HIPAA compliance steps: the six-step process from PHI map to lasting evidence

Where the process ends when no certificate exists

Unlike ISO certification or a SOC 2 report, HIPAA ends in no external decision. HHS states that covered entities are not required to certify their compliance and that it does not recognise private organisations' certifications of Security Rule compliance. A seal from a website neither protects you from an OCR finding nor satisfies a hospital's vendor auditor.

Three audiences judge the programme instead. The HHS Office for Civil Rights enforces the rules through complaint investigations and compliance reviews. Your US healthcare customers test you through due diligence questionnaires and vendor audits. And your own organisation must evaluate itself periodically, because the Security Rule requires it. Your organisation owns the programme; Sterling builds it with your teams and prepares the evidence, and does not certify or attest HIPAA compliance.

Steps 1 and 2: confirm your status, then run the gap analysis

Step 1: covered entity or business associate, and where the PHI goes

A health plan, a clearinghouse or a provider that transmits health information electronically in a standard transaction is a covered entity. A company that creates, receives, maintains or transmits PHI for one of them is a business associate, and so is its subcontractor doing the same. The test is what you do with the data and for whom, not where your office is.

Then map the PHI: which client contracts involve it, which services, sites and systems store or reach it, and which vendors see it. That map becomes the scope of every later step and shows where agreements are needed in both directions; their content is covered in Business associate agreements: what to sign and what to issue.

Step 2: compare what you have with the four rules

The gap analysis is Sterling's first engagement stage. It reviews your policies, safeguards, agreements and records against the Privacy, Security, Breach Notification and Enforcement Rules, keeps what already works and turns the rest into actions with owners and dates. Organisations that already run an audited ISMS usually find the gaps concentrated in the Privacy Rule, the agreements and the breach procedures.

Step 3: the risk analysis and the safeguards it calls for

The Security Rule requires an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of all the ePHI you hold. HHS calls it the first step in identifying safeguards. A defensible analysis covers every system holding ePHI, identifies threats and vulnerabilities, records existing measures, rates likelihood and impact, and is documented and reviewed. The method is set out in The Security Rule risk analysis: how to conduct one.

The risk management plan that follows drives three groups of safeguards:

• Administrative: a security official, access procedures, awareness training, incident procedures, a tested contingency plan and a sanction policy.
• Physical: facility access, workstation rules, and control of devices and media through to disposal.
• Technical: unique user IDs, emergency access, audit controls, integrity protection, authentication and transmission security.

Required specifications must be implemented. For each addressable one, record whether it is reasonable and appropriate for you and, if not, why, and what equivalent measure you use. Encryption is addressable today, but a decision not to encrypt ePHI needs strong written reasoning.

This step also completes the Privacy Rule work (a privacy official, minimum necessary rules, individuals' requests, complaints and sanctions) and the breach procedure: the four-factor risk assessment, who decides, and how the sixty-day notification clock is tracked from discovery. Policies come last, describing what the organisation now does, and are kept for six years; see HIPAA documentation: what you need and what you do not.

Step 4: evaluate, audit internally and close the findings

The Security Rule's evaluation standard requires a periodic technical and non-technical evaluation of how well your policies and safeguards meet its requirements, performed internally or by an external organisation. It is the nearest HIPAA comes to an audit stage.

Once the safeguards have left records, audit each rule by sampling real cases: a leaver's access removal, an individual's access request, a suspected incident and its breach assessment. Sterling raises findings before any customer does, and each is closed with evidence rather than a promise.

Step 5: show the evidence to the people who ask

Business associates are usually tested by customers long before OCR looks, through questionnaires and vendor audits. Some customers want an independent report; none is a HIPAA certificate, but each can rest on the same safeguards:

The choice is weighed in HIPAA vs SOC 2, HITRUST and ISO/IEC 27001. For planning, note that in Security Rule enforcement OCR considers whether recognised security practices were in place for the prior twelve months: evidence that has run for a year counts for more than evidence produced last week.

Step 6: keep the programme running

HIPAA has no surveillance audit to impose a yearly rhythm, so the programme needs its own. Update the risk analysis whenever systems, sites or services change. Refresh training each year, rehearse the breach procedure with a realistic scenario, re-verify business associates, and keep documentation for six years from creation or last effective date.

Watch the regulation too. HHS proposed a stronger Security Rule on 6 January 2025; it remains a proposal and the current rule stays in force. A programme with an asset inventory, multi-factor authentication and encryption already in place will adapt without a rebuild; see The proposed Security Rule update, explained.

How long the HIPAA compliance steps take

Most programmes take three to six months from the first workshop to evidence a customer's auditor can test: the short end for a service provider with an audited ISMS, the long end for a multi-site operation or a first-time healthcare provider. The price factors are in HIPAA compliance cost: what moves the price.

HIPAA compliance process: questions buyers ask