HIPAA Compliance as a Program, Not a Binder
HIPAA has no certificate. OCR, payers, and health-system customers ask for a current risk analysis, policies people follow, signed BAAs, training records, and proof the safeguards exist. We build that and keep it current.
Who this is for
Covered entities without a compliance team — independent and group practices, dental and behavioral-health clinics — and health-tech business associates whose customers ask for HIPAA documentation during procurement.
A HIPAA compliance program is the set of documented analyses, policies, agreements, training, and technical safeguards that the Privacy, Security, and Breach Notification Rules require of covered entities and their business associates. There is no government certification. Compliance is shown by producing those records when OCR, an auditor, or a customer asks, and by the safeguards actually matching what the records say.
What prompts a HIPAA program rebuild
OCR sent a data request after a complaint or a breach report, and the risk analysis on file is a template that was never completed for your systems.
A health system's vendor-risk team wants your risk analysis, policies, BAA, and training records before it will sign.
You reported a small breach and discovered the incident response plan existed only on paper.
A new location, EHR migration, or acquisition changed your systems and the documentation no longer describes them.
Staff turnover means nobody can show who was trained, when, or on what.
Why template HIPAA programs fail under review
The most common HIPAA failure is not a missing firewall. It is a risk analysis that does not describe the organization. OCR's enforcement announcements repeat the finding — no accurate and thorough risk analysis — across hospitals, small practices, and vendors, and OCR runs a Risk Analysis Initiative specifically to pursue it. A purchased policy binder with another practice's name removed, or a checklist that says MFA is on when it is not, gives an investigator a written record that the organization knew what to do and did not.
A working program starts with the inventory: where ePHI is created, stored, and sent, who can reach it, and on which devices. The risk analysis scores threats against that inventory. Risk management assigns owners and dates to the gaps. Policies describe what the organization will actually do; training and sanctions hold staff to it; BAAs extend the same duties to vendors. The Privacy Rule adds patient-facing duties — the Notice of Privacy Practices, the right of access to records, minimum-necessary use — and the Breach Notification Rule sets the clock when something goes wrong.
Health-tech companies carry most of the same Security Rule duties as business associates, and the HITECH Act made them directly liable for compliance rather than only contractually bound. Their customers usually ask for evidence through security questionnaires; some also want SOC 2 or HITRUST. We build the HIPAA program first and map it to those frameworks when a customer requires them, instead of running three disconnected projects.
What a HIPAA program has to cover
Clinical and practice-management systems
The EHR, practice-management and billing software, e-prescribing, imaging or PACS, and the patient portal. We document access roles in each and how their audit logs are reviewed.
Patient communication channels
Email, fax-to-email services, appointment-reminder and texting tools, and telehealth platforms. Each is checked for a BAA and for whether PHI travels unencrypted.
Billing and revenue-cycle partners
Clearinghouses, billing services, and collection agencies receive PHI routinely. Each needs a BAA and a defined minimum-necessary data set.
Workforce and their devices
Every staff member with PHI access, including part-time and contracted clinicians, and the devices they use — personal phones included if they read work email.
Health-tech production stack
For business associates: the production cloud account, CI/CD pipeline, support desk, analytics, and any AI service that might receive PHI. Each sub-processor needs a subcontractor BAA before PHI reaches it.
The program we build and maintain
Security Risk Analysis
Scoped to your systems and vendors, scoring likelihood and impact for each threat, in the form HHS guidance describes. Redone annually and after significant changes rather than filed once.
Risk management plan
Every finding gets an owner, a fix, and a target date, tracked to closure, so the analysis drives change instead of sitting in a folder.
Policies and procedures
Privacy, Security, and Breach Notification Rule policies written for how your organization works, with version history and the six-year retention that §164.316 requires.
BAA program
An inventory of business associates and subcontractors, signed agreements on file, and a check that runs before any new vendor receives PHI.
Workforce training and sanctions
Role-based training at hire and annually, attendance records, and a sanctions policy that is applied and logged.
