HIPAA · Health information privacy and security (United States)
HIPAA compliance consulting for protected health information your clients can trust you with.
Build a HIPAA compliance programme that stands up to a regulator, a hospital's vendor audit and a customer's due diligence questionnaire: risk analysis, safeguards, policies, training, business associate agreements and breach procedures, with the evidence behind each. Sterling's expert and experienced consultants build it with your operations, IT and compliance teams, in 60+ countries, and stay with you through the customer review and after it. We ensure a successful compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced HIPAA compliance consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling prepares the programme and the evidence; compliance is assessed by regulators and your customers' auditors
8,100+ client engagements in 60+ countries.
HIPAA client experience
What it is
What is HIPAA and what is it used for?
HIPAA is the Health Insurance Portability and Accountability Act of 1996, the US federal law under which the Department of Health and Human Services (HHS) sets national standards for the privacy and security of individually identifiable health information. Its rules, enforced by the HHS Office for Civil Rights (OCR), decide how protected health information (PHI) may be used and disclosed, how electronic PHI must be safeguarded, and what must happen when PHI is breached.
HIPAA is not written for hospitals alone. The moment a service provider creates, receives, maintains or transmits PHI for a US health plan, provider or clearinghouse, it becomes a business associate with obligations of its own, enforceable by OCR and written into every contract. For a BPO in the Philippines, a billing company in India or a SaaS platform in the UAE, HIPAA is the condition of doing healthcare business in the United States. The useful question is narrower than the statute: do you know where PHI enters, sits and leaves, and can you show an auditor the evidence without a week of preparation?
Current text and status. The rules in force are the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Parts 160 and 164, as amended by the 2013 Omnibus Rule that made business associates directly liable. HHS published a proposed rule on 6 January 2025 to strengthen the Security Rule; it remains a proposal, no final rule has been published, and the Department's latest regulatory agenda lists the final action as a long-term item. The current Security Rule remains in effect; a programme built today implements it and designs towards the proposal, so a final rule becomes an adjustment rather than a rebuild. The proposed Security Rule update, explained
Who it is for
Who needs HIPAA compliance?
HIPAA applies to covered entities, meaning US health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with a standard transaction, and to their business associates: anyone who creates, receives, maintains or transmits PHI on their behalf, and any subcontractor down the chain. The definition is about what you do with the data, not where your office is. Organisations come to Sterling for HIPAA from four starting points:
- A US healthcare client will not sign without it. The contract arrives with a business associate agreement, a security questionnaire and a request for your policies, risk analysis and training records. The programme has to exist first.
- You are a covered entity or a health-tech company entering the US market. A clinic group, a plan administrator, a telehealth or health-data platform: the obligations are direct, the regulator is OCR, and the first incident tests whether the programme is real.
- You already handle PHI and a customer audit found gaps. Template policies, no documented risk analysis, unsigned vendor agreements, breach procedures nobody has rehearsed. The customer wants a dated remediation plan.
- You run SOC 2, ISO/IEC 27001 or PCI DSS and want HIPAA on the same control set. Most Security Rule safeguards are already in your ISMS; the Privacy Rule, the breach clock and the contractual chain are not. HIPAA becomes an extension, not a second programme.
The intended result is control over PHI you can demonstrate: to a regulator on the worst day, and to an auditor on an ordinary one. It depends on the programme running, not on the policies existing.
Business benefits
How HIPAA compliance supports client trust and operational control
A HIPAA programme earns its keep in two places: the contracts it unlocks and the incidents it prevents. We begin where PHI is most exposed in your operation, agent desktops, shared mailboxes, file transfers, home-based staff and subcontractors, and build the programme around those points.
- Contracts you can signA business associate agreement you can honour, backed by the risk analysis, policies and training records US healthcare clients ask for at onboarding.
- Shorter vendor auditsEvidence organised by rule and safeguard, so a hospital's risk team gets answers in days rather than a quarter of chasing.
- Fewer incidents that become breachesAccess limited to the minimum necessary, encryption where it matters, logs that someone reviews, and staff who recognise a phishing e-mail.
- A breach handled on the clockThe four-factor risk assessment, notification templates and decision owners ready before the sixty-day clock starts.
