Buyer guides for organizations asked to prove HIPAA Security Rule compliance: what a HIPAA certification is and is not, risk analysis, cost, vendor obligations, business associate agreements, OCR enforcement, penetration testing, penalties and the pending rule changes.
Why there is no official HIPAA certification, what HHS says about third-party HIPAA certificates and seals, what the Security Rule's evaluation standard actually requires, and what customers can reasonably ask a vendor for instead.
How to run the risk analysis the Security Rule requires: scope, the elements OCR expects, documentation and update triggers, the free HHS SRA Tool, NIST SP 800-66 Rev. 2 and SP 800-30 methods, and why OCR's Risk Analysis Initiative makes it the first thing investigators ask for.
What Security Rule compliance costs and why: the cost factors the rule itself tells entities to weigh, HHS's own cost estimates for the proposed rule, the cost of getting it wrong (penalties and settlements), and which activities drive spend.
What the Security Rule means for software, SaaS and cloud companies that handle ePHI for health care customers: when a vendor becomes a business associate, direct liability, the encrypted-data rule for cloud providers, BAAs and SLAs, and what customers will ask to see.
What a business associate agreement must contain for Security Rule purposes, who needs one, how subcontractor flow-down works, the incident reporting clause, and the changes the 2025 proposal would make.
How OCR finds and handles Security Rule problems: complaints, compliance reviews after breach reports, the HIPAA audit program, what investigators request, how cases end in technical assistance, resolution agreements or civil money penalties, and what recent cases cite.
Whether HIPAA requires penetration testing today (it does not name it), where testing fits under the evaluation and risk analysis standards, what NIST SP 800-66 Rev. 2 suggests, and the annual penetration test and six-month scanning the 2025 proposal would require.
What Security Rule violations can cost: the four culpability tiers, the 2026 inflation-adjusted amounts, HHS's lower annual caps under its 2019 enforcement discretion notice, how settlements differ from civil money penalties, and recent amounts.
The January 2025 proposal to overhaul the Security Rule and its status as of October 2026: what would change (no more addressable, mandatory encryption and MFA, asset inventory, 72-hour restoration, annual audits and penetration tests), HHS's cost estimate, and the projected timeline.
Whether the Security Rule applies to your organization: health plans, clearinghouses and providers that bill electronically, business associates and their subcontractors, why only electronic PHI is covered, and how HITECH made vendors directly liable.
What the Security Rule actually requires: the general rules, the administrative, physical and technical safeguard standards, the factors that let a small practice and a large plan choose different measures, organizational requirements and six-year documentation.
How addressable implementation specifications really work: why addressable is not optional, the three choices the rule allows, how the risk analysis drives the decision, the documentation OCR expects, encryption as the best-known example and the proposal to make everything required.
A practical checklist of what OCR expects to see: risk analysis and risk management, a named security official, written policies, training and sanctions, business associate agreements, contingency planning, periodic evaluation, activity review and six-year records.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.