Last verified: October 2026, against the HIPAA regulation text and HHS documents in the Federal Register. General information, not legal advice — confirm with your compliance officer or attorney.
What is HIPAA compliance? For a practice, it means running an ongoing program that meets the HIPAA Privacy, Security and Breach Notification Rules: named officials, a risk analysis, written policies, trained staff, signed vendor agreements and records that prove it. It is something you do and document every year, not a badge you buy once.
In short: HIPAA compliance is a documented set of habits, not a certificate. HHS doesn't certify anyone. A compliant small practice can show a current risk analysis, policies its staff actually follow, training records, a BAA for every vendor touching patient data, a posted privacy notice, and a plan for breaches and records requests.
HIPAA compliance in one paragraph
HIPAA applies to covered entities, which include most practices that bill insurance electronically, and to the vendors that handle their patient data. Compliance means three things at once: you only use and disclose what counts as PHI in ways the rules permit, you protect electronic PHI with reasonable safeguards, and you notify the right people when something goes wrong. Each rule also says "document it." If it isn't written down, OCR (HHS's Office for Civil Rights, the enforcer) will treat it as not done.
Why there's no official HIPAA certification
HHS made this choice deliberately. When it published the Security Rule in 2003, commenters asked for federally certified products and external certification. HHS responded (opens in a new tab) that it does "not intend to create certification criteria," that it "will not assume the task of certifying software and off-the-shelf products," and that "evaluation can best be handled through the marketplace."
So the certification seals on vendor websites are private products. Some reflect a real third-party assessment, which can be useful evidence. None is a government approval, and none transfers your obligations to the vendor. Your compliance depends on how your practice uses the tool, not on the vendor's badge.
The pieces of a compliance program
| Component | What it means for a small practice | Rule |
|---|---|---|
| Privacy and security officials | Name who owns policies and complaints; one person can do both | 164.530(a); 164.308(a)(2) |
| Risk analysis and risk management | Assess risks to ePHI, then reduce them and record how | 164.308(a)(1)(ii)(A)–(B) |
| Policies and procedures | Written, sized to your practice, updated when the law changes | 164.530(i); 164.316 |
| Workforce training and sanctions | Train new hires within a reasonable time; apply sanctions for violations | 164.530(b), (e); 164.308(a)(5) |
| Business associate agreements | A written contract with every vendor that handles PHI | 164.308(b); 164.314(a) |
| Notice of Privacy Practices | Given at first service, posted in the office and on your website | 164.520 |
| Patient-rights processes | Records requests answered within 30 days, amendments, restrictions | 164.524–164.528 |
| Breach response | Assess, then notify without unreasonable delay and within 60 days of discovery | 164.400–164.414 |
| Documentation retention | Keep policies, training and assessments for six years | 164.530(j); 164.316(b)(2) |
Three items catch small practices off guard. The Notice of Privacy Practices must be "prominently" posted on the website if you have one that describes your services, under 164.520(c)(3)(i) (opens in a new tab). The right of access (opens in a new tab) gives you 30 days to act on a records request, with one 30-day extension. And six-year retention (opens in a new tab) applies to the documentation itself, so a training log from this spring has to survive until 2032.
The regulation text for most rows is in 164.308 (opens in a new tab) and 164.316 (opens in a new tab). For the use-and-disclosure side, see the Privacy Rule. The HIPAA risk assessment walkthrough covers the step OCR cites most.
What 'HIPAA-compliant' means when a vendor says it
When a form builder, CRM or chat tool says it is "HIPAA compliant," translate it into two testable claims: the vendor will sign a business associate agreement for the plan you're buying, and it has safeguards to back that agreement up. Section 164.314(a) (opens in a new tab) requires the contract to bind the vendor to the Security Rule, flow the same terms down to its subcontractors and report security incidents, including breaches, to you.
Ask five questions before any patient data goes in:
- Will you sign a BAA, and for which plan? Many vendors sign only on higher tiers.