- A controlled subcontractor chainYour vendors and subcontractors under agreements that flow the obligations down, with their safeguards checked rather than assumed.
- One control set for several frameworksHIPAA safeguards, SOC 2 criteria, ISO/IEC 27001 controls and PCI DSS requirements mapped once, evidenced once, audited from one workspace.
Choose a few measures that reflect these priorities: time to answer a customer questionnaire, incidents escalated correctly, training completion and the age of your risk analysis. A folder of policies carrying last year's dates is not a compliance result.
Requirements
What are the main HIPAA requirements?
HIPAA's obligations sit in four rules: the Privacy Rule governs the use and disclosure of PHI in any form; the Security Rule the safeguarding of electronic PHI; the Breach Notification Rule what happens after an impermissible disclosure; the Enforcement Rule how OCR investigates and penalises, with four penalty tiers adjusted for inflation each year and state attorneys general able to sue as well. The table maps the three rules that shape your programme, plus the pending proposal; the programme is checked against the regulation text, section by section, during the build.
| Rule | What it requires of you | What it looks like in practice |
|---|---|---|
| Privacy Rule 45 CFR Part 164, Subpart E | Use and disclose PHI only as permitted or authorised; apply the minimum necessary standard; honour individuals' rights; run the administrative programme | A privacy official, a notice of privacy practices for covered entities, authorisation forms, access and amendment requests met on time, training, sanctions, complaints and six-year records |
| Security Rule General rules and risk analysis, 164.306 and 164.308(a)(1) | Protect the confidentiality, integrity and availability of all ePHI; select safeguards from an accurate and thorough risk analysis; required specifications are mandatory, addressable ones are documented decisions | A written risk analysis of every system holding ePHI, a risk management plan with owners and dates, a sanction policy and reviewed activity logs |
| Security Rule Administrative safeguards, 164.308 | A security official; workforce access control; security awareness training; incident procedures; contingency planning; periodic evaluation; business associate contracts (164.314); written policies retained six years (164.316) | Access procedures, training records, an incident log, tested backup and recovery plans, an evaluation report, agreements with every client and vendor, and a controlled policy set with version history |
| Security Rule Physical safeguards, 164.310 | Control access to the facilities, workstations and devices that hold or reach ePHI; govern media disposal and reuse | Facility access rules, clean-desk and screen rules for agents, device and media inventories, wiping and disposal certificates and equipment movement records |
| Security Rule Technical safeguards, 164.312 | Unique user IDs, emergency access, automatic logoff, audit controls, integrity checks, authentication and transmission security; encryption is addressable today and proposed to become required | Role-based access, multi-factor authentication, session timeouts, reviewed central logs, encrypted storage and transmission, and the reasoning behind any alternative measure |
| Breach Notification Rule 164.400 to 164.414 | Presume a breach unless a four-factor risk assessment shows a low probability of compromise; notify individuals, HHS and, for large breaches, the media within the deadlines; business associates notify the covered entity | An incident-to-breach procedure, the four-factor record, notification templates, a log of smaller breaches for the annual report to HHS and the sixty-day clock tracked from discovery |
| Proposed Security Rule update Proposed rule of 6 January 2025 · status: proposal | Would make all specifications required and add written documentation, an asset inventory and network map, encryption, multi-factor authentication, six-monthly vulnerability scans, annual penetration tests, 72-hour restoration and an annual compliance audit | Nothing new is required yet; a mature programme meets most of it already, and the gap analysis records where you stand so a final rule is an adjustment |
What does useful HIPAA compliance evidence look like?
A data-flow map of PHI, the risk analysis and risk management plan, signed business associate agreements in both directions, access reviews, training records, encryption and logging configuration evidence, incident and breach assessment records, contingency test results and the periodic evaluation. We identify the records your processes need, without creating documents to fill a folder, and they live in Effivity from the first workshop so an auditor sees a programme that runs.
HIPAA requirements explained, rule by ruleCompliance process
How do you become HIPAA compliant?
There is no certificate at the end of a HIPAA programme, so the work has to be right rather than merely audited. You build a programme that meets the rules, operate it long enough to produce evidence, and demonstrate it: to the customers who ask, to any third-party assessor you choose and, if it ever comes to that, to OCR. Sterling builds the programme and the evidence with you; assessing compliance belongs to the regulator and your customers' auditors.
