Skip to content

Healthcare · HHS Office for Civil Rights

HIPAA Security, Privacy and Breach Notification Rules

A documented, accurate risk analysis is the first thing OCR asks for after a breach. Keep it current every day.

Take the 3-minute Cyber Hygiene Test

Rather skip the call? Get a fixed-fee HIPAA quote in writing.

One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing

Who it applies to

The businesses that carry HIPAA, and the pages written for them.

Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.

Healthcare & DentalNonprofits & Associations

Which packages prepare you for it

Practice Cybersecurity, Data Protection and HIPAA Package

Medical and dental practices, clinics, surgery centers, hospital departments and the business associates that serve them

Fixed feescoped in 30 minutes
Details →

Mock Audit Package: SOC 2, HIPAA or CMMC

Organizations within 90 days of a SOC 2 audit, an OCR inquiry or a C3PAO assessment, and any leadership team that wants to know before it counts

Fixed feescoped in 30 minutes
Details →

What it asks for

In plain English, what HIPAA expects you to have in place.

  • A documented risk analysisAccurate and thorough, covering every system that holds ePHI, and kept current. It is the first document an investigator asks for.
  • Administrative safeguardsA named security official, workforce training, sanction policy, access management and business associate agreements.
  • Physical safeguardsFacility access, workstation use and device and media controls, including disposal.
  • Technical safeguardsUnique user identification, access control, audit controls, integrity controls, transmission security and encryption where reasonable and appropriate.
  • Breach notificationDetect, assess, and notify individuals, HHS and where required the media, within the windows the rule sets.
  • Privacy Rule dutiesA notice of privacy practices, minimum necessary use, and a process for patient rights requests.

A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.

Or start with the 3-minute test

Where it starts

Your one-stop shop for HIPAA compliance

HIPAA has no certificate and no finish line, which is why a small practice never knows when it is done. There is a way to know.

The Security Rule asks for one thing before anything else: a documented, current risk analysis of where patient data lives and what threatens it. OCR asks for it first after a complaint or a breach, and its Risk Analysis Initiative has settled case after case where the document was missing or shallow.

Most compliance software gives you policy templates and a checklist. We write the risk analysis with you, fix what it finds, train your staff and keep the evidence current, so the file is ready on the day someone asks.

Take the history: tick what is true for you

Tick what applies and we show what your risk analysis has to cover. Nothing ticked yet means we start with the walk-around.

The steps

Eight steps from "are we HIPAA compliant?" to a file OCR accepts

The whole HIPAA journey, short version. We handle every step with you.

take the history

Decide: risk analysis first, or the full program

A risk analysis is the document HHS asks for first. A full program adds the policies, training, business associate agreements, access controls and breach plan that the analysis says you need. Most practices start with the analysis; a practice that has never written anything down needs the program.

Risk analysis only, or the full program

Risk analysis: the document first. Pick it if you have policies and training already, or if a prime, a partner or an insurer asked for the analysis itself.

Risk analysis vs full program at a glance
FeatureRisk analysisFull program
What you getThe dated analysis and a ranked fix listThe analysis, the fixes, policies, training, BAAs and the breach plan
TimeWeeksA quarter, then it runs all year
Who it suitsPractices with a program that needs a current analysisPractices starting from scratch, or after an incident
What OCR seesThe first document it asks forThe whole file
examine

Find where patient data actually lives

The EHR is usually well guarded. The data that leaks sits in the fax memory, the copier drive, the imaging vendor's remote access, the recall spreadsheet and the personal phone that texts the on-call doctor.

With AccuSights: we walk the building with you, on site or on a call, and write every location down. That list is the first page of the risk analysis.

diagnose

Write the risk analysis

Each place data lives, what threatens it, how likely and how severe, and what you have in place today. HHS separates this from risk management, which is fixing what you find.

With AccuSights: your engineer writes it in the structure OCR investigators read, dated and signed, with the ranked fix list behind it.

treat

Fix what it found

MFA on the EHR and email, encryption on every laptop, old accounts closed, vendor access switched to scheduled, the policies people actually follow, and training with a record.

Ten questions to ask before you sign

With AccuSights: remediation is in-house or with your IT provider, and we verify each fix in your real environment, not on a screenshot.

sign the BAAs

Get every vendor under agreement

Every vendor that creates, receives, keeps or sends patient data is a business associate and needs a signed agreement with the terms 45 CFR 164.504(e) requires. Cloud services included.

With AccuSights: we list the vendors, chase the agreements and file them where the next inspector can find them.

monitor the vitals

Keep it true, not just documented

A risk analysis is a living document. A new scanner, a new vendor or a departing employee changes it. Access logs have to be reviewed and incidents written up.

Control monitorIllustration
  • Laptops encryptedPassing
  • MFA on the EHR and emailPassing
  • Training records currentPassing
  • Vendor access scheduled onlyPassing

Does it pay for itself

-$3,008 a yearIt does not pay for itself on time alone. You would save about 83 hours, worth $4,992, against a $8,000 price. Break-even is 6.4 hours a week of manual work. It can still be worth it for a Type 2, where the real saving is exceptions you never get.

