A hospital’s vendor-risk team wants your HIPAA risk analysis before the contract moves. A health-system customer won’t sign until you return a business associate agreement you can actually honor. Or an incident has you wondering what the Office for Civil Rights would find if it looked. HIPAA readiness gives you a current, documented risk analysis, safeguards you can show, and evidence that holds up when someone asks.
The HIPAA Security Rule asks every covered entity and business associate to protect electronic protected health information (ePHI) through administrative, physical and technical safeguards, and to back every decision with documentation. It is deliberately flexible: some implementation specifications are required and others are “addressable,” which means you must assess whether each one is reasonable and appropriate for your organization and document either how you meet it or why an equivalent measure fits better. That flexibility is where most organizations come unstuck, because “we decided it didn’t apply” is only a defensible answer when the reasoning is written down.
The foundation is the security risk analysis: an accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity and availability of all the ePHI you create, receive, maintain or transmit, followed by a risk management plan that brings those risks down to a reasonable and appropriate level. The HHS Office for Civil Rights (OCR) enforces HIPAA, and a missing, partial or stale risk analysis is one of the most common failings cited in its investigations and resolution agreements. The Privacy Rule and the Breach Notification Rule sit alongside the Security Rule: minimum necessary access, patient rights, and a documented way to assess and report breaches of unsecured PHI.
Healthcare buyers come to HIPAA from two directions. Providers, health plans and clearinghouses are covered entities and own the obligation outright. Health-tech, SaaS, billing, analytics and managed-service companies become business associates the moment they handle PHI for a covered entity, and they carry Security Rule obligations directly, not just through the contract. HHS has also proposed updates to the Security Rule that would make expectations such as a technology asset inventory, a network map, multi-factor authentication, encryption, vulnerability scanning and penetration testing explicit rather than implied. Those changes are a proposal, not settled law, and the final text may differ; either way they show where OCR’s expectations are heading, and a program built toward them is ahead of the rule rather than behind it.
You sell into hospitals, clinics or health plans, and every deal now arrives with a security questionnaire and a BAA. You need a risk analysis and safeguards you can describe with confidence, not a template you hope nobody reads closely.
You are a covered entity — a practice, clinic group, surgery center, lab or behavioral-health provider — running EHRs, imaging, connected devices and a changing workforce, with a risk analysis that hasn’t kept pace with any of them.
Billing, coding, transcription, IT and managed-service, analytics and cloud companies that touch PHI on someone else’s behalf, and must flow the same obligations down to the vendors they use.
A breach, a patient complaint or a data request from OCR has turned HIPAA from a contract clause into a live question. You need to know where you stand and what to fix first.
No one — HIPAA has no official certification
Your own documented compliance, examined by OCR in an investigation or audit and by your customers through security questionnaires and business associate agreements
HHS does not certify or endorse anyone’s HIPAA compliance, so a “HIPAA certificate” is only ever the seller’s own badge. Readiness gives you what does count — a documented risk analysis, working safeguards and evidence — and if a customer wants third-party assurance, it prepares you for a HITRUST or SOC 2 assessment with the assessor you choose.
A written, enterprise-wide risk analysis of your ePHI — the document OCR asks for first — with threats, vulnerabilities, likelihood, impact and risk ratings you can defend line by line.
Prioritized treatments for every significant risk, with owners and accepted residual risk recorded, so the analysis leads to action instead of a shelf.
Every Security Rule standard and implementation specification mapped to your current state, with required and addressable items clearly separated and each addressable decision documented.
Where PHI is created, stored, processed and sent, including SaaS, cloud and vendor connections — the asset inventory and network view the proposed rule would make explicit.
HIPAA security policies and procedures written for how your organization actually works, ready for leadership to approve and your workforce to follow.
A review of the business associate agreements you sign and the ones you need from your own vendors, with missing agreements and weak flow-down terms called out.
A documented process for assessing a suspected breach of unsecured PHI and for notifying affected individuals, HHS and, where required, the media on the deadlines the rule sets.
Organized evidence and plain, accurate answers for the hospital and payer security questionnaires that hold up your deals.
Better found now, by people on your side, than by your assessor.
A “risk analysis” that is really a checklist or questionnaire, not an assessment of threats and vulnerabilities to all ePHI
A risk analysis done once and never updated after new systems, new vendors or an incident
Addressable specifications treated as optional, with no documented reasoning behind the decision
ePHI in places nobody inventoried: shared drives, email, spreadsheets, test environments, analytics tools and personal devices
Missing or outdated BAAs, especially with subcontractors and cloud vendors
Audit logs that are collected but never reviewed, so inappropriate access to records goes unnoticed
Backups that exist but have never been restored, and contingency plans that have never been tested
Terminations and role changes that leave access to EHRs, email and cloud consoles in place
The risk analysis must cover vulnerabilities, not just policies; an internal test shows how far an attacker on your network could get toward systems holding ePHI.
