hipaa compliance vs certification
Robert Godard
Listen to: "Does HIPAA Certification Guarantee HIPAA Compliance?"

Over the years, healthcare organizations have gone to great lengths to achieve and maintain sterling HIPAA compliance. The ability to work with patient records and other sensitive data in an increasingly electronic environment is crucial to these organizations and the entire healthcare community.

Healthcare organization leaders understand that implementing HIPAA comes with its share of challenges, but in the end, the effort always pays off.

Following are a few key ways that the HIPAA Privacy Rule has revolutionized the healthcare industry for the better:

  • HIPAA has created a culture of compliance in an environment heavy with regulations and frequent regulatory updates. Keeping up compliance is essential, and HIPAA has been instrumental in helping companies comply.
  • HIPAA has strengthened security in healthcare organizations and in organizations that work in tandem with healthcare organizations.
  • In file-sharing situations, HIPAA has safely facilitated this activity between different healthcare systems. Upon patient approval for permission to share their records, many providers are able to instantly send records to the designated recipient electronically.
  • HIPAA has been instrumental in developing national standards regarding patient confidentiality and healthcare information.

These benefits and others show how important the HIPAA Privacy Rule has been to core organizations involved with the healthcare industry and their valued patients.

It is also important that any organization, healthcare-related or not, is HIPAA compliant when dealing with a healthcare organization.

When working with vendors and business associates, it is vital that healthcare organization leaders ensure that their organizations are each HIPAA compliant. Diligent healthcare organizations have done all the hard work to make sure their bases are covered in all matters of HIPAA. It only makes sense that they guarantee that anyone they do business with also cares about HIPAA compliance in the interest of protecting confidential patient records.

Given the electronically connected nature of every facet of business today—wherein patient files are at least theoretically open to exposure—it is vitally important that healthcare organizations take the necessary steps to ensure that any other parties with whom they do business are not only HIPAA certified, but that they are also HIPAA compliant. There is a difference between those two concepts.

What Is HIPAA Certification and Does HIPAA Certified Equal HIPAA Compliant?

HIPAA certification simply means that an organization has participated in a course that was designed to train and teach the organization’s staff members the information needed to steer the organization toward achieving HIPAA compliance.

While HIPAA certification offers a dutiful organization a full tool kit, intended to help them achieve HIPAA compliance, certification is not in itself a recognizable measure of HIPAA compliance.

HIPAA certification courses and frameworks are available through a variety of companies that focus on making sure businesses understand and comply with all the regulations, but they do not perform those tasks for the company, nor do they bear any responsibility or liability for a company’s not following through on the necessary steps.

Therefore, HIPAA certification does not equal HIPAA compliance, and it also does not guarantee HIPAA compliance. Does that make HIPAA certification worthless? No.

Organizations can certainly take any and all information learned via HIPAA certification training and testing to use in their efforts to achieve and maintain full HIPAA compliance. Any additional tools to help reach HIPAA compliance have value.

What Is the Best Way to Guarantee HIPAA Compliance?

Healthcare organizations must rely on the goods, services and expertise of businesses not fundamentally associated with the healthcare industry. That is just the way of today’s world, as healthcare companies—like businesses in any other industry—try to find the best resources for the best financial value. This means that most of these specialized companies—like cloud servers and payroll processors—are not organically designed or mandated to comply with a set of regulations aimed at the healthcare industry.

However, as the medical world and all other industries continue to become more interwoven, it is important that more companies consider adding HIPAA compliance to the roster. As technology becomes more embedded than ever in most industries, allowing for important services like cloud storage to accommodate massive volumes of data, it makes sense for healthcare systems to enjoy the myriad benefits involved. They just need to make sure these companies protect their patients’ data by complying with HIPAA.

We know that HIPAA certification is no guarantee that a company is HIPAA compliant. Thankfully though, there are other ways to keep everyone on board for protecting patients’ information.

One of the most important things that business leaders like yourself can do to ensure HIPAA compliance with any outsourced services or expertise is to learn about the Five Rules and the HITECH Act. The five rules of HIPAA include the Privacy Rule, Security Rule, Transactions Rule, Identifiers Rule and Enforcement Rule.

Working with a trusted auditing firm to ensure that all requirements of HIPAA have been met is one of the best ways to protect your business.

At I.S. Partners, we understand the value of hiring specialized companies to handle specialized tasks. We also understand that, in doing so, these valued business associates must comply with the healthcare industry’s standards and regulations. We can work with you to ensure full HIPAA compliance.

Call us at (215) 675-1400, send us a message,, or start a chat with us to learn more about HIPAA certification, compliance and much more.

About The Author

Get Hassle-free Pricing in 3 Easy Steps

Request a quote using the form below
Allow us to create a customized plan
We'll get you an accurate, no-obligation quote
Untitled-1 Asset 1 Request a Quote Background

Request a Quote

Please fill out the fields below and one of our compliance specialists will contact you shortly. Want to speak to us now? Call us at (866) 335-6235

Request a Quote (Keep)

I.S. Partners is serious about privacy. We will never share your information with third parties. Please read our Privacy Policy for more information.


Great companies think alike!

Join hundreds of other companies that trust I.S Partners for their compliance, attestation and security needs.

Teladoc VeriClaim DentaQuest VisioNet Verifacts Sterling AV Med DOE Legal