Most practices have no platform at all; the hours are the office manager's. Half is generous for a practice, so start lower.

With AccuSights: our endpoint agent and monitoring catch the drift, and your engineer updates the analysis when the practice changes.

second opinion

Test the defenses

The Security Rule requires a periodic evaluation, not a penetration test by name. The January 2025 proposal would add scanning and testing; it is still a proposal. A test is still the fastest way to find the open door.

With AccuSights: light testing in-house, with partners for a full external test when your size or your insurer calls for it.

annual checkup

Review it every year

Policies re-signed, training repeated, the risk analysis updated, the breach log reviewed, the vendor list checked. The file OCR asks for is the one you kept, not the one you wrote once.

With AccuSights: the annual review is on the calendar and mostly done by the time it arrives, because the evidence collected itself.

Why AccuSights

Why small practices pick AccuSights for HIPAA

Compliance software assumes someone in the practice will run it. We assume the office manager already has a job.

Priced for a startup, not a Series D

One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.

The endpoint agent is built in

Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.

A human who has done this before

A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.

Written once, read by every inspector

One control set maps to HIPAA, to the NIST framework HHS points to, and to the SOC 2 your larger clients may ask for next.

HIPAANIST CSF 2.0SOC 2CIS ControlsState privacy laws

What it costs

What HIPAA costs, in plain numbers

There is no certificate to buy and no auditor to pay, which is why the cost is mostly the work. Here is what is published.

$0The certification fee. There is no HIPAA certification; HHS does not endorse one.Source: HHS Security Rule FAQ (2026)
A fixed feeThe risk analysis and the fix plan, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)

Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.

Get my HIPAA quote

Self-serve compliance software

  • You get a portal and drive it yourself.
  • Expert help is often a separate purchase or a partner referral.
  • Device checks usually need an MDM you set up first.
  • Pricing comes after a sales call.

AccuSights

  • A named engineer runs it with you.
  • Guidance and remediation are included, not referred out.
  • The endpoint agent ships with the platform.
  • A fixed fee, in writing, within 24 hours of the intake form.

Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing

Service sheet, free to keep and share

HIPAA Security Rule risk analysis

Required today, whatever happens with the proposed update. What a real risk analysis covers. Two pages, PDF, written for whoever runs the office.

By asking for the sheet you agree to the privacy policy. We may follow up once about it; reply stop and we will not write again.

Questions

HIPAA questions we get every week

Who has to comply with the HIPAA Security Rule?
Covered entities (health plans, clearinghouses and providers who bill electronically) and their business associates, meaning vendors that create, receive, keep or send ePHI for them. That includes billing companies, IT providers and cloud services. Size does not matter. If you are a vendor to healthcare, expect a BAA and questions about your safeguards. We prepare both sides.Source: HHS, HIPAA Security Rule
What is a HIPAA risk analysis?
A documented review of where ePHI lives, what threatens it, how likely and harmful each threat is, and what controls you have. HHS separates it from risk management, which is fixing what you find. OCR's Risk Analysis Initiative has settled multiple cases since 2024 where this document was missing or shallow. Our assessment produces one and a ranked fix plan.Source: HHS Security Rule FAQ
Is the new HIPAA Security Rule final?
No. HHS proposed it in January 2025 with mandatory MFA and encryption, asset inventories, network maps, 72-hour restoration and annual compliance audits. As of October 2026 it remains a proposal; the federal Unified Agenda lists final action for July 2027. Today's rule still applies in full, and building toward the proposal now is sensible preparation.Source: Unified Agenda, RIN 0945-AA22 (HIPAA Security Rule update)
How fast must a HIPAA breach be reported?
Affected individuals must be told without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within that window, and to prominent media when 500 or more residents of one state are involved. Smaller breaches go to HHS within 60 days after the end of the calendar year.Source: HHS Breach Notification Rule
Can a company be HIPAA certified?
There is no official HIPAA certification. HHS says covered entities are not required to certify compliance and that it does not endorse private certifications. Third-party reviews can still help show due diligence. What matters to OCR is a current risk analysis, working safeguards, trained staff and documented policies. We help you assemble that evidence.Source: HHS Security Rule FAQ
Can we use cloud services for patient data?
Yes. HHS guidance says covered entities and business associates may use cloud providers to store or process ePHI if they sign a business associate agreement and include the service in their risk analysis. The provider is then a business associate with its own duties. Configuration on your side, such as access and MFA, is still yours to get right.Source: HHS business associate and cloud FAQ
Do you certify HIPAA compliance?
No. We do not certify, and the regulator, examiner or independent auditor for HIPAA has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with HIPAA?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do HIPAA separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.

Next step

Thirty minutes, an engineer, a written scope for HIPAA.

Book the demo and see how one control set carries HIPAA and everything else you owe. Or leave your details and an engineer replies within one business day.

Get a fixed-fee quote

See how we use your information

3-min test