- 01Establish your status and the PHI in scope.Covered entity or business associate, which clients and contracts, which services, sites and systems touch PHI, and which vendors.
- 02Gap analysis: review the current programme against the four rules.The gap analysis compares your policies, safeguards, agreements and records with the four rules, keeps what works and agrees actions, owners and dates.
- 03Conduct the risk analysis and implement the safeguards.A documented risk analysis of every system holding ePHI, a risk management plan, the administrative, physical and technical safeguards, policies, agreements and workforce training.
- 04Evaluate, audit and address the findings.The Security Rule's periodic evaluation, an internal audit against each rule and a management review; findings are raised by us first and closed with evidence.
- 05Demonstrate compliance to the people who ask.Customer due diligence and vendor audits and, where you choose it, a SOC 2 examination, a HITRUST assessment or ISO/IEC 27001 certification on the same evidence.
- 06Maintain the programme year after year.The risk analysis updated as systems change, annual training, breach procedures rehearsed, business associates re-verified and documentation retained for six years.
Check the credibility of what you are offered, not just the price. Nobody can sell you HIPAA certification, because HHS recognises none; a seal or a certificate bought online proves nothing to an auditor and nothing to OCR. Ask any provider which risk analysis they will perform, which policies will be written for your operation, who will train your people and what evidence you will hold. How to choose a credible HIPAA provider · The compliance buyer's checklist
Cost
How much does HIPAA compliance cost?
There is no useful universal price for a HIPAA compliance programme. A twenty-seat coding team with one client and one platform is a different project from a multi-site BPO with home-based agents, three healthcare clients and a subcontractor chain. What we do promise is a proposal with every component visible and a fee that is fixed.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Current maturity, the number of PHI-handling services and systems, sites and countries, deliverables and how much of the work your team takes on (Design™ or Drive™) |
| Independent assessment, where you choose one | The CPA firm's fee for a SOC 2 examination, the assessor and HITRUST fees, or the certification body's fees for ISO/IEC 27001, identified separately so the programme cost stays comparable |
| Internal resources | Time from IT, operations and HR, the security tooling the risk analysis calls for, legal review of agreements and any operational changes |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Annual risk analysis updates, training refreshers, breach drills, business associate reviews and preparation for the proposed Security Rule changes, under Sustain™ |
What moves the price
- Sites, countries and home-based workers who handle PHI
- Systems, platforms and client environments in scope
- Whether a risk analysis, an ISMS or a SOC 2 programme already exists
- The customer's deadline, and how much of the work your team can carry
- The length of your vendor chain, and how many agreements need rewriting
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Third-party assessment fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does HIPAA compliance take?
A realistic HIPAA programme takes three to six months, occasionally less where an audited ISMS already exists and the work is mostly the Privacy Rule, agreements and breach procedures. The pace is set by how quickly the risk analysis can be completed, how much remediation it reveals and whether a customer is waiting. We plan around the evidence a vendor auditor will ask for, with milestones your team tracks in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to contracts, data flows, systems, existing policies and the people who run them |
| Risk analysis, build and implementation | The number of systems holding ePHI, the remediation the risk analysis reveals, tooling procurement, legal turnaround on agreements and training rollout |
| Evidence and review | Safeguards operating long enough to produce logs, reviews and records, followed by the periodic evaluation, internal audit and management review |
| Regulator or customer review | The customer's due diligence calendar, the CPA firm's or assessor's scheduling where a SOC 2, HITRUST or ISO/IEC 27001 review is chosen, and the time to address findings |
If a client contract or a go-live date depends on the programme, share it at the start. We will tell you what is achievable and which decisions cannot wait; we will not promise a "HIPAA compliant" date before anyone has looked at where your PHI goes.
The chief compliance officer writes that the HIPAA and PCI DSS gap assessment gave a clear view of the company's compliance posture, existing controls and areas for improvement, helped it prioritise remediation and set clear action plans, and that the team's technical expertise, structured approach and practical recommendations made the assessment efficient and credible in supporting customer assurance requirements.
Challenges
Common HIPAA implementation challenges
Most HIPAA programmes run into the same five obstacles. Each has a practical answer.
Nobody is sure whether HIPAA applies, or to which parts of the business.
