Firms that write the HIPAA policy set, run the risk analysis and train the workforce. The Office for Civil Rights asks for policies, training records and sanction records first.
No HIPAA rule requires you to “certify” compliance. HHS says it “does not endorse or otherwise recognize private organizations’ ‘certifications’” and that such certifications do not remove your legal obligations (HHS FAQ). HHS’s Office for Civil Rights enforces the rules. A consultant can help you do the work; nobody can certify it on HHS’s behalf.
The Security Rule requires covered entities and business associates to conduct “an accurate and thorough assessment” of the risks to electronic protected health information and to manage those risks (45 CFR 164.308). Consultants typically run that risk analysis, write policies and procedures, train staff, review business associate agreements and plan breach response.
We checked each firm’s own website, and each card shows the date we read it. We list only firms whose websites offer HIPAA compliance services. The notes say what each firm’s HIPAA page mentions. A listing is not a recommendation.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
Their own websites offer HIPAA compliance services; each card shows the date we checked. 253 listed.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.