HIPAA
Privacy and Security Rules, applied to how your team actually works.
Sydney headquartered CPA firm serving Australian and US companies
The global benchmark for healthcare data protection.
HIPAA's Privacy, Security, and Breach Notification Rules govern the use and protection of protected health information (PHI). The Security Rule sets out administrative, physical and technical safeguards, split into 'required' and 'addressable' controls. 'Addressable' means you must consider the safeguard and either implement it, implement an equivalent, or document a reasoned decision not to, not that it's optional.
When you're a covered entity or business associate handling PHI, or you're about to sign a Business Associate Agreement with someone who is. Increasingly relevant for SaaS, AI and infrastructure providers whose customers operate in US healthcare.
PHI controls that scale
We treat 'addressable' safeguards as decisions to be documented, not corners to cut. Then we assess your administrative, physical and technical controls against the volume and sensitivity of the PHI you actually hold.
Questions we're often asked.
- Why are we being asked for HIPAA?
- When you handle, host, transmit or have potential access to protected health information, whether directly for patients or on behalf of a covered entity, your customers need assurance that you meet the Privacy, Security and Breach Notification Rules. That includes administrative, physical and technical safeguards proportional to the sensitivity of the PHI you touch, and the BAA obligations that flow with it.
- Is HIPAA certified?
- No. There's no official HIPAA certification. What exists is an independent assessment of your compliance against the Privacy, Security and Breach Notification Rules, which is what your customers and their auditors will actually ask for. We issue attestation reports that demonstrate your compliance for your enterprise customers' review and reliance.
- Do we need HIPAA if we don't touch patient data directly?
- If you host, process or transmit PHI on behalf of a covered entity or another business associate, you're a business associate under HIPAA, and you need a BAA plus the Security Rule safeguards. That includes most infrastructure and SaaS providers in the healthcare stack. Being regulated by HIPAA means you must comply, but you're not obligated to issue an attestation report. The Throughline attestation is an optional way to evidence that compliance to enterprise customers.
- What does a Security Rule risk analysis actually involve?
- A documented, ongoing analysis of the risks and vulnerabilities to the confidentiality, integrity and availability of PHI you hold, together with the safeguards you've applied. It's the single most common area of enforcement findings when it's missing or superficial.
- How does HIPAA interact with SOC 2?
- They're complementary. SOC 2 attests to your controls; HIPAA sets specific safeguard requirements for PHI. Many healthcare-adjacent companies map HIPAA safeguards into their SOC 2 program so a single control set serves both.
How an engagement actually runs.
- 01. PHI inventoryWhere it lives, who accesses it, why.
- 02. Risk analysisThe Security Rule's keystone requirement, done properly.
- 03. Safeguards reviewAdministrative, physical, technical, proportional.
- 04. BAAs & vendorsFlow-down obligations, actually flowed down.
- 05. ReadinessBreach response, audit response, evidence ready.
Ready when you are
Let's discuss your HIPAA needs.
A named senior practitioner will lead the conversation and stay accountable from scoping through report issuance.