Incident response and breach assessment
A written plan, an annual tabletop exercise, and the four-factor risk assessment from §164.402 ready to use, so the decision to notify or not is documented.
First 30 days
- Scope and ePHI inventory across systems, locations, and vendors.
- Security Risk Analysis drafted against your real environment.
- BAA gap list covering every vendor that touches PHI.
- Three to six quick-win controls closed, such as MFA, device encryption, and core written policies.
- A remediation roadmap ordered by risk.
After month one
- Risk management plan tracked to closure with your privacy and security officers.
- Remaining policies finalized, with staff acknowledgements tracked.
- Annual training, a sanctions log, and periodic access reviews.
- Annual risk analysis refresh and a tabletop incident exercise.
- Questionnaire and audit responses drawn from a maintained evidence library.
HIPAA rules and related frameworks
Privacy Rule — 45 CFR Part 164, Subpart E
Governs uses and disclosures of PHI, patient rights including access to records, the Notice of Privacy Practices, and minimum-necessary use. OCR has brought dozens of enforcement actions under its Right of Access Initiative for slow responses to record requests.
HHS: Summary of the HIPAA Privacy RuleSecurity Rule — 45 CFR Part 164, Subpart C
Administrative, physical, and technical safeguards for ePHI, beginning with the risk analysis at §164.308(a)(1)(ii)(A) and the risk management that follows it.
HHS: Guidance on Risk Analysis Requirements under the Security RuleBreach Notification Rule — 45 CFR 164.400–414
Individual notice within 60 days of discovery; HHS notice within 60 days for breaches of 500 or more, or within 60 days of year-end for smaller ones; media notice when more than 500 residents of a state are affected. Business associates must notify the covered entity.
HHS: Breach Notification RuleBusiness associate contracts
The BAA must state permitted uses, require safeguards and breach reporting, flow terms down to subcontractors, and provide for return or destruction of PHI. HHS publishes sample provisions.
HHS: Sample Business Associate Agreement ProvisionsSOC 2 and HITRUST (when customers require them)
Neither is a HIPAA requirement. Health systems often ask vendors for one of them; we reuse the HIPAA program's controls and evidence when you pursue either.
From a fixed-price sprint to an ongoing program
The HIPAA Risk Analysis Sprint is $5,000 fixed for 30 days and produces the risk analysis, BAA gap list, first controls, and roadmap. Running the program afterwards typically fits the Essential retainer ($3,500–$7,500 per month) for a single practice; the example bundle on our pricing page pairs Essential with a HIPAA add-on at about $5,500 per month. Health-tech companies combining the program with managed cloud usually fit Professional ($8,000–$15,000 per month).
HIPAA program questions
Is there such a thing as HIPAA certification?
No. HHS does not certify organizations or endorse private HIPAA certifications; those are training or assessment products. What counts is a documented program and safeguards that match it, which OCR evaluates when it investigates.
Are we a covered entity or a business associate?
Health plans, clearinghouses, and providers that bill electronically are covered entities. Companies handling PHI on their behalf — software vendors, billing companies, IT providers — are business associates. We confirm the role before writing policies, because it changes which Privacy Rule duties apply to you directly.
Does PlatOps sign a BAA for compliance work?
Yes, whenever the work involves access to systems that hold PHI. Practices sign with us as their business associate; health-tech companies sign with us as a subcontractor under their own customer BAAs.
How often does the risk analysis need updating?
The Security Rule treats it as ongoing, and HHS guidance calls for review and updates as the environment or operations change. We refresh it at least annually and whenever a major system, location, or vendor changes.
Can we use the free HHS Security Risk Assessment Tool?
Yes. ONC and OCR publish it for small and medium providers and it is a reasonable framework. Its output is only as accurate as the answers entered, so we fill it from an actual review of your systems rather than from memory.
What does OCR usually ask for first?
Typically the most recent risk analysis, the risk management plan, relevant policies, and evidence about the specific complaint or incident. Keeping those current is the most useful preparation an organization can do.
Start with a real risk analysis
Book a call and we will scope either a HIPAA Risk Analysis Sprint or an ongoing program, depending on where your documentation stands today.