The US standard for protecting health information. HIPAA sets mandatory privacy and security rules for any organisation that handles protected health information — from providers and insurers to the vendors who serve them.
The Health Insurance Portability and Accountability Act establishes federal requirements for protected health information (PHI) in the United States, through its Privacy Rule, Security Rule, and Breach Notification Rule.
It applies both to covered entities — healthcare providers, health plans, and clearinghouses — and to the business associates that process PHI on their behalf, which is where most technology vendors fall.
HIPAA has no single government certification. Organisations demonstrate compliance through a documented risk analysis, implemented safeguards, and an independent assessment — and many adopt a certifiable framework to evidence it to partners.
Hospitals, clinics, and practices handling patient records.
Any SaaS or service touching PHI as a business associate.
Health plans and clearinghouses processing member data.
Delivered through our specialist network. We conduct the required risk analysis, implement the administrative, physical, and technical safeguards, and prepare you for an independent assessment — so you can give healthcare partners credible evidence, not just a self-attestation.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
If you build software or provide services for US healthcare organisations, your customers will ask whether you handle protected health information (PHI) safely, and they will often ask you to sign a business associate agreement (BAA) before sharing any data.
Are you a business associate? If your company creates, receives, maintains or transmits PHI on behalf of a covered entity, you are, and you carry direct HIPAA obligations. This can apply to companies based outside the US as well, if they handle PHI for US customers. We help you scope exactly where you stand.
What compliant means in practice. HIPAA has no official government certificate. Compliance is shown through a documented Security Rule risk analysis, implemented administrative, physical and technical safeguards, policies, staff training and BAAs, often supported by an independent assessment.
HIPAA alongside SOC 2 or ISO 27001. Many health-tech vendors also hold a framework such as SOC 2 or ISO 27001 to give partners stronger proof. The controls overlap, so we can plan them together. See our SOC 2 page and ISO 27001 page.
Remote-first delivery. ISONEX works remotely with clients across the GCC, UK, EU and US. We conduct the risk analysis, implement the safeguards and prepare you for an independent assessment, with calls scheduled around your working hours.
Timeline and cost. Timeline depends on your scope and how mature your safeguards already are, so we set it with you at kickoff. We quote after a short scoping call. Book a free advisory session.
No — the US government doesn't certify HIPAA compliance. Organisations demonstrate it through a documented risk analysis, implemented safeguards, and an independent assessment. Some adopt a certifiable framework on top to give partners stronger proof.
If your company creates, receives, maintains, or transmits PHI on behalf of a covered entity, then yes — and you carry direct HIPAA obligations plus a business associate agreement. We help you scope exactly where you stand.
Yes. ISONEX is a remote-first consultancy and we deliver HIPAA programmes for clients in the US, the UK, Europe and the GCC. Everything is done online, scheduled around your working hours.
Yes. If a company outside the US handles PHI on behalf of a US covered entity, it is a business associate and must meet HIPAA requirements, including a BAA. We help you scope this and build the programme.
If you handle PHI for a covered entity or for another business associate, HIPAA requires a written BAA between you. Customers will usually send theirs, and we help you review your obligations alongside your counsel.
It depends on your scope and how mature your safeguards already are. We run a Security Rule risk analysis first, then set a realistic timeline with you at kickoff instead of promising a number blind.
Many health-tech vendors do, because partners often ask for a recognised third-party report on top of HIPAA. The controls overlap, so we can plan them together. See our SOC 2 page and ISO 27001 page.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session