HIPAA is a US federal law governing the privacy and security of protected health information (PHI), enforced by the HHS Office for Civil Rights (OCR). There is no official HIPAA certification. HHS has stated this directly and repeatedly. Compliance is an ongoing legal obligation, evidenced by your actual safeguards and documentation — not a one-time credential.
Why We're Leading With What HIPAA Certification Isn't
Search "HIPAA certification" and you'll find dozens of vendors selling seals, badges, and certificates. HHS has been explicit that it does not endorse or recognize any of these private programmes, and that holding one "does not absolve covered entities of their legal obligations." A 2021 amendment to the HITECH Act does require HHS to consider "recognized security practices" when determining fines — but this is not the same as certification.
A framed certificate means nothing if OCR investigators ask for your Security Risk Assessment and find none. What actually protects you is the underlying compliance work: documented risk analysis, implemented safeguards, workforce training records, business associate agreements, and breach notification procedures.
What We Actually Help You Build
- Security Risk Assessment (SRA): the single most commonly cited deficiency in OCR enforcement actions
- Administrative, physical, and technical safeguards: documented policies and controls
- Privacy Rule policies: minimum necessary standard procedures, patient rights processes
- Breach Notification procedures: documented processes for identifying, assessing, and reporting breaches
- Business Associate Agreements: properly structured agreements with vendors and partners
- Workforce training records: documented, substantive training
Current Enforcement Reality
OCR enforcement is active and increasing: more than 20 enforcement actions resulted in settlements or civil monetary penalties in 2024 alone. OCR's Risk Analysis Initiative continues to specifically target organisations lacking a genuine, documented Security Risk Assessment. Phase 3 of OCR's compliance audit programme is currently underway.
Build Real Compliance Evidence
Free consultation. We assess your current gaps honestly and provide a fixed quote within 24 hours.
Get Free Consultation →Health-Tech Company?
SOC 2 and ISO 27001 are genuine, accredited certifications many health-tech buyers also expect.
Explore ISO 27001 →Real value of honest HIPAA readiness work
Based on outcomes reported by healthcare organisations we've advised.
Evidence That Actually Holds Up
Documented Security Risk Assessments and safeguards are what OCR investigates — not a certificate.
Addresses the Most Common Deficiency
A missing or outdated Security Risk Assessment is the most frequently cited gap in OCR enforcement actions.
Honest, No False Assurance
We will never sell you a certificate implying government recognition that doesn't exist.
Favourable Treatment Under HITECH
Demonstrating genuine, ongoing "recognized security practices" can lead to more favourable treatment in HHS penalty determinations.
Pairs Naturally with ISO 27001
For health-tech companies wanting a genuine, accredited security credential alongside HIPAA readiness.
Ready for OCR's Active Audit Program
With Phase 3 of OCR's compliance audit programme underway, genuine documented readiness matters more than ever.
What organisations say about London Cert's HIPAA advisory
Feedback from healthcare organisations and business associates we've worked with.
“We'd bought a "HIPAA certificate" from another vendor years ago and never had a real Security Risk Assessment. London Cert was honest that the certificate meant nothing and helped us build the actual documentation we needed.”
“As a health-tech business associate, we needed genuine evidence for our enterprise clients' vendor risk assessments. London Cert's work gave us that, plus honest guidance on pairing with ISO 27001.”
“We appreciated that London Cert didn't try to sell us a meaningless seal. The Security Risk Assessment and policy work they did was genuinely thorough and gave our board real confidence.”
The real evidence that protects you
OCR evaluates your actual safeguards and documentation — this is what we help you build.
Security Risk Assessment (SRA)
A thorough, documented analysis identifying risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI — the foundation for everything else.
Administrative Safeguards
Security management processes, workforce security policies, access management, and security awareness training programmes.
Physical & Technical Safeguards
Facility access controls, workstation security, encryption, access controls, audit logs, and transmission security for ePHI.
Business Associate Agreements
Properly structured contracts with every vendor or partner handling PHI on your behalf.
Breach Notification Procedures
Documented processes for identifying, assessing, and reporting breaches within legally required timeframes.
Workforce Training Records
Substantive training covering the Privacy Rule, Security Rule, and Breach Notification Rule — with documented completion records.
London Cert helps you build genuine documentation across all six areas — this is what forms your actual compliance posture, not a certificate.
What's changing (and what isn't, yet)
A significant proposed update is pending, but not yet finalised.
The first major proposed update to the Security Rule since 2013. The most significant proposed change: eliminating the distinction between "required" and "addressable" implementation specifications.
Despite the public comment period closing in March 2025, OCR has not issued a final rule as of mid-2026. There is no confirmed timeline for when, or whether, the proposal will be finalised.
More than 20 enforcement actions resulted in settlements or civil monetary penalties in 2024 — regardless of the pending rule change, current enforcement remains robust.
HHS confirmed updated civil monetary penalty amounts for HIPAA violations, reflecting the annual inflation adjustment required by law.
Organisations already treating addressable specifications as effectively required — good practice regardless — will face less disruption if and when the rule is finalised.
How we build your real compliance evidence
An honest, thorough process — no shortcuts, no false certificates.
Free Consultation & Gap Assessment
We assess your current documentation, safeguards, and any prior risk assessments, and provide a fixed quote within 24 hours.
Security Risk Assessment
A thorough, documented analysis of risks to ePHI confidentiality, integrity, and availability.
Policy & Safeguard Development
We build the administrative, physical, and technical safeguard documentation, BAAs, and breach notification procedures your assessment identifies as needed.
Training & Ongoing Readiness
Workforce training delivery and documentation, plus guidance on maintaining this as an ongoing programme, not a one-time exercise.
HIPAA Compliance — every question answered honestly
The most-asked questions — straight, accurate answers.
No. The U.S. Department of Health and Human Services (HHS) has stated directly, in its own published guidance, that it does not endorse or recognize any private organization's certification regarding the HIPAA Privacy Rule or Security Rule, and that such certifications do not absolve covered entities of their legal obligations. No government agency — HHS, OCR, or CMS — issues a certificate declaring an organization "HIPAA compliant."
Still have questions?
Our HIPAA compliance advisory team is available for a free consultation.
Talk to an Expert →Need Genuine Accredited Certification?
Explore ISO 27001 for real IAF-accredited information security certification.
Explore ISO 27001 →