We map the PHI flows and the contracts first: which clients are covered entities or business associates, which services touch PHI and which do not. The scope follows the data, so a BPO with one healthcare client is not rebuilding its whole operation.
The policies exist, but the risk analysis is missing or generic.
A risk analysis that names no systems is among the most common findings in OCR investigations and customer audits alike. We conduct one that covers every system holding ePHI, with likelihood, impact and a risk management plan, and keep it current in Effivity as systems change.
Business associate agreements are unsigned, outdated or flow in only one direction.
We review the agreements your clients impose on you, prepare the ones you impose on your vendors, and keep a register of who holds PHI on your behalf. Your lawyers keep the final word on wording; the register keeps the evidence.
Evidence is scattered across ticketing tools, e-mail and spreadsheets.
Define the records each safeguard produces, who owns them and where they live. Effivity is configured for those records within the agreed scope, so a questionnaire is answered from the system, not reconstructed for it.
HIPAA, SOC 2, ISO/IEC 27001 and PCI DSS are being run as four projects.
Map the requirements once to a single control set, evidence each control once and let every framework draw on the same records. Each framework's specific obligations are still met; the duplication is not.
Your engagement
What your HIPAA engagement includes
Your agreed scope brings together everything a working programme and a prepared workforce need. Many providers sell a policy pack and leave you to make it true; a Sterling engagement is the whole journey, from one team, under one all-inclusive proposal.
Scope, gap analysis and implementation plan
PHI flows, your status under the rules, the gaps against all four, and a plan with responsibilities, dates and decision owners, agreed before work starts.
Risk analysis, safeguards and documentation
The Security Rule risk analysis and risk management plan, the policy and procedure set on Sterling's own template sets, and business associate agreement support with your lawyers.
Effivity ISO & GRC software
Your HIPAA programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Evaluation, internal audit and management review
The periodic evaluation the Security Rule requires and an internal audit against each rule, conducted or facilitated as agreed, with findings closed with evidence before an auditor arrives.
Review readiness and support
Preparation for customer due diligence and vendor audits, for any SOC 2, HITRUST or ISO/IEC 27001 review you choose, and support if OCR asks.
Compliance assessments and enforcement decisions remain with the regulator and your customers' auditors.
How we deliver
How Sterling supports your HIPAA implementation
Every HIPAA engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Choose the level of support that matches your capacity; the method, the software and the accountability stay the same.
- 01Design™Guided implementation: your team builds the programme with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the agreed build work, from risk analysis to training rollout, with your process owners.
- 03Sustain™After go-live: annual risk analysis updates, internal audits, breach drills, refresher and new-hire training and customer audit support, year after year.
- 04Automate™The programme running in Effivity: PHI flows, risks, policies, agreements, incidents, training and evaluations in one workspace.
- 05Revise™Changes in the rules, such as a final Security Rule update, and changes in your clients, services, sites or subcontractors.
Before work starts we fix the engagement team, the weekly working session, the deliverables and who decides what. Progress is then reviewed against those commitments, so gaps show early rather than when a customer's auditor is already on the call.
How Sterling OS™ worksOften combined with
Standards organisations pair with HIPAA
- 21 CFR Part 11 / EU Annex 1121 CFR Part 11 and Annex 11 compliance for GxP systems: requirements, validation, audit trails and e-signatures, with evidence ready for FDA and EU inspectors.
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
Effivity · HIPAA compliance software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the HIPAA Privacy, Security and Breach Notification Rules.
Every Sterling HIPAA engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the compliance workspace within the agreed scope, so PHI data flows, the risk analysis, policies, business associate agreements, access reviews, training records, incidents and breach assessments live in one place, the programme runs in daily work and an auditor reviews a live system rather than a folder of PDFs. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
PHI inventory, uses and disclosures
Where PHI enters, sits and leaves, which client it belongs to and which permitted purpose each use serves; authorisations and individual-rights requests logged with deadlines.
Systems, threats, likelihood and impact
Every system holding ePHI listed with its threats and vulnerabilities, risk levels calculated, treatments assigned to owners with dates, and the analysis versioned so the auditor sees when it changed and why.
Access, training, incidents and contingency
Access requests, awareness training completion, incident tickets and contingency plan tests, each producing its record as the work is done.
