It's somewhere in-between. There's no required HIPAA certification process, all you need to do is sign a BAA and you're a covered entity (and HIPAA applies to y

It's somewhere in-between. There's no required HIPAA certification process, all you need to do is sign a BAA and you're a covered entity (and HIPAA applies to you). HIPAA really requires only a few things: if you have a breach of PHI you have to announce it quickly and announce it in a local newspaper, you shouldn't be sharing PHI with partners that won't sign a BAA and you should all be recieving HIPAA training. This is enforced with fines and by the terms in your BAA. Your company may be out of scope though. If your company never receives PHI, then HIPAA doesn't apply to you. If you do receive PHI, then the danger of losing it, either accidentally our through a hack is much larger