- Where is the data stored? Country, and whether it is kept separate from non-PHI data.
- Is it encrypted in transit and at rest?
- Who can access it? Role-based permissions, multi-factor login and an audit log.
- What are the breach terms? How quickly they notify you, and what help they give.
A vendor that won't answer in writing isn't ready for PHI. Our guide to checking vendors' HIPAA claims applies these questions to common marketing tools, and business associate agreements explains what the contract must say.
Medfy answers them this way: patient information from its forms, chat, inbox and CRM is stored in separate, encrypted HIPAA databases in the US or Canada; Medfy signs a BAA with every practice before any patient data flows; and ad platforms never receive patient data. More in Medfy's HIPAA approach.
How OCR checks compliance: complaints, breaches, audits
OCR has four ways in, and only the first is in your control.
- Complaints. Any person can file a complaint (opens in a new tab), generally within 180 days. A patient whose records request went unanswered is the classic case.
- Breach reports. OCR's breach portal (opens in a new tab) says it investigates all breaches affecting 500 or more people; smaller ones may be investigated depending on resources and priorities.
- Compliance reviews. OCR must open one (opens in a new tab) when a preliminary review suggests willful neglect, and may open one in any other circumstance.
- Audits. The HITECH Act requires periodic audits (opens in a new tab). In its January 2025 Security Rule proposal (opens in a new tab), HHS reported that its 2016–2017 audits of 166 covered entities found only 14 percent substantially fulfilling their risk analysis obligations.
A finding of noncompliance doesn't automatically mean a fine. Under 160.312 (opens in a new tab), OCR may resolve a case "by informal means," including demonstrated compliance or a corrective action plan. Your documentation decides which way it goes.
Compliance for a five-person practice: a realistic scope
A five-person practice does not need a compliance department. It needs about two days to set up and a few hours each quarter. A realistic split:
- Practice manager (privacy and security official): owns the risk analysis, the vendor list with BAAs, the policies binder and the breach log.
- Owner or lead clinician: approves the risk management plan and signs off on sanctions.
- Front desk: trained on verification, records requests, review replies and what never goes in email.
- IT contractor or MSP (managed service provider): under a BAA, handles MFA, encryption, backups and device wipes.
- Website vendor: under a BAA if forms or chat collect patient data; no pixels on form pages.
The HIPAA compliance checklist turns this into a one-page tracker. If you want an outside view of the marketing side first, the free marketing audit flags privacy risks such as tracking pixels on patient forms.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Is there an official HIPAA certification?
No. HHS doesn't certify practices, products or vendors as HIPAA compliant. When it wrote the Security Rule, HHS said it would not certify software and left evaluation to the marketplace. Private companies sell certificates and seals, and some are useful as evidence of effort, but none is a government approval and none protects you in an OCR investigation. What protects you is a documented, working compliance program.
Who is responsible for HIPAA compliance in a practice?
The practice itself, as the covered entity. HIPAA requires you to designate a privacy official and a security official, who can be the same person, often the practice manager. The owner still carries the legal responsibility, and every workforce member must follow the policies. Vendors are responsible for their own safeguards under their BAAs. Confirm role assignments with your compliance officer or attorney.
How often should a practice review HIPAA compliance?
The current Security Rule requires periodic evaluations and documentation reviews, plus updates whenever your systems or operations change, without naming a fixed interval. Many practices review once a year and after any new vendor, move or breach. HHS's January 2025 proposal would require a compliance audit at least every 12 months, but it is not final. Set your cadence with your compliance officer or attorney.
What does it mean when a vendor says it's HIPAA compliant?
On its own, very little. It should mean the vendor will sign a business associate agreement for the product you use and has administrative, physical and technical safeguards in place. Ask for the BAA, where data is stored, how it is encrypted, who can access it, and how fast they report breaches. If they won't sign a BAA, keep patient information out of the tool.