A small team can stand up a defensible HIPAA Security Rule programme in about twelve weeks if the scope is narrow and leadership gives time. This calendar is our planning suggestion, not a regulatory timeline. Start with the risk analysis, build policies and technical safeguards from it, train staff, paper your vendors, then rehearse a breach.
What does the law require, in plain terms?
The Security Rule (45 CFR Part 164, Subpart C) covers electronic protected health information. Among its standards, the regulation text requires you to conduct an accurate and thorough assessment of risks and vulnerabilities to the confidentiality, integrity and availability of that information (the risk analysis, marked required), to apply sanctions to workforce members who fail to follow policy, and to regularly review records of system activity such as audit logs and access reports. It also requires periodic evaluation, a security awareness and training programme for all workforce members including management, and documentation retained for six years.
Technical safeguards in section 164.312 include access control, audit controls, integrity, person or entity authentication and transmission security. Some implementation specifications are required and others are addressable, which means you assess them and either implement, implement an alternative or document why not. Addressable does not mean optional.
There is no official HIPAA certificate. Anyone offering one is selling an attestation or an assessment, not a government credential. Your counsel and, if relevant, your customers decide what proof they want.
The 12 week calendar
Week 1, scope and ownership. Name a security official. List every system that creates, receives, maintains or transmits electronic protected health information, and every vendor that touches it. Decide what is out of scope and why.
Weeks 2 to 3, risk analysis. Walk each in scope system. For every threat you can name, record likelihood, impact, existing safeguards and the gap. Score and rank. This document drives everything else, so do not skim it.
Week 4, risk management plan. Turn the ranked risks into actions with owners and dates. Decide what to accept, with leadership sign off on each acceptance.
Weeks 4 to 5, policies. Write the policies the risk analysis calls for: access, sanctions, workstation use, device and media handling, contingency planning, incident response and audit review. Keep them short and true to how you operate.
Weeks 5 to 8, technical safeguards. Implement unique user IDs, multi factor authentication, role based access, encryption in transit and at rest, audit logging with a review routine, automatic logoff where appropriate and integrity protections. Address the highest risks first.
Week 7, business associate agreements. Identify vendors who are business associates and make sure signed agreements exist. Check that each vendor can actually meet their obligations.
Week 9, training. Train everyone, including management, and keep attendance and completion records. Add role specific modules for engineers and support staff.
Week 10, contingency. Test a backup restore and walk through a downtime scenario. Record results.
Week 11, breach drill. The breach notification rule requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Run a tabletop that includes how you decide whether an event is a breach and who signs off on notices.
Week 12, evaluation and handover. Review everything against the rule, log open items and set a recurring schedule for the next year.
What evidence should you keep?
The rule asks for documentation retained for six years from creation or from when it was last in effect, whichever is later. Keep the risk analysis and every revision, policies with approval dates, training records, access reviews, audit log review notes, BAAs, restore tests and breach drill records. Version everything.
Where do teams slip?
- Buying tools before doing the risk analysis.
- A risk analysis that covers the main app but not laptops, email or shared drives.
- Treating addressable items as optional.
- Logs collected and never reviewed.
- Forgetting vendors, including software suppliers that handle data on your behalf.
- No refresh cycle. The rule expects evaluation in response to environmental or operational changes.
What to do
- Appoint a security official and define scope in week one.
- Complete a written risk analysis before anything else.
- Convert risks into a dated management plan approved by leadership.
- Implement access control, authentication, encryption and logging.
- Sign BAAs with every business associate.
- Train all staff and keep records.
- Run a restore test and a breach drill, then schedule annual reviews.
Quick check
Is there a HIPAA certification?
No official government certification exists. Third parties offer assessments or attestations, but meeting the rule is demonstrated through your documentation and practice.
How long must HIPAA documentation be kept?
Section 164.316 requires retaining required documentation for six years from the date of creation or the date it last was in effect, whichever is later.
Sources
- 45 CFR 164.308, administrative safeguards
- 45 CFR 164.312, technical safeguards
- 45 CFR 164.316, policies, procedures and documentation
- 45 CFR 164.404, notice to individuals
The HHS site blocked automated access when we tried to fetch it on 18 October 2026, so regulation text comes from the Legal Information Institute copy. Check HHS guidance for current interpretation.
How Safeguard helps automate this
Much of a twelve week plan is collecting proof. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of screenshots, and monitoring keeps running after the sprint ends. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. The remediation agent can open tested fix pull requests for vulnerable dependencies and other findings; it is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps you prepare and keep evidence ready, and it does not make you HIPAA compliant or replace your counsel or an assessor. Book a call to see it in practice.
Last reviewed: 18 October 2026.