Facilities, workstations and media
Site access rules, workstation and device inventories, media disposal and reuse records and equipment movement logs, kept by site so multi-site evidence is never assembled by hand.
Access control, logging and encryption evidence
User access reviews, multi-factor authentication and session timeout attestations, log review sign-offs and encryption configuration evidence, with the reasoning behind any alternative measure documented.
Agreements in both directions
Every customer agreement signed and every vendor agreement issued, with renewal dates, subcontractors named and the annual verification of their safeguards recorded.
Incident to breach, on the clock
The four-factor risk assessment for each incident, the decision and its evidence, notification templates and the log of smaller breaches for the annual HHS report, with the sixty-day clock visible from discovery.
One control set for HIPAA, SOC 2, ISO/IEC 27001 and PCI DSS
Controls mapped once to every framework you carry, evidence attached once, and forms and reports adapted to how you work, without code.
What this means at the audit
A hospital's vendor auditor asks for the risk analysis, the policy set, the training records, the last access review, the incident log and the business associate agreements. In Effivity each is a screen, with dates, owners and evidence attached, not a folder built the week before the questionnaire is due. After go-live, Sustain™ runs in the same workspace, so the next customer audit finds a programme that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your policies, agreements and registers migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, PIMS, BCMS and QMS when you integrate other standards
HIPAA client experience
On the record: what clients say about working with Sterling.
The operations director notes that the team understood both the compliance requirements and the company's day-to-day processing operations, and that the guidance and remediation plan improved how teams handle sensitive information across shifts and locations while strengthening compliance practice.
The chief compliance officer writes that the HIPAA and PCI DSS gap assessment gave a clear view of the company's compliance posture, existing controls and areas for improvement, helped it prioritise remediation and set clear action plans, and that the team's technical expertise, structured approach and practical recommendations made the assessment efficient and credible in supporting customer assurance requirements.
The operations manager writes that the team's attention to detail, collaborative approach and commitment to quality set a standard well beyond what the company expected.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request.
Case studies with HIPAA in scope
Real engagements, real outcomes.
- 01Read the case study
Healthcare: HIPAA compliance for a technology provider to healthcare clients
A technology company serving healthcare clients found HIPAA complex and needed to protect patient information. Tighter security controls, clear policies and active monitoring sharply reduced the risk of breaches of protected health information and of HIPAA violations. Demonstrated compliance earned the trust of healthcare clients, expanded its partnerships and won new contracts; its chief technology officer said data security now sits at the core of the company's operations, protecting both its clients' information and its business.
- 02Read the case study
BPO: six standards that opened doors in regulated sectors
A BPO serving clients in highly regulated sectors had good people but needed systems to deliver consistently and protect sensitive data. It implemented ISO 9001, ISO/IEC 27001, ISO/IEC 27701, ISO 22301, PCI DSS and HIPAA. The security, privacy and payment controls safeguarded client data and kept it compliant, and ISO 22301 prepared it for disruption with backup systems, plans for alternative sites and fast recovery. Its chief executive said this opened the way to clients previously out of reach.
Sterling Academy · HIPAA e-learning
Train every employee on HIPAA, not just the compliance team.
Both the Privacy and Security Rules require workforce training, and auditors ask for the records. Sterling Academy delivers e-learning for the whole workforce and for those who run the programme: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- HIPAA awareness for every employee who could see PHI, with the training evidence both rules require
- Practitioner courses for the privacy official, the security official and process owners
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Learner progress by team and site, and a training status report for the auditor
- New hires trained before they touch PHI, so evidence is current at every audit
- A Sterling consultant reachable when a learner needs one
Sterling Academy courses for a HIPAA programme
The courses your people take, and who takes them.
HIPAA Awareness
What PHI is, what each person may and may not do with it, how to recognise and report an incident, and why the minimum necessary standard applies to everyday tasks. The training evidence both rules require.
View the courseDocumented Information Management
Writing, approving, distributing and retaining the policies, procedures and records the Security Rule expects, with six-year retention and review-on-change discipline built in.
View the courseNonconformity Management
Handling security incidents, privacy complaints and audit findings: investigation, the incident-to-breach decision, sanctions, root cause and the corrective action evidence an auditor expects.
