HIPAA Certified vs. HIPAA Compliant

April 14, 2012
77 Views

This is a blog post on the phrase ‘HIPAA certified’ to inform you that there is no such thing as ‘HIPAA certified.’ What’s the correct term, then? ‘HIPAA compliant.’ This means that you, as a covered entity, or business associate, has been found in compliance with the HIPAA Security and Privacy Rules as established by the Department of Health and Human Services (HHS). You have done your due diligence by putting in policies, processes and procedures to achieve technical, administrative and physical safeguards to protect PHI.

This is a blog post on the phrase ‘HIPAA certified’ to inform you that there is no such thing as ‘HIPAA certified.’ What’s the correct term, then? ‘HIPAA compliant.’ This means that you, as a covered entity, or business associate, has been found in compliance with the HIPAA Security and Privacy Rules as established by the Department of Health and Human Services (HHS). You have done your due diligence by putting in policies, processes and procedures to achieve technical, administrative and physical safeguards to protect PHI.

The HHS does recognize any ‘HIPAA certification’ program as legitimate. When they come to inspect and audit, they will likely not care if you have a ‘HIPAA certified’ seal on your website. They care about the security and design of your controls to protect PHI to the best of your ability, and the actual policies and procedures your organization abides by.

While many use ‘certified’ and ‘compliant’ interchangeably to mean the same thing, they cannot be used to describe data centers, hosting providers or any service provider acting as a business associate to a covered entity that needs to achieve their own compliance. For example, it’s not ‘HIPAA certified data centers,’ it’s ‘HIPAA compliant data centers.’ Or ‘HIPAA compliant hosting,’ not ‘HIPAA certified hosting.’

This article, from ZDNet is properly titled Will Your Cloud Be HIPAA Compliant? Yet, despite its title, ‘certified’ appears everywhere in the article as it refers to data center providers:

HIPAA Certified Data Centers?

But at least one person commenting on the article seems to understand the difference:

 

So for service providers in the healthcare industry – and for healthcare organizations that contract out to them, please take heed: the correct term is “HIPAA compliant” not “HIPAA certified.” Be wary of those that claim to be certified – because chances are, they might not really know what they’re talking about at all.

You may be interested

What to Look for in Patient Solutions Software
eHealth
365 views
eHealth
365 views

What to Look for in Patient Solutions Software

Robert Cordray - August 17, 2017

The medical sector is one area where technology has had a significant impact, largely by providing tools that simplify many…

Can Natural Remedies Like RediCalm Decrease Stress and Anxiety?
Wellness
2 views
Wellness
2 views

Can Natural Remedies Like RediCalm Decrease Stress and Anxiety?

Ryan Kh - August 16, 2017

According to research from the National Institute of Mental Health, anxiety disorders are the most common mental illness in the…

How to Alleviate Stress Related Insomnia
Specialties
400 views
Specialties
400 views

How to Alleviate Stress Related Insomnia

JohnHenning - August 15, 2017

Do you have difficulty falling asleep or staying asleep every night? You aren't alone. According to multiple studies, including one…