The HIPAA Security Rule text sets standards that covered entities and business associates must meet. It does not create a certificate a software vendor can earn. A vendor can offer assurances instead, such as a signed business associate agreement, a documented risk analysis and independent audit reports, but none of them is a HIPAA certification.
What the rule text actually says
Read the Security Rule sections that deal with vendors and you find obligations, not a credential. A covered entity may let a business associate handle electronic protected health information once it obtains "satisfactory assurances" that the associate will appropriately safeguard it. Those assurances are documented in a written contract or other arrangement. The associate must comply with the applicable parts of the Security Rule, make sure its own subcontractors agree to do the same, and report security incidents it becomes aware of.
Nothing in those paragraphs says "get certified." The standard is about what the vendor does and whether the buyer has reasonable confidence in it. That is why a badge on a website cannot settle the question.
What vendors show instead
| Evidence | What it tells you | What it does not tell you |
|---|---|---|
| Business associate agreement | The vendor accepted contract duties | That the controls work |
| Written risk analysis summary | The vendor looked for risks in its own systems | Whether the risks were fixed |
| SOC 2 report | An independent auditor tested stated controls over a period or at a date | That the scope covers the product you