Is there a HIPAA certification, and what should a vendor provide instead?
When a customer, contract or procurement form asks for HIPAA certification, the honest answer is that no official HIPAA certification exists, and HHS does not endorse or recognize certificates or seals issued by private organizations. Your buyer is asking for assurance, not a document from a federal body, so the useful question is what evidence supports the vendor's security claims. The Security Rule does not require anyone to certify compliance. It does require a periodic technical and nontechnical evaluation of how well policies and procedures meet the rule, repeated after environmental or operational changes (45 CFR 164.308(a)(8)). That evaluation can be done internally or by an external organization, but the entity remains responsible for its own controls. That division of roles should shape what you ask for. The organization owns its controls and decides how they operate. An implementation partner can prepare systems, configurations, policies and evidence, but it cannot sign off on compliance for the organization. Only an independent assessor can issue a report or opinion on the result. Ask a vendor to name its evaluation owner, the date of its most recent evaluation, the scope it covered, and who performed it. Ask for the written risk analysis summary, the list of addressable specifications it chose to implement or document as not reasonable, and the business associate agreement it will sign. A third-party report, if one exists, should be read for its scope and period, not for a seal.
The answer also depends on which side of the relationship you sit on. A covered entity buying services from a vendor must obtain satisfactory assurances through a business associate agreement and should assess whether the vendor safeguards ePHI adequately. A business associate is directly liable for complying with the Security Rule, so a customer's review of a vendor's controls does not transfer that liability, and a vendor cannot pass its duties to a certificate holder. Confirm with your legal or privacy team which role applies to each data flow, then match the request to it: a covered entity should focus on contractual terms and evaluation evidence, while a business associate should document its own risk analysis and evaluation so it can answer those requests directly.
What the evaluation standard in 164.308(a)(8) actually requires
The Security Rule does not ask for a certificate. It asks covered entities and business associates to evaluate, on a recurring basis, how well their policies and procedures meet the rule, and to repeat that evaluation when their environment changes. The four cards below separate the duty itself from the choices an organization makes about who performs it.
A periodic technical and nontechnical evaluation
The standard expects a recurring review that covers both technology and people: configurations, logs and access settings on one side, and policies, training records, workforce practices and vendor arrangements on the other. A one-time penetration test or a framed certificate does not meet it on its own. When you assess a vendor, ask for the date of its last evaluation, who ran it, and whether it covered nontechnical controls as well as systems.
The first evaluation against the rule
The initial evaluation measures current policies and procedures against each Security Rule requirement, so it works as a gap baseline. Its output should be a written list of where the organization meets a requirement, where it does not, and what it will do about each gap. Buyers should expect to see this baseline document, along with the risk analysis it relies on, before they accept a vendor's security claims.
Re-evaluation after environmental or operational changes
The rule also requires another evaluation when something changes that could affect ePHI security, such as a new cloud platform, a merger, a new electronic health record, or a shift in staffing or ownership. This trigger is easy to miss because it is event driven rather than calendar driven. When reviewing a vendor, ask which changes in the past year prompted a re-evaluation and what the vendor did afterward.
Internal or external performance
The evaluation can be carried out by the organization's own staff or by an outside organization that provides evaluation or certification services. Either way, the covered entity or business associate remains responsible for the result. An external report helps as evidence of independent review, but it does not transfer the duty or replace the organization's own decisions. Ask who performed the evaluation, what their qualifications were, and whether the scope matches the systems that actually hold ePHI.
What to ask a vendor for instead of a certificate
A covered entity remains responsible for ensuring that the business associates it works with protect electronic PHI, so the assessment should test how the vendor meets the Security Rule rather than accept a label. Start with a short, specific request list and read the documents against the standards they claim to address. The HHS FAQ on certification makes clear that a private certification does not relieve either party of its obligations, so the evidence has to come from the vendor's own program.
- Current risk analysis summary: A dated summary showing scope, threats considered, likelihood and impact ratings, and the risk management decisions that followed.
- Written policies mapped to standards: Policies and procedures that cross-reference the administrative, physical and technical safeguards they implement.
- Business associate agreement: The signed agreement, plus the subcontractor flow-down terms that govern the vendor's own vendors.
- Evaluation reports and their dates: Records of the periodic technical and nontechnical evaluation required by 45 CFR 164.308(a)(8), including the trigger for any re-evaluation after environmental or operational change.
