Rules, as amended by the 2013 Omnibus Rule; the Security Rule update proposed in January 2025 remains a proposal
- Certification
- None exists. Compliance is demonstrated to the regulator, your customers and their auditors through a documented programme; SOC 2, HITRUST and ISO/IEC 27001 can evidence it
- Sterling's role
- Programme build with your team, Effivity, training, internal audit and review readiness, then Sustain™
- Cost and timing
- Total investment for a HIPAA compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
HIPAA: questions people ask
Is there such a thing as HIPAA certification?
No. HHS states that it does not endorse or recognise any private organisation's certification of Security Rule compliance, that such a certificate does not absolve an organisation of its obligations, and that it does not prevent OCR from finding a violation. Compliance is demonstrated through a documented programme and its evidence. A SOC 2 report, HITRUST or ISO/IEC 27001 certification can support it; none is HIPAA certification.
We are outside the United States. Does HIPAA apply to us?
If you create, receive, maintain or transmit PHI for a US covered entity or another business associate, you are a business associate, and the obligations follow the data rather than the office address. Your customer will require a business associate agreement and its auditors will expect the programme behind it. Local privacy law applies as well, not instead.
What is a business associate agreement, and who has to sign one?
The contract between a covered entity, or a business associate, and the business associate that handles PHI for it: permitted uses and disclosures, safeguards, incident and breach reporting, flow-down to subcontractors, support for individuals' rights, HHS access to books and records, and what happens to the PHI at termination. You sign one with every client that gives you PHI and issue one to every vendor that touches it.
What is the difference between required and addressable specifications?
Required specifications must be implemented as written. For addressable ones, you assess whether the specification is reasonable and appropriate for your environment; if not, you document why and implement an equivalent alternative where reasonable. Addressable never means optional. The January 2025 proposal would remove the distinction; it is not final.
What has to happen when PHI is breached?
An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a four-factor risk assessment shows a low probability of compromise. Individuals are notified without unreasonable delay and no later than sixty days after discovery; HHS within sixty days for breaches affecting 500 or more people and annually for smaller ones; the media for breaches affecting more than 500 residents of a state. A business associate notifies the covered entity within sixty days, and usually much faster under its contract.
Keep exploring
Related to this video
Read next
Services
The complete guide
Everything on HIPAA
Start with the HIPAA page, or go straight to the guide you need.
On the HIPAA page
Guides
More videos: Privacy and data protection
- How to implement ISO/IEC 27701Implementation walkthrough · 3 min 14 s
- ISO/IEC 27701 requirements explainedTwo-minute brief · 2 min
- How to comply with GDPRCompliance walkthrough · 3 min 24 s
- GDPR requirements explainedTwo-minute brief · 2 min
- How to comply with the Philippine Data Privacy ActCompliance walkthrough · 3 min 15 s
- Philippine Data Privacy Act requirements explainedTwo-minute brief · 2 min
- How to comply with India's DPDP Act 2023Compliance walkthrough · 3 min 15 s
- India's DPDP Act 2023 requirements explainedTwo-minute brief · 2 min
- How to comply with Singapore's PDPACompliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your HIPAA compliance programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice