Privacy & data protection
HIPAA
HIPAA (Health Insurance Portability and Accountability Act)
HIPAA sets the US requirements for protecting health information. We help you implement the Security and Privacy Rule safeguards and build the evidence to show you comply.
What HIPAA is
HIPAA is US federal legislation that governs how protected health information (PHI) is handled. Its Privacy Rule controls how PHI may be used and disclosed, while its Security Rule sets administrative, physical and technical safeguards for electronic PHI. The Breach Notification Rule sets out what must happen when protected information is exposed.
HIPAA is a regulation enforced by the US Department of Health and Human Services, not a standard you are certified against. There is no official HIPAA certificate. Compliance is demonstrated through a documented risk analysis, implemented safeguards, policies, training and Business Associate Agreements with the vendors who handle PHI on your behalf.
The structure of the standard
Privacy Rule
Sets national standards for how protected health information may be used and disclosed and gives individuals rights over their records, including access and amendment.
Security Rule
Sets the safeguards that protect electronic protected health information and is organised into administrative, physical and technical safeguard groups.
Security Rule · administrative safeguards
Cover the governance side, including the required risk analysis, workforce training, access management and contingency planning.
Security Rule · physical safeguards
Address physical access to facilities, workstations and devices, along with media controls for the disposal and reuse of hardware.
Security Rule · technical safeguards
Address access control, audit logging, integrity protection and transmission security for systems that store or move electronic PHI.
Breach Notification Rule
Defines what counts as a breach of unsecured PHI and the notifications owed to affected individuals, the regulator and, in larger breaches, the media.
Enforcement Rule
Sets out how the Office for Civil Rights investigates complaints and the penalty tiers that apply to violations.
HITECH and the Omnibus Rule
Later amendments that extended direct liability to business associates and tightened breach and enforcement provisions.
Who needs it
- Covered entities such as healthcare providers, health plans and clearinghouses
- Business associates, including SaaS and cloud vendors that handle PHI for a covered entity
- Any company processing US health data that is being asked to sign a Business Associate Agreement
What you get
- A PHI data map and documented Security Rule risk analysis
- Administrative, physical and technical safeguards with supporting policies
- Penetration test evidence for systems handling electronic PHI
- A compliance evidence pack and Business Associate Agreement support
Timelines depend on your scope, the systems that touch PHI and your current safeguards. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
HIPAA was enacted in 1996, with the Privacy Rule, Security Rule and Breach Notification Rule added through later rulemaking and strengthened by the HITECH Act in 2009 and the Omnibus Rule in 2013. The version in force today still rests on those rules, administered by the Office for Civil Rights within the US Department of Health and Human Services. A proposed update to the Security Rule is under consideration, published as a notice of proposed rulemaking, that would strengthen and make more specific the cybersecurity expectations for electronic PHI; it is not yet final and the existing Security Rule remains the standard you are measured against. Treat the proposal as a direction of travel to prepare for rather than a changed obligation, and keep your risk analysis and safeguards current in the meantime.
What it costs
There is no HIPAA certificate to buy, because HIPAA is a regulation you demonstrate compliance with rather than a scheme an accredited body certifies you against. Your costs are our scoped advisory and implementation fee, quoted up front once we understand your size, the systems that touch PHI and where you are starting from, plus any independent assessment, audit, penetration test or legal and privacy input you choose to bring in, which those parties price separately on their own terms. tr3labs is never the certifier, auditor or regulator; a customer or a third party may run a HIPAA assessment against you, and that engagement is theirs to cost. We scope it with you rather than quote blind.
How tr3labs gets you there
Scope and risk analysis
We identify where PHI lives and flows, perform the risk analysis the Security Rule requires, and measure your current safeguards against the Privacy, Security and Breach Notification Rules.
Build the safeguards
We help you implement the administrative, physical and technical safeguards, draft the required policies, support your training, and get your Business Associate Agreements in order.
Test and prove
We run penetration testing and security reviews against the systems holding electronic PHI so your technical safeguards are evidenced, not just asserted.
Readiness and attestation support
We assemble the documentation that evidences your compliance and prepare you to respond confidently to customer due diligence or a third-party HIPAA assessment.
HIPAA and SOC 2 compared
Both get raised when a buyer is checking whether their data is safe with you, so health companies often field requests for each one and conflate them.
| HIPAA | SOC 2 | |
|---|---|---|
| Covers | US protected health information | Security and related trust criteria for a service |
| Who asks for it | US health regulators and partners handling PHI | Enterprise buyers doing vendor due diligence |
| Core idea | Legal obligation to protect health data | Independent report on your controls |
| Audit model | No certificate; compliance is evidenced | Report issued by a licensed CPA firm |
| Often held with | Business Associate Agreements | ISO 27001 and vendor security reviews |
HIPAA FAQ
- How much does HIPAA compliance cost?
- There is no HIPAA certificate to buy. You pay our scoped advisory and implementation fee, quoted up front, plus any independent assessment, audit, penetration test or legal input you choose to bring in, which those parties price on their own terms. tr3labs is never the certifier or regulator.
- How long does HIPAA compliance take?
- It depends on your scope, the systems that touch PHI and your current safeguards. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Is there an official HIPAA certificate?
- No. HIPAA is a regulation enforced by the US Department of Health and Human Services, not a certifiable standard, so no official certificate exists. Compliance is demonstrated through a documented risk analysis, implemented safeguards and evidence. Be cautious of anyone selling a HIPAA certificate as proof.
- What is a Business Associate Agreement?
- It is a contract required by HIPAA between a covered entity and a vendor that handles protected health information on its behalf. It sets out each party's responsibilities for safeguarding that data. We help you put the right agreements in place with the vendors in scope.
- Does HIPAA require penetration testing?
- HIPAA does not name a specific test, but the Security Rule requires you to assess risks to electronic PHI and apply appropriate technical safeguards. Penetration testing is a well-established way to evidence that those safeguards work, and our testing supports exactly that.
The services that get you there
Related standards
Related reading
India's DPDP Act: A Practical Compliance Guide (2025)
What India's Digital Personal Data Protection (DPDP) Act requires, who counts as a data fiduciary, what the 2025 Rules add, the penalties, and a practical path to compliance.
9 min read
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read