- Workforce training records: Completion records and the content covered, with dates.
Confirm that each document is current, signed or approved by a named person, and specific to the services you are buying.
A business associate receiving a customer questionnaire should answer with evidence it can produce on request, not with a statement of compliance. Each answer should point to a document that exists, has a date and has an owner. Because business associates are directly liable for complying with the Security Rule, the answers also need to reflect the vendor's own obligations, not only those of its customers.
- Incident response and breach procedures: The written plan, the named roles, and the process for reporting incidents to covered entities under the business associate agreement.
- Risk analysis and risk management records: A summary the vendor can share under confidentiality terms, with the review date and the open items it is tracking.
- Subcontractor list and assurances: Which subcontractors touch ePHI and the agreements that bind them to the same restrictions.
- Evaluation history: Dates of past evaluations and what changed as a result, including any findings closed out.
- Scope statement for each answer: A clear note of which systems and services each answer covers, so customers do not assume coverage of products the questionnaire never mentioned.
Illustrative example: a questionnaire answer that says "we encrypt data" should link to the encryption policy, the key management procedure and the date it was last reviewed. Answers without a document behind them deserve follow-up.
When a vendor presents a third-party HIPAA certificate or seal, procurement should treat it as one input and ask for the report behind it. HHS does not endorse or recognize private HIPAA certifications, and a certificate does not preclude a later finding of violation. The useful questions are who performed the work, what it covered, and what it did not test.
- Independent assessment report: The full report, not a badge or summary page, with the assessment period stated.
- Assessor identity and independence: The name of the firm and individuals, and confirmation that they had no role in designing or operating the controls they assessed.
- Scope of the assessment: The systems, facilities, products, locations and business processes included, and any exclusions that matter to your data flows.
- Findings and remediation status: Open findings, corrective actions and dates, as recorded in the report.
- Permission to verify: A written statement that the vendor will let you check the certificate's status and scope directly with the issuer.
Confirm the assessor's independence and the report's scope before relying on the document, and record which Security Rule areas it does not address so they can be covered by your own review.
What a third-party HIPAA assessment can and cannot show
An independent assessment can show that, on a particular date, a defined set of systems, policies and procedures was tested against the Security Rule and what the assessor found. It cannot show that the organization is compliant today, will remain compliant next quarter, or was compliant during periods it did not examine. The Security Rule's evaluation standard in 45 CFR 164.308(a)(8) is periodic and also triggered by environmental or operational changes, so a single report is a snapshot. Before buying one, confirm in writing which systems, locations, business units and ePHI flows are in scope, which Security Rule standards the assessor tested, and whether the work covered the implementation specifications marked addressable as well as those marked required.
An outside review can count as part of the evaluation. HHS's 2003 FAQ says the evaluation may be performed internally or by an external organization that provides evaluation or certification services. That only helps if the engagement is scoped to the Security Rule itself and not to a generic framework or a seal. The assessment does not replace the organization's own risk analysis under 45 CFR 164.308(a)(1), which the entity must own, keep current and document. A third-party report should be an input to that analysis, not a stand-in for it. Ask who will maintain the risk management plan after the assessor leaves, and who will record the decisions on addressable specifications.
A report also does not bind the Office for Civil Rights. HHS does not recognize private certifications, and a third-party assessment does not prevent OCR from later investigating and finding a Security Rule violation. Business associates remain directly liable under the Security Rule, so a customer cannot rely on a vendor's report to discharge its own obligations, and a vendor cannot pass its liability to an assessor. Treat any assessment as evidence that supports your position in an OCR inquiry, and plan to produce the underlying records, including your risk analysis, policies and activity reviews, on request.
Common questions about HIPAA certification and assessments
Does a HIPAA seal protect us from OCR enforcement action?
No. A HIPAA seal does not protect an organization from OCR action. HHS states that it does not endorse or recognize private organizations' certifications regarding the Security Rule, and that such certifications do not relieve covered entities of their legal obligations. HHS also states that a third-party certification does not prevent it from later finding a security violation. OCR decides whether a violation occurred by looking at your own risk analysis, policies, safeguards and records. Before you rely on any seal, ask the vendor what it covers, who issued it, and whether it has been tested against the Security Rule's standards and implementation specifications.