What the test coversInternet-facing VPNs, remote access, email and portals are where many healthcare intrusions begin, and the proposed Security Rule update would make penetration testing an explicit expectation.
What the test coversPatient portals, provider dashboards and scheduling apps put ePHI one broken access check away from the wrong person.
What the test coversFHIR and HL7 interfaces, EHR and payer integrations, and partner APIs move PHI between systems and need authorization tested record by record.
What the test coversWhere ePHI lives in AWS, Azure or Google Cloud, misconfigured storage, identity and logging are among the most common causes of exposure.
What the test coversRegular scanning feeds the risk analysis and the evaluation standard, and is one of the measures the proposed Security Rule update names explicitly.
What the test coversPhishing is a leading route into healthcare networks; testing your workforce shows whether the security awareness and training safeguard is working.
What the test coversConnected medical and building devices often share networks with ePHI and can’t be patched like ordinary IT, so they belong in the risk analysis with real evidence.
What the test coversClinical, staff and guest Wi-Fi often run beside systems that hold ePHI; a wireless test shows whether the technical safeguards you rely on actually keep them apart.
What the test coversDesktop clinical and billing applications often store or cache ePHI on the endpoint; testing them shows whether access control and encryption hold where the data actually sits.
What the test coversNo. HHS and OCR do not certify, accredit or endorse anyone’s HIPAA compliance, and there is no official HIPAA certificate for an organization or a product. Anyone selling a “HIPAA certificate” is selling their own badge. What customers and regulators actually look for is evidence: a current risk analysis, a risk management plan, policies that match practice, signed BAAs and proof that safeguards operate. If a buyer insists on independent assurance, the usual answers are a HITRUST certification or a SOC 2 report that includes HIPAA-related criteria, each issued by an assessor you choose.
Yes. Since the HITECH Act and the Omnibus Rule, business associates are directly liable for complying with the Security Rule and with certain Privacy Rule and Breach Notification obligations, and OCR can investigate and penalize them. Your BAA sets the contractual terms, but the regulatory obligation exists even if a covered entity never sends one. The same applies one level down: vendors that handle PHI for you are subcontractor business associates, and you need BAAs with them.
OCR expects it to be accurate and thorough. It should cover all the ePHI you create, receive, maintain or transmit, wherever it lives; identify realistic threats and the vulnerabilities they could exploit; assess current safeguards, likelihood and impact; assign risk levels; and be documented and kept current as your environment changes. OCR’s own guidance and NIST SP 800-66 describe these elements. A vendor questionnaire, a policy review or a vulnerability scan on its own is not a risk analysis, though each can feed one.
It does not mean optional. For each addressable implementation specification — encryption of data at rest is the best-known example — you assess whether it is reasonable and appropriate for your environment. If it is, you implement it. If it isn’t, you document why and implement an equivalent alternative measure where one is reasonable. That documentation is what matters when someone asks. The proposed Security Rule update would remove most of the distinction and make nearly every specification required, which is one more reason to take addressable items seriously now.
HHS published a proposed rule to update the Security Rule that would, among other things, call for a written technology asset inventory and network map, multi-factor authentication, encryption of ePHI, regular vulnerability scanning and penetration testing, and tested backup and recovery. Treat it as a proposal until HHS publishes a final rule, and expect the final text to differ in places. Most of what it describes is already good practice and already expected by hospital vendor-risk teams, so building toward it is rarely wasted. Readiness measures you against both the current rule and the proposal, so you can see which gaps matter today and which are coming.
The current Security Rule does not name penetration testing, but it does require a thorough risk analysis that identifies vulnerabilities and a periodic technical evaluation of your safeguards, and testing is the most direct evidence for both. Hospital vendor-risk teams and cyber insurers often ask for a recent penetration test report, and the proposed update would make penetration testing and vulnerability scanning explicit. Because CyberlySecure also performs penetration testing, you can get the testing and the readiness work from one team that understands both halves.
Nothing removes the duty to notify after a breach of unsecured PHI, but preparation changes the conversation. PHI encrypted in line with HHS guidance is not “unsecured,” so a lost encrypted laptop may not be a reportable breach at all. And under a 2021 amendment to the HITECH Act, HHS must consider whether you had recognized security practices in place, such as the NIST Cybersecurity Framework or the 405(d) practices, when it decides penalties and audit outcomes. A documented program is evidence in your favor.
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.
Not sure where to start? One of our testers reviews your internet-facing footprint and sends you a short summary of what an attacker would see — free. Nothing you don’t own is ever touched, and there’s no sales sequence.
Free. No obligation.
