United States · Compliance
HIPAA compliance in the United States
Achieve HIPAA compliance in the US with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- New York office team
- Effivity software included
- Academy training included
Who asks for HIPAA in the US
Clients include
HIPAA compliance in the US at a glance
HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in the US ask for evidence that you meet it.
Health plans, clearinghouses and providers that transmit health information electronically are covered entities under HIPAA, and their business associates — billing companies, cloud hosts, software vendors, transcription and support services — carry Security Rule obligations of their own. The rule, at 45 CFR Part 160 and Subparts A and C of Part 164, requires administrative, physical and technical safeguards that protect the confidentiality, integrity and availability of electronic protected health information. There is no HIPAA certificate and no government-approved certifying body: compliance is shown through a documented risk analysis, policies, workforce training, business associate agreements and records that stand up to a review by the Department of Health and Human Services. Many vendors support that evidence with ISO/IEC 27001 or a SOC 2 report, which hospital customers often request. Sterling's New York office runs the gap assessment, risk analysis and remediation, with Sterling Academy training and Effivity included in the engagement. The local questions follow.
Who needs HIPAA in the US, and what happens without it
These are the organisations in the US that most often need to show HIPAA.
- Health care providers that transmit health information electronicallyCovered entities under the Security Rule.
- Health plans and health care clearinghousesCovered entities under the Security Rule.
- Business associates — billing, cloud hosting, software, transcription and support vendorsBusiness associates of covered entities are within the Security Rule's scope.
- Health-tech start-ups selling to hospitalsHospital procurement asks for evidence of HIPAA safeguards, often with SOC 2 or ISO/IEC 27001.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the HIPAA readiness checkHIPAA requirements in the US
Strip away the vocabulary and HIPAA requires covered entities and business associates to comply in six areas protecting health information.
In the US these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: HIPAA explained →
How to achieve HIPAA compliance in the US
One team from the New York office carries the work from scoping to sign-off. Delivered from the New York office across the US, with remote delivery for teams in other time zones and on-site work as agreed.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against HIPAA and the US requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does HIPAA compliance take in the US?
There is no standard duration: it depends on your scope and on how much of the system already runs. In the US these are the factors that set the timeline.
- Number of systems and locations holding ePHI
- Whether a current risk analysis exists
- Number of business associates and agreements to review
- Workforce training coverage
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does HIPAA compliance cost in the US?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In the US these factors move both.
- Number of systems, facilities and vendors in scope
- Technical remediation (access control, audit logging, encryption)
- Whether SOC 2 or ISO/IEC 27001 is pursued alongside
- Policy and training development
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
HIPAA consultants and assessors in the US
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers HIPAA and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in the US are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive HIPAA in the US (2)
| Instrument | How it treats the standard |
|---|---|
| HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164) | The instrument itself Administrative, physical and technical safeguards for ePHI; no certification. |
| AICPA SOC 2 examination | Related Vendors often evidence safeguards to covered entities through a SOC 2 report. |
Accreditation, audit language and remote audits in the US
Compliance, not certification: there is no HIPAA certificate and no government-approved certifying body. Evidence is the risk analysis, policies and procedures, safeguards, workforce training, business associate agreements and records, available if HHS reviews them. Independent assessments or SOC 2 / ISO/IEC 27001 can support that evidence. Edition and transition details: HIPAA hub →
Audit language
Documentation and assessments are in English.
Remote and on-site
Gap assessments and evidence reviews can be remote; physical safeguards are checked on-site at facilities that hold ePHI.
HIPAA in the US: questions clients ask
Is there a HIPAA certification?
No. The HIPAA Security Rule contains no certification, and the HHS page that sets it out does not mention one. Compliance is something the covered entity or business associate evidences for itself. Be cautious of anyone selling a HIPAA certificate, and confirm what counts as adequate evidence with your counsel.
Does HIPAA apply to software vendors?
Yes, where the vendor works with electronic protected health information for a covered entity. The Security Rule applies to covered entities, meaning health plans, health care clearinghouses and health care providers that transmit health information electronically, and to their business associates. A software vendor in that position is within scope; confirm your status with your counsel.
Can ISO 27001 or SOC 2 prove HIPAA compliance?
They support the evidence but cannot prove compliance alone. A SOC 2 report or an ISO/IEC 27001 certificate shows that safeguards were examined or certified, yet neither takes the place of the HIPAA risk analysis or your business associate agreements. Use them beside those documents and check the position with your counsel.
More on HIPAA for US organisations
Other standards US businesses ask Sterling for
Organisations in the US often combine HIPAA with one of these, under one management system where the scopes allow.
Start with a free discovery call from the New York office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164) — hhs.gov (accessed 5 Oct 2026)
- AICPA SOC 2 examination — aicpa-cima.com (accessed 5 Oct 2026)
- Higher-level contract quality requirements (FAR 46.202-4) — acquisition.gov (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the New York team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice