Uncategorized

HIPAA Certified vs. HIPAA Compliant

2 Mins read

This is a blog post on the phrase ‘HIPAA certified’ to inform you that there is no such thing as ‘HIPAA certified.’ What’s the correct term, then? ‘HIPAA compliant.’ This means that you, as a covered entity, or business associate, has been found in compliance with the HIPAA Security and Privacy Rules as established by the Department of Health and Human Services (HHS). You have done your due diligence by putting in policies, processes and procedures to achieve technical, administrative and physical safeguards to protect PHI.

This is a blog post on the phrase ‘HIPAA certified’ to inform you that there is no such thing as ‘HIPAA certified.’ What’s the correct term, then? ‘HIPAA compliant.’ This means that you, as a covered entity, or business associate, has been found in compliance with the HIPAA Security and Privacy Rules as established by the Department of Health and Human Services (HHS). You have done your due diligence by putting in policies, processes and procedures to achieve technical, administrative and physical safeguards to protect PHI.

The HHS does recognize any ‘HIPAA certification’ program as legitimate. When they come to inspect and audit, they will likely not care if you have a ‘HIPAA certified’ seal on your website. They care about the security and design of your controls to protect PHI to the best of your ability, and the actual policies and procedures your organization abides by.

While many use ‘certified’ and ‘compliant’ interchangeably to mean the same thing, they cannot be used to describe data centers, hosting providers or any service provider acting as a business associate to a covered entity that needs to achieve their own compliance. For example, it’s not ‘HIPAA certified data centers,’ it’s ‘HIPAA compliant data centers.’ Or ‘HIPAA compliant hosting,’ not ‘HIPAA certified hosting.’

This article, from ZDNet is properly titled Will Your Cloud Be HIPAA Compliant? Yet, despite its title, ‘certified’ appears everywhere in the article as it refers to data center providers:

HIPAA Certified Data Centers?

But at least one person commenting on the article seems to understand the difference:

 

So for service providers in the healthcare industry – and for healthcare organizations that contract out to them, please take heed: the correct term is “HIPAA compliant” not “HIPAA certified.” Be wary of those that claim to be certified – because chances are, they might not really know what they’re talking about at all.

Related posts
NewsUncategorized

How to Effectively Support Employees With Disabilities

2 Mins read
Disability is not inability, and your business can make the most of the underused and the underappreciated one billion workers living with…
Dental healthSpecialtiesUncategorized

Everything You Need To Know About Dental X-Rays And 3D Imaging

3 Mins read
Over the years, there has been a growing demand for better dental technology as people became more interested in their oral health….
NewsUncategorized

5 Tips to Minimize Workplace Liability from Infectious Diseases

3 Mins read
Infectious diseases are very common in the workplace. Up to 20% of Americans get the flu each year and many get sick…