View the courseRisk Management
Conducting and maintaining the Security Rule risk analysis: scoping every system holding ePHI, identifying threats and vulnerabilities, rating likelihood and impact, and turning the result into a risk management plan.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will audit the HIPAA programme, with practical exercises on your own PHI flows and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO/IEC 27001, ISO/IEC 27701, ISO 22301, ISO 9001 and more, so a programme combining HIPAA with an ISMS or a PIMS trains one workforce on one platform.
See all coursesSterling consulting clients arrange access through their consultant. Sterling Academy certificates are training certificates for the people who complete the courses; they are not, and nothing is, HIPAA certification of your organisation.
Where we work
Where Sterling delivers HIPAA
Keep exploring
Explore more about HIPAA
Watch a video on how to comply with HIPAA here.
Watch a video on HIPAA requirements here.
HIPAA resources
Services for HIPAA
Why Sterling
Want successful HIPAA compliance? Come to Sterling.
Whether you are a Philippine BPO onboarding its first US healthcare client, an Indian billing company with three, or a Gulf health-tech platform entering the US market, Sterling builds a HIPAA programme that your clients' auditors recognise and your people can run. We work through the contractual chain, the data flows across sites and time zones and the overlap with frameworks you already hold, so the programme supports growth without becoming a second operation.
HIPAA programmes across 60+ countries
Compliance programmes built for BPOs, contact centres, billing and coding companies, SaaS providers, IT services firms and healthcare organisations, with one engagement team accountable across every country you operate in.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with third-party assessment fees identified separately. No surprises, ever.
A programme your people can run
Less paperwork and maximum effect: policies, training and software connected to the way agents, engineers and supervisors handle PHI, so the programme is adopted rather than tolerated.
Expert and experienced consultants
Consultants who have advised on information security, privacy and compliance programmes across sectors and countries since 2003, and who build your HIPAA programme properly the first time, so a customer audit confirms what already works.
The Sterling Promise
What our HIPAA compliance success guarantee means
We stay with you until your agreed HIPAA compliance outcome is achieved: the programme built, the evidence in place, and the customer review or third-party assessment your engagement defines supported until its findings are resolved. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability rather than a policy pack with a date.
The engagement identifies the rules, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed safeguards into use. Regulators and your customers' auditors assess compliance and retain their decisions. Our commitment concerns the agreed compliance support, not a promise that no incident will occur or that every contract will be won.
After the programme is live
What happens after you become HIPAA compliant?
HIPAA compliance has no expiry date and no renewal audit, which is exactly why programmes decay. The risk analysis has to be updated when systems change, training repeated for new hires, agreements renewed and verified, breach procedures rehearsed and the periodic evaluation actually performed. OCR asks whether recognised security practices were in place for the previous twelve months; a customer asks the same every year in a different questionnaire.
Under Sterling OS™ Sustain™ we review incidents, access, vendors and the risk analysis with you alongside the planned internal audits and management reviews, so the programme stays current between customer audits rather than being revived when the next questionnaire arrives. If the proposed Security Rule update becomes final, Revise™ turns a known gap into a dated plan.
FAQs
Frequently asked questions about HIPAA
Is there such a thing as HIPAA certification?
No. HHS states that it does not endorse or recognise any private organisation's certification of Security Rule compliance, that such a certificate does not absolve an organisation of its obligations, and that it does not prevent OCR from finding a violation. Compliance is demonstrated through a documented programme and its evidence. A SOC 2 report, HITRUST or ISO/IEC 27001 certification can support it; none is HIPAA certification.
We are outside the United States. Does HIPAA apply to us?
If you create, receive, maintain or transmit PHI for a US covered entity or another business associate, you are a business associate, and the obligations follow the data rather than the office address. Your customer will require a business associate agreement and its auditors will expect the programme behind it. Local privacy law applies as well, not instead.
What is a business associate agreement, and who has to sign one?
The contract between a covered entity, or a business associate, and the business associate that handles PHI for it: permitted uses and disclosures, safeguards, incident and breach reporting, flow-down to subcontractors, support for individuals' rights, HHS access to books and records, and what happens to the PHI at termination. You sign one with every client that gives you PHI and issue one to every vendor that touches it.
What is the difference between required and addressable specifications?