Is a HIPAA certificate required by law?
No. No Security Rule standard or implementation specification requires a covered entity to certify its compliance, according to HHS. What the rule does require is a periodic technical and nontechnical evaluation under 45 CFR 164.308(a)(8), first against the rule and then after environmental or operational changes. That evaluation can be performed internally or by an external organization that provides evaluation or certification services. Business associates are directly liable for complying with the Security Rule, so the obligation stays with each organization even when it hires an outside party.
Can a vendor say it is HIPAA certified?
Vendors should not describe themselves as HIPAA certified, because no official HIPAA certification exists. A vendor can truthfully say it has implemented Security Rule safeguards, signed business associate agreements, and undergone an evaluation or assessment by a named firm. Ask for the scope of that work, the date it covers, the findings, and the remediation status. Ask the vendor to explain its own risk analysis and how it evaluates safeguards after changes. Confirm any claim with the assessor's engagement letter and the vendor's written documentation rather than a logo on a website.
What does an outside HIPAA evaluation cost in effort, and who must be involved?
The rule does not set a price or a duration for an evaluation, and no researched figure is available here, so confirm the numbers with each firm in writing. Cost depends on the number of systems that store or transmit electronic PHI, the number of locations and business associates, the depth of the technical testing, and how ready your documentation is. Expect the work to involve the security official, system owners, privacy staff, legal counsel for business associate agreements, and the people who run backups and access reviews. Ask each proposal to list its deliverables, the systems in scope, the staff involved, and what the organization must provide.
Can our organization perform the HIPAA evaluation ourselves?
Yes. The Security Rule allows an evaluation to be done internally or by an external organization, so a covered entity or business associate can run its own evaluation if it has the skills, independence and documentation to support the results. Internal teams should be able to compare current policies and technical controls against each standard, record the findings, and track remediation. Many organizations combine internal ownership with outside testing or review. Whichever path you choose, the organization remains responsible for the outcome, and the evaluation must be repeated after environmental or operational changes.
What would the proposed annual compliance audit change for us?
The January 6, 2025 proposed rule (90 FR 898) would add an annual compliance audit as proposed 45 CFR 164.308(a)(14). As of October 2026, that rule has not been finalized, so the requirement does not apply yet. The proposal does not specify whether your staff or an outside party must perform the audit, so confirm that point in the final rule before budgeting. Until then, keep your current evaluation under 45 CFR 164.308(a)(8) current and documented. Track the rulemaking through the Federal Register and the latest Unified Agenda entry for RIN 0945-AA22.
What evidence should we ask an assessor to show us?
Ask for a written scope, the criteria used, and a description of the procedures performed, not just a conclusion. Useful evidence includes the risk analysis reviewed, the policies and procedures tested, samples of access reviews and audit log reviews, training and sanction records, business associate agreement inventory, backup and restoration test results, and a list of open findings with owners and dates. The assessor should state what it did not test. An independent auditor or certification body issues any formal report, and DeployOpen prepares systems and evidence for assessments without issuing reports or certificates.
Where can we read the rule's evaluation standard ourselves?
Start with the text of 45 CFR 164.308(a)(8) on the eCFR, which describes the evaluation standard in plain structure: an initial evaluation against the rule, then repeat evaluations after environmental or operational changes that affect electronic PHI. Read HHS's 2003 FAQ on certification next, since it explains why seals are not required and how an external evaluation fits in. NIST SP 800-66 Rev. 2 provides informational guidance and sample questions for implementing the standard, though it is not legally binding. Confirm with your counsel how these sources apply to your specific systems.
How the pending rule could change what buyers request
HHS proposed a major revision to the Security Rule on January 6, 2025 (90 FR 898), and one change matters directly for anyone buying HIPAA assurance: the proposal would add an annual compliance audit to the rule, as proposed 45 CFR 164.308(a)(14). The proposal does not say whether the covered entity or business associate performs that audit or whether an outside party must. As of October 2026 the rule has not been finalized, and the latest Unified Agenda entry for RIN 0945-AA22 lists it under Long-Term Actions with final action projected for July 2027. Until HHS publishes a final rule, no annual audit is required, and no certificate or seal can stand in for one.
