The article
If someone offers to make your practice "HIPAA certified", start with one fact: HHS, the federal health department that enforces HIPAA, does not certify HIPAA compliance. HHS says no HIPAA standard requires a certification, and it does not recognize private ones. Useful HIPAA compliance services sell something else: the work the Security Rule asks for, done in your systems and written down so you can show it.
I have been building software for 18 years, and since 2017 my team of 70+ specialists has delivered 150+ projects, healthcare among them. We take the technical side: we find where protected health information lives, put the safeguards into your systems and software, and keep the evidence. The legal opinion and the signatures stay with your compliance officer and your counsel.
HIPAA compliance services: the short version
| What | How it works |
|---|---|
| For | Practices, clinics, health tech companies and the vendors that handle their patients' data |
| We do | The risk analysis, the safeguards in your systems and software, policies and training, the evidence |
| You keep | The decisions, the legal opinion and the signatures |
| Ways to work | One project before a deadline, or HIPAA compliance managed services month after month |
| Price | Estimated before work starts; the first call and the rough estimate are free |
| First answer | Within 30 minutes on weekdays, 9-18 Miami time |
What the Security Rule asks, in plain words
The rule asks for things you can show, not a product you can buy. From its text:
- A risk analysis: an accurate and thorough assessment of the risks to your electronic health information, and security measures that bring them down to a reasonable level.
- A named security official who answers for the policies, and security training for the whole workforce.
- A login of their own for every user, and audit controls that record activity in the systems with patient data. The rule also asks you to review those records regularly, so collecting logs is only half of it.
- Backups you can restore: exact copies of the data and a plan to recover it after a loss. Both are required.
- Encryption: "addressable" in the current text, which is not the same as optional. You encrypt, or you document why it is not reasonable and put an equivalent measure in place.
- A periodic evaluation, repeated when your systems or operations change, and written policies kept for 6 years after they were last in effect.
In January 2025 HHS proposed a large update of the Security Rule; among other changes, encryption would become required. The latest federal regulatory agenda lists it among long-term actions, with a final rule planned for July 2027. Ask your compliance advisor where it stands when you read this. Encrypting health data is worth doing either way.
HIPAA IT compliance services: what we do in your systems
Most of HIPAA lives in systems: who can open a record, what gets logged, where the copies are. That is why the work in your systems is the core of what we do:
- Email, devices, cloud and backups set up so health information stays encrypted, access-controlled and logged.
- Access by role: each person sees what their job needs, and access ends when they leave.
- Logs someone reads: audit logs where patient data lives, and a routine to review them.
- Copies that restore: backups kept apart from the main system, with a restore tested before you need one.
- A breach plan: who decides, who tells whom, and by when.
The deadlines in that plan come from the Breach Notification Rule. A covered entity has at most 60 calendar days from discovering a breach to tell each affected person, and sooner is expected when it can, and a business associate tells the covered entity within the same limit. A breach of 500 or more people goes to HHS at the same time; smaller ones are logged and reported within 60 days after the year ends.
Software built for HIPAA from day one
When the product itself holds patient data, the safeguards belong in the code. RxPhoto lets clinics in dermatology, aesthetics, plastic surgery, vein treatment and wound care capture, store and share patient photos. We worked on the backend, the web front end and the API behind the mobile app, including custom patient reports. Photos go straight into the patient's record on a secure cloud portal, and an audit log lets administrators follow every user action, so a practice can show who opened which record and when. Per rxphoto.com, the platform stores 80m+ before-and-after photos.
What made it hard: one record for each patient's photos, videos, forms and notes instead of separate systems, and reports that leave the clinic as PDF, JPG or PowerPoint for patients, doctors and insurers. Tools like this are what our compliance software development is about.
Who needs a business associate agreement: a map to forward
A vendor that handles protected health information for you, whether it creates, stores, receives or sends it, is a business associate, and HIPAA asks for a business associate agreement with it before it handles the data. Walk your vendor list through this table:
| Vendor | Why it can be a business associate | Ask before it starts |
|---|---|---|
| Cloud hosting, storage, backups | HHS says a cloud provider that stores only encrypted data, without the key, is still a business associate | A signed agreement, where the copies live, how your data comes back if you leave |
| Your developer or IT support | Work in a live system means access to patient data | Can the work run on test data? If not, an agreement before access |
| Analytics and ad pixels on a patient portal | HHS's Office for Civil Rights says trackers on pages behind a login generally have access to protected health information | What each script sends, and to whom |
| An AI service that reads notes or messages | It receives patient data from your systems | An agreement, and whether your data trains its models |
| Email and messaging | Messages with patient details pass through it and stay there | An agreement, and encryption in transit |
How the work goes
The steps are the same for a single project and for HIPAA compliance outsourcing services that run for years:
- Scope. Which systems, devices, vendors and people touch patient data. You send what you have and give us access to look; we fill in the rest.
- Gaps. What is missing against the Security Rule, ranked by risk and by what an auditor or a client will check first.
- Controls. HIPAA compliance remediation services: we close the gaps in your systems and software, from access and logs to backups and encryption. Then HIPAA compliance testing services show that each safeguard works, not only that it exists.
- Proof. The risk analysis, policies, logs, vendor list and test results, kept current and kept in your accounts.
After that you run it yourself, or hand it to us as managed HIPAA compliance services with a named contact and regular reviews. HIPAA compliance consulting services without engineering are enough when your systems are already sound. When the gap is in the software, you need people who can change it.
What the estimate depends on
HIPAA work has no fixed price, because it depends on your systems. We estimate it before work starts, and the first call and the rough estimate are free. The estimate moves with:
- how many systems hold patient data, and whether you or a vendor runs them;
- how many people and devices reach them;
- how many vendors handle the data;
- how much of your own software must change;
- what already exists: a recent risk analysis, policies, logs.
How to judge any HIPAA provider
In October 2026 I went through the five pages Google showed me for this search. None names a price for its own service. None says that HHS does not certify anyone, and one advises choosing a provider by its "certifications". None mentions tracking pixels on patient portals or building software. Five pages are a small sample, so take this as a list of questions to ask, not a statistic:
- What will you change in our systems, and what will you only write down?
- Which of our vendors need a business associate agreement, and why?
- Who reviews our audit logs, and how often?
- Where will our evidence live, and whose account is it in?
- What stays with our compliance officer and our counsel?
Related work
Healthcare compliance covers what surrounds HIPAA: data exchange with partners, records, vendor reviews. Cloud compliance sets up AWS, Azure or Google Cloud for health data. A risk assessment and penetration testing look deeper at security, and incident response takes over when the breach plan meets a real incident. For a practice's public site, see websites for medical practices; every rule we work with is on the compliance page.
Tell us how you handle health data today: the systems, the vendors and the deadline. On request, we sign an NDA before you share any details. We reply with where we would start and a free rough estimate. Our record: 5.0 on Clutch from 26 verified reviews as of September 2026, and not one negative review.
