Who is HIPAA compliance consulting for?
Startups facing their first health-system or enterprise security questionnaire, teams that inherited a product with no compliance record, and research platforms moving from IRB-covered use to commercial use. We are engineers who have built HIPAA-covered systems, so the advice is specific to software rather than generic policy.
What does HIPAA compliance consulting include?
- Gap assessment — administrative, physical, and technical safeguards reviewed against the Security Rule and Privacy Rule, with findings rated by risk.
- Risk analysis — the documented risk analysis the Security Rule requires, written so you can maintain it.
- Technical safeguards review — encryption, access control, audit logs, backups, logging, and secrets handling, checked in the running system rather than on paper.
- Vendor and BAA inventory — every service that touches PHI, whether a Business Associate Agreement exists, and what to do where one does not.
- Policies and procedures — right-sized for your stage, not a binder copied from a hospital.
- Verification — after remediation we test that the policy and the system agree, and issue a memo you can hand to a customer.
- SOC 2 and questionnaire readiness — mapping your HIPAA controls to what security reviewers will ask next.
How does a HIPAA compliance consulting engagement run?
- Scope and evidence requestConfirm systems in scope and collect architecture, policies, vendor list, and access.
- AssessmentInterviews with engineering and leadership, configuration review, and a read of the code paths that handle PHI.
- Findings and roadmapA risk-rated report with a sequenced remediation plan and effort estimates.
- VerificationRe-test after remediation and a written verification memo.
HIPAA vs. SOC 2 vs. HITRUST vs. ISO 27001
Security questionnaires from health systems and payers mix these four together, but they are different things. HIPAA is a law you must follow if you are a covered entity or business associate. The other three are voluntary frameworks that buyers use as evidence you follow good security practice. None of them is a "HIPAA certification": HHS does not certify or endorse HIPAA compliance.
| Framework | What it is | Required by law? | Who asks for it | Who assesses it | Official source |
|---|---|---|---|---|---|
| HIPAA Privacy, Security and Breach Notification Rules | Federal rules for protecting PHI, including administrative, physical and technical safeguards for electronic PHI | Yes, for covered entities and their business associates | Every covered entity you handle PHI for, through a Business Associate Agreement | No certification. HHS Office for Civil Rights enforces through investigations and audits; you document your own risk analysis | HHS Security Rule |
| SOC 2 | An attestation report on controls relevant to security, availability, processing integrity, confidentiality and privacy | No, voluntary | Enterprise customers and their procurement teams, in and outside healthcare | An independent CPA firm, as a Type 1 (design at a point in time) or Type 2 (operation over a period) report | AICPA SOC 2 |
| HITRUST | A certifiable control framework (the HITRUST CSF) that maps HIPAA, NIST and other standards into one set of requirements | No, voluntary | Health systems and payers, especially for vendors with broad PHI access | HITRUST-authorized external assessors, with HITRUST issuing the certification | HITRUST Alliance |
| ISO/IEC 27001 | The international standard for an information security management system (ISMS) | No, voluntary | International customers and partners, especially in Europe | An accredited certification body | ISO 27001 |
How we sequence it for most early-stage teams: get HIPAA right first because it is the legal floor, then pick SOC 2 or HITRUST based on which one your target customers ask for. A well-built HIPAA program produces most of the evidence either audit needs. For the HIPAA safeguards in an app and the HIPAA vs. FTC question, see healthcare mobile app development; for HIPAA-eligible cloud services and BAAs, see healthcare software architecture.
State consumer health data laws
If you collect health data directly from consumers and are not a HIPAA covered entity or business associate, state law may cover you anyway. Several states now regulate "consumer health data" in ways that reach wellness apps and wearables. The main ones to check:
- Washington, My Health My Data Act (RCW 19.373): requires consent to collect and to share consumer health data, bars geofencing around in-person health care facilities, and makes violations unfair or deceptive acts under the state Consumer Protection Act. Most entities had to comply by March 31, 2024 and small businesses by June 30, 2024 (Washington Attorney General).
- Nevada, SB 370 (enrolled bill): a similar consumer health data law, enforced as a deceptive trade practice. The bill states that it creates no private right of action.
- Connecticut, CTDPA consumer health data provisions (Connecticut Attorney General): Connecticut's privacy law includes consumer health data rules that apply to every consumer health data controller doing business in the state, whatever its size.
- California, Confidentiality of Medical Information Act (Civil Code §56 and following): California's medical privacy law, which also reaches some businesses that offer software or hardware designed to maintain medical information.
These summaries are a starting map, not legal advice. Thresholds, definitions and exemptions differ by state, so we scope the technical controls (consent capture, data maps, deletion, vendor contracts) and work alongside your privacy counsel on the legal reading.
Frequently asked questions about HIPAA compliance consulting
Is this a HIPAA certification?
There is no official HIPAA certification. What we provide is an independent assessment and a verification memo stating what we reviewed and what we found, which is what customers and partners actually ask for.
Do we need a BAA with you?
Only if exposure to PHI is unavoidable. We work from read-only access and de-identified or synthetic data wherever possible, and we sign a Business Associate Agreement before any PHI is involved.
How does this relate to SOC 2?
HIPAA is a legal requirement for covered entities and business associates; SOC 2 is an audit standard customers may demand. The controls overlap heavily, so we map the HIPAA work to SOC 2 criteria and tell you how far you are from an audit.
Is SOC 2 or HITRUST required for HIPAA compliance?
No. HIPAA is the legal requirement; SOC 2 and HITRUST are voluntary. Customers often ask for one of them as evidence of your security program, so the choice depends on who you sell to. Health systems and payers ask for HITRUST more often; general enterprise buyers usually ask for SOC 2.
Does HIPAA apply to a consumer wellness app?
Only if the app is run by, or on behalf of, a HIPAA covered entity such as a provider or health plan. A direct-to-consumer app usually is not covered by HIPAA, but state consumer health data laws such as Washington's My Health My Data Act and federal FTC rules can still apply.
Which state laws cover consumer health data outside HIPAA?
The main ones to check are Washington's My Health My Data Act (RCW 19.373), Nevada SB 370, Connecticut's CTDPA consumer health data provisions and California's Confidentiality of Medical Information Act. Each has its own definitions and exemptions, so map your data flows against each state where you have users.
Related services
Scope it in 30 minutes
Book a scoping call and we'll name the smallest engagement that moves you forward. Most teams start with the fixed-scope Initial Audit.
Book a 30-min scoping callPrefer to write? Send a short note.