Buyers should treat the proposal as a signal, not a requirement. Watch the Federal Register for the final rule and its effective and compliance dates, which the proposal's status page and the Unified Agenda entry will show before publication. Ask vendors now which party performed their last independent security review, what scope it covered, and whether they would share the summary under a non-disclosure agreement. If the final rule names an audit but leaves the performer open, a vendor that already runs internal and external evaluations will be easier to confirm against the new text than one that has never tested its controls.
For contracts, the practical step is to write terms that can adapt. Include a clause requiring the vendor to comply with HIPAA Security Rule amendments as they take effect, to cooperate with reasonable assessments that the law or a regulator requires, and to share the results of required audits within a stated period. Ask the vendor to confirm in writing who would perform any future audit and how the cost would be allocated, because the answer will change the price and the timeline. Have counsel review the wording against the final rule once it is published, and confirm the current status with the Federal Register and HHS before signing.
How to check an assessor or consultant before signing
No HIPAA certificate exists, so the question is who did the work, how it was scoped and who stands behind the conclusions. The cards below cover the checks that separate a useful independent evaluation from a seal that proves little. DeployOpen prepares systems, controls and evidence for your assessment, but it does not issue reports or certificates.
Confirm independence from the assessed party
Ask whether the firm builds, operates or resells the systems it will evaluate, and whether any staff member designed the controls under review. HHS's 2003 FAQ says the evaluation can be done internally or by an external organization, so independence is your choice to weigh, not a federal test. A firm that configured your environment can still help you prepare, but its findings about that environment deserve a second, separate review. Put the answer in writing before engagement.
Get the scope and evidence list in writing
Require a written statement of which systems, facilities, workforce groups and business associates are in scope, and which Security Rule standards the work covers. Ask for the evidence list the engagement will produce, such as the risk analysis record, policies, access reviews and activity logs. A vague scope such as "HIPAA readiness" leaves you unable to tell later what was tested. Fixed scope, deliverables and timing should be agreed before work starts.
Ask who issues the report and what it says
Ask whether the output is a memo, a findings log or a formal report, who signs it, and what it does and does not conclude. A report that states a firm "certifies" you as HIPAA compliant overstates what any private firm can give you. Only HHS, through its own enforcement, decides whether a violation occurred. Ask the firm to state its limitations, the period it covers and what would make the conclusions stale.
Verify Security Rule experience without accepting seals
Ask for named examples of Security Rule work, such as risk analysis, evaluation under 164.308(a)(8), or business associate program reviews, described in terms that do not identify clients. Ask which staff member holds the role, what training they have, and whether they have worked with the NIST SP 800-66 Rev. 2 resource guide. A badge or logo on a website is not evidence of Security Rule competence, and HHS does not endorse private certifications.
Keep the organization in control of its controls
Confirm in the contract that your organization owns the controls, the risk decisions and the final documentation, and that the consultant prepares systems and evidence on your behalf. DeployOpen works this way: it prepares systems, controls and evidence for assessments, and it does not issue audit reports, attestations or certifications. Any firm that says it can issue a HIPAA certificate on behalf of HHS should be treated as a red flag.
How DeployOpen prepares Security Rule evidence for an independent assessment
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, then prepares the systems, controls and evidence your organization can show to an assessor. DeployOpen does not issue HIPAA reports or certificates, because no such certificate exists and HHS does not recognize private certifications.
How we scope
- Engagements are fixed-scope, with systems, Security Rule requirements and deliverables agreed in writing before work starts.
- The written scope names which ePHI systems, environments and evaluation activities are covered for HIPAA certification explained.
- Scope also records what remains with your security official, workforce and any independent assessor you engage.
How we build
- Systems are built or hardened in your cloud accounts, data center or air-gapped network under your change control.
- Controls for the chosen standards are mapped to the configurations, policies and logs that will show them working.
- Security testing of applications, APIs and infrastructure is performed against the agreed scope to inform the evaluation.
How we hand over
- Documentation covers configurations, policies, procedures and evidence sources, written so your security official can maintain them.
- Evidence packages are organized by standard and implementation specification so an assessor can trace each claim.
- Handover includes a record of decisions on addressable specifications, including reasons and any equivalent alternative measures.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Re-evaluation after environmental or operational changes can be scoped as a follow-on engagement.
- Ask any assessor or certification-style provider to confirm in writing what they will issue and who is entitled to rely on it.
