HIPAA compliance · GRC software
HIPAA compliance for healthtech teams, kept current every day.
If your product creates, receives, stores or sends protected health information for a US healthcare customer, HIPAA applies to you. AEGIS builds your HIPAA program from a short interview, maps it to the Security Rule, and keeps the evidence current on the same controls as SOC 2 and ISO 27001.
Every framework on every plan, priced by team size. You choose your auditor.
The basics
What is HIPAA compliance?
HIPAA is the US law that protects health information. Its Privacy Rule controls how protected health information (PHI) is used and shared, its Security Rule sets the safeguards for electronic PHI, and its Breach Notification Rule says who you must tell when PHI is exposed.
It applies to covered entities (health plans, healthcare clearinghouses and most providers) and to their business associates: any vendor that handles PHI for them. If you build telehealth, EHR, billing, lab, care management or AI scribe software for US healthcare customers, you are almost certainly a business associate, and you will be asked to sign a business associate agreement (BAA).
Requirements
What the HIPAA Security Rule asks for
The Security Rule is risk-based. You assess the risks to electronic PHI, then put administrative, physical and technical safeguards in place and keep them documented.
- Risk analysisAn accurate, thorough assessment of the risks to the electronic PHI you hold, kept current.
- Risk managementSecurity measures that bring those risks down to a reasonable level, with owners.
- Administrative safeguardsA security official, workforce training, sanctions, contingency plans and BAAs with your own vendors.
- Physical safeguardsFacility access, workstation security and controls on devices and media that hold PHI.
- Technical safeguardsAccess control, audit logs, integrity controls, user authentication and transmission security.
- Breach notificationNotify affected individuals within 60 days of discovery, HHS, and the media when 500 or more people in a state are affected.
Explained
Is there a HIPAA certification?
No. HHS does not certify anyone as HIPAA compliant, and no official HIPAA certification exists. Compliance is something you show: a current risk analysis, documented safeguards, signed BAAs, trained staff and evidence that the controls work.
Buyers usually ask for that evidence in a security review, often alongside a SOC 2 report. AEGIS keeps HIPAA on the same control set as SOC 2 and ISO 27001, so one program answers all three.
Checklist
HIPAA checklist
What an auditor or regulator will want to see. AEGIS generates each of these as a control, policy or evidence task, with an owner.
- Risk analysis: a documented assessment of risks to electronic PHI, reviewed regularly.
- BAAs: signed agreements with every customer you serve and every vendor that touches PHI.
- Policies: Security Rule policies that match how your team actually works.
- Access control: unique user IDs, least privilege and regular access reviews.
- Audit logs: records of who accessed PHI and when, kept and reviewed.
- Encryption: PHI encrypted in transit and at rest wherever reasonable.
- Training: security awareness training for everyone who can reach PHI.
- Testing: vulnerability scans and a penetration test as evidence your safeguards hold.
With AEGIS
Get HIPAA ready, then stay ready.
Gets you compliant
From zero to ready
- A short security interview scopes HIPAA for your company, with a reason for every control.
- Controls, policies, risk register and evidence backlog are generated in an afternoon.
- AI drafts each policy in your real context; a person on your team approves it.
- Evidence collects from your cloud, code, identity and devices.
Keeps you compliant
Current every day after
- Checks keep running and evidence keeps collecting after the audit.
- Access reviews, training and policy sign-offs come round on schedule, with owners.
- A control that drifts shows up before your next audit, and a check that cannot run never counts as a pass.
- HIPAA shares one control set with every other framework, all included on every plan.
Your auditor, your choice
Pick the auditor that fits your buyers.
HIPAA has no certifying body, but customers and partners often want an independent view, usually a SOC 2 report that covers your HIPAA controls or a third-party HIPAA assessment. You choose the firm, tier 1, 2 or 3, US-based or India-based, and AEGIS gives them read-only access to your evidence.
Works with Nexus Void
Security work that becomes HIPAA evidence.
VAPT
Penetration testing
The current Security Rule asks you to evaluate your safeguards, and a penetration test is the usual evidence. HHS has also proposed making annual pentests and twice-yearly vulnerability scans mandatory. Our VAPT report files into AEGIS as that evidence.
Explore VAPTARGUS
Code security
PHI leaks often start in code: an API that returns another patient's record, a hardcoded key, a vulnerable dependency. ARGUS finds them, maps every endpoint to the patient data it touches, and its findings become risks and evidence in AEGIS.
Explore ARGUSOther frameworks
One control set, every framework included.
FAQ
HIPAA questions, answered
Answers to the questions teams ask us most. Updated 22 October 2026.
Still have questions? Contact us
Who needs to comply with HIPAA?
Covered entities (health plans, healthcare clearinghouses and providers who bill electronically) and their business associates: any company that creates, receives, stores or sends protected health information on their behalf. Most healthtech and health SaaS vendors serving US customers are business associates.
Is there a HIPAA certification?
No. HHS does not certify or endorse HIPAA compliance, and no official certificate exists. You show compliance with a current risk analysis, documented safeguards, signed BAAs and evidence, often packaged in a SOC 2 report or an independent HIPAA assessment.
Does HIPAA apply to companies in India?
It applies through your customers. If you handle PHI for a US covered entity or business associate, you will sign a BAA that holds you to the Security Rule, and US buyers will review you against it. Many Indian healthtech and services companies serving US customers run HIPAA programs for exactly this reason.
Does HIPAA require a penetration test?
The current Security Rule does not name one. It requires a risk analysis and periodic evaluation of your safeguards, and a penetration test is the usual evidence. HHS has proposed making annual penetration tests and vulnerability scans every six months mandatory, but as of October 2026 that rule is not final.
What is changing in the HIPAA Security Rule?
HHS proposed an overhaul in January 2025: mandatory encryption and multi-factor authentication, an asset inventory, network segmentation, vulnerability scans every six months and an annual penetration test. It has not been finalized, and HHS now lists July 2027 as its target. Teams building to it early will have less to change.
HIPAA or SOC 2: which do we need?
Often both. HIPAA is the law you must follow if you handle PHI; SOC 2 is the report US buyers ask for to trust your security. Most controls overlap, and AEGIS maps both onto one control set, so evidence collected once counts for both.
How much does HIPAA compliance cost?
With AEGIS, HIPAA is included on every plan, priced by team size rather than per framework. If you want an independent assessment or a SOC 2 report covering HIPAA, that fee is set by the firm you choose.
HIPAA with AEGIS
Get HIPAA ready, and keep it that way.
Tell us who is asking for it and we will show you the path, and which auditors fit.