Required specifications must be implemented as written. For addressable ones, you assess whether the specification is reasonable and appropriate for your environment; if not, you document why and implement an equivalent alternative where reasonable. Addressable never means optional. The January 2025 proposal would remove the distinction; it is not final.
What has to happen when PHI is breached?
An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a four-factor risk assessment shows a low probability of compromise. Individuals are notified without unreasonable delay and no later than sixty days after discovery; HHS within sixty days for breaches affecting 500 or more people and annually for smaller ones; the media for breaches affecting more than 500 residents of a state. A business associate notifies the covered entity within sixty days, and usually much faster under its contract.
Does Sterling certify or attest our HIPAA compliance?
No, and nobody can certify it. Sterling builds the programme and the evidence with you. Compliance is assessed by OCR if it investigates, by your customers' auditors routinely and, where you choose independent evidence, by a CPA firm, a HITRUST assessor or an accredited certification body. A provider offering a HIPAA certificate is offering paper.
Will our ISO/IEC 27001 certification or SOC 2 report make us HIPAA compliant?
Not by themselves. An ISMS or a SOC 2 programme covers most of the Security Rule's safeguards, and auditors value the independent report. The Privacy Rule, the breach clock, the business associate chain and HIPAA's own documentation are not in either by default. We extend the control set you have rather than starting again.
What is the status of the proposed Security Rule changes?
HHS published a proposed rule on 6 January 2025 that would make every specification required and add encryption, multi-factor authentication, an asset inventory and network map, vulnerability scanning, penetration testing, 72-hour restoration and an annual compliance audit. Comments closed in March 2025. No final rule has been published; the Department's latest regulatory agenda lists the final action as a long-term item. We build to the current rule and record where you stand.
What do you need to prepare a HIPAA proposal?
Which clients give you PHI and in which role, the services, systems and sites that handle it, approximate headcount, whether a risk analysis, an ISMS or a SOC 2 programme exists, and the contract deadline. That is enough for a scoped, all-inclusive proposal; no policy manual is needed first.
Before the first call
Prepare a useful HIPAA readiness brief
You do not need a policy manual before the first discussion. Bring a short account of where PHI comes from, where it goes and what your clients ask for. Seven questions are enough:
- Which clients or prospects give you PHI, and are they covered entities or business associates themselves? What does their contract or questionnaire ask for?
- Which services, systems, sites and home-based roles create, receive, store or transmit PHI, and which do not?
- Do you hold a documented risk analysis, and when was it last updated?
- Which vendors and subcontractors touch PHI on your behalf, and which of them have signed an agreement with you?
- What do incidents, customer audit findings or questionnaire gaps tell you about the starting point?
- Which frameworks do you already run, such as ISO/IEC 27001, SOC 2 or PCI DSS, and what evidence exists?
- Who can make decisions and contribute time, and is there a contract date or a customer audit to plan around?
These answers let us scope the work and price it realistically. They prepare a conversation; they are not a scored assessment or a compliance determination.
Don’t be fooled by certification scams
If it takes ten days, it is not HIPAA compliance.
Because HHS recognises no HIPAA certification, the market has invented its own: seals for a website, certificates from an online quiz, "HIPAA compliant" badges sold with a hosting plan. They cost little, and are worth exactly that when a hospital's risk team, a state attorney general or OCR asks for the risk analysis behind them.
How to choose a credible HIPAA provider
- Ask what the seal or certificate actually attests. No government body certifies HIPAA compliance; a seal proves somebody was paid for a seal.
- Ask for the risk analysis. A programme without an accurate and thorough risk analysis of your systems fails the first question OCR and every serious customer asks.
- Check whether the policies describe your operation. A template set that never mentions your platforms, sites or clients documents nothing.
- Ask who trains your people and what records you will hold. Both the Privacy Rule and the Security Rule require workforce training; a framed certificate does not.
- Ask about the agreements. If the provider has not asked which clients give you PHI and which vendors receive it, the business associate chain is still open.
- Walk away from "HIPAA certified in 7 days", "compliant hosting means a compliant company" and one invoice for compliance and certificate. A programme has to be built and run before it can be shown.
Keep exploring
More on HIPAA and related standards
Every HIPAA guide
More in Healthcare, medical devices & life sciences
Talk to a consultant
Plan your HIPAA compliance programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice