5 ms·

HIPAA isn’t a certification just FYI. If someone is selling you a HIPAA certification they are scamming you. HIPAA “compliant” simply means you’ve hired a 3rd

HIPAA isn’t a certification just FYI. If someone is selling you a HIPAA certification they are scamming you. HIPAA “compliant” simply means you’ve hired a 3rd party to audit your business. Essentially they ensure you do what you say you do in your policies and procedures. There are certifications that can effectively illuminate the need for these types of questionnaires. HITRUST as an example in Healthcare and SOC 2 for broader SaaS providers.

dragonwriter 6y ago
> HIPAA isn’t a certification just FYI. There are HIPAA certifications, but they aren't legally required or beneficial. They may have some marketing value. > HIPAA “compliant” simply means you’ve hired a 3rd party to audit your business No, it means you are following HIPAA requirements; 3rd party audit is not a HIPAA requirement any more than certification is, though it may be useful in identifying compliance issues.
- ryanSrich 6y ago
  Semantics. I’m saying a HIPAA certification from HHS or any official governing body doesn’t exist. A 3rd party auditor might give you a “certification” but it’s meaningless to call yourself “HIPAA certified”. You wouldn’t say that. You’d say “we’ve conducted a 3rd party independent audit”. You can go ahead and claim HIPAA compliance all you want, but most health systems are going to ask you if you’ve conducted an audit or if you have any certifications - SOC 2, HITRUST, etc. So in reality you’re not HIPAA compliant until you can prove it. That’s my point.
  - dragonwriter 6y ago
    “HIPAA compliant” means you aren't breaking the law, which is quite important independent of any audit or certification because there are penalties for breaking the law, and they apply to all covered entities. “HIPAA certified” and the identity of the certifying authority is also potentially important; it may have some marketing value, but more importantly it is (as you note, but bizarrely use it to propose that “audit” is more important than “certification”), various people you might want to do business with may require certification, by an acceptable certification authority. (Possibly different ones for different aspects of HIPAA.) OTOH, there are covered entities that don't have to worry about this at all, because of who they are and who they plan to do business with. A 3rd party audit for HIPAA compliance probably isn't important to anyone external to you directly (and is not an element of compliance), but may be useful for identifying compliance issues, or may be a component of certification.
    - sk5t 6y ago
      Because there's no certifying / accrediting body for HIPAA compliance--practices that comply with the law do not constitute a certification process--what you get is a letter from an unaccredited firm, not a certification. As such, sophisticated customers don't put that much stock in it.

dragonwriter 6y ago

> HIPAA isn’t a certification just FYI. There are HIPAA certifications, but they aren't legally required or beneficial. They may have some marketing value. > HIPAA “compliant” simply means you’ve hired a 3rd party to audit your business No, it means you are following HIPAA requirements; 3rd party audit is not a HIPAA requirement any more than certification is, though it may be useful in identifying compliance issues.

ryanSrich 6y ago
Semantics. I’m saying a HIPAA certification from HHS or any official governing body doesn’t exist. A 3rd party auditor might give you a “certification” but it’s meaningless to call yourself “HIPAA certified”. You wouldn’t say that. You’d say “we’ve conducted a 3rd party independent audit”. You can go ahead and claim HIPAA compliance all you want, but most health systems are going to ask you if you’ve conducted an audit or if you have any certifications - SOC 2, HITRUST, etc. So in reality you’re not HIPAA compliant until you can prove it. That’s my point.
- dragonwriter 6y ago
  “HIPAA compliant” means you aren't breaking the law, which is quite important independent of any audit or certification because there are penalties for breaking the law, and they apply to all covered entities. “HIPAA certified” and the identity of the certifying authority is also potentially important; it may have some marketing value, but more importantly it is (as you note, but bizarrely use it to propose that “audit” is more important than “certification”), various people you might want to do business with may require certification, by an acceptable certification authority. (Possibly different ones for different aspects of HIPAA.) OTOH, there are covered entities that don't have to worry about this at all, because of who they are and who they plan to do business with. A 3rd party audit for HIPAA compliance probably isn't important to anyone external to you directly (and is not an element of compliance), but may be useful for identifying compliance issues, or may be a component of certification.
  - sk5t 6y ago
    Because there's no certifying / accrediting body for HIPAA compliance--practices that comply with the law do not constitute a certification process--what you get is a letter from an unaccredited firm, not a certification. As such, sophisticated customers don't put that much stock in it.