02 / Compliance and certification
HIPAA, starting with where the health data really goes
We help covered entities and business associates run the risk analysis the Security Rule asks for, check the safeguards around electronic protected health information, and test the systems that hold it.
Overview
What the HIPAA Security Rule asks of you
HIPAA is a US federal law. Its Security Rule applies to covered entities, such as health plans, health care clearinghouses and many health care providers, and to their business associates. It asks you to protect the confidentiality, integrity and availability of electronic protected health information (ePHI) through administrative, physical and technical safeguards.
The starting point is a risk analysis: an accurate and thorough assessment of the risks to the ePHI you create, receive, maintain or transmit, followed by risk management to bring those risks down. Some implementation specifications are required, others are addressable, which means you assess them and document what you decided, not that you may skip them. Business associates need a business associate agreement before they handle ePHI.
There is no official HIPAA certification. The Department of Health and Human Services does not certify or endorse anyone as HIPAA compliant, and its Office for Civil Rights enforces the rules. Black Fox is not a lawyer or a regulator. We do the security work and document it.
Who it is for
US health care providers, health plans and clearinghouses, and the business associates that serve them, such as software vendors, cloud and IT providers and billing companies. Also companies outside the US that handle ePHI for US clients and receive HIPAA questions in contracts.
The work, from scoping to evidence.
What we do
Risk analysis
We find where ePHI lives and moves, including the systems and vendors you forgot, and assess the threats, vulnerabilities and likely impact for each.
Administrative safeguards
A review of your security management process, workforce security, access management, training, incident procedures, contingency planning and evaluation.
Physical safeguards
A look at facility access, workstation use and security, and how devices and media holding ePHI are handled, reused and disposed of.
Technical safeguards
A review on the systems themselves of access control, audit controls, integrity, authentication and transmission security, such as encryption in transit.
Business associates
An inventory of the vendors that touch ePHI, a check that agreements are in place, and a view of whether their security matches what they signed.
Technical testing
Penetration tests of the applications, APIs, networks and cloud environments that hold ePHI, adapted to HIPAA, with proofs of concept for what we find.
How the engagement runs
Kickoff
We agree the scope, the systems and the people involved, and sign an NDA first if you need one.
Discovery
Interviews, document review and data flow mapping to find every place ePHI is created, stored or sent.
Risk analysis
We assess risks across the safeguards and rate them by likelihood and impact.
Testing
Optional technical testing of the highest-risk systems, agreed in advance.
Risk management plan
We work with your owners on a plan to reduce the risks, with the decisions on addressable specifications documented.
Handover
Recommendations, a business report with the risk assessment and a technical report, then a closing meeting for your feedback.
What you receive
- ePHI inventory and data flow map
- Security Rule risk analysis
- Safeguard gap assessment across administrative, physical and technical areas
- Risk management plan with documented decisions
- Business associate inventory and agreement checklist
- Penetration test report with proofs of concept
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Can you certify us as HIPAA compliant?
No, and nobody else can either. There is no official HIPAA certification, and the Department of Health and Human Services does not endorse private ones. What you can show is a documented risk analysis, the safeguards you put in place and the evidence that they work. Our certificate of successful engagement records that an engagement took place, nothing more.
Are we a business associate?
If you create, receive, maintain or transmit protected health information on behalf of a covered entity, you very likely are, and you need a business associate agreement. Whether a specific arrangement qualifies is a question for your counsel.
Does addressable mean optional?
No. For an addressable specification you assess whether it is reasonable and appropriate for you. If it is, you implement it. If not, you document why and implement an equivalent alternative where that is reasonable.
Does HIPAA require penetration testing?
The Security Rule asks for a risk analysis and for periodic evaluation of your safeguards, and does not name a specific test. Penetration testing is one common way to find the technical vulnerabilities the risk analysis has to account for.
Related services
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
- Offensive securityPenetration TestingPenetration testing by Black Fox Security: black, grey and white box tests against an agreed scope, business and technical reports, and a retest of your fixes.
- Compliance and certificationSOC 2SOC 2 readiness from Black Fox Security: Trust Services Criteria scoping, gap assessment, control design and evidence preparation for your CPA firm's examination.
- Governance and riskThird-party risk managementSupplier risk management from Black Fox Security: inventory, tiering, questionnaires, evidence review and contract clauses, aligned with NIS2 and DORA expectations.
Start with the risk analysis
Tell us where your ePHI lives and who touches it. We will help you see what the Security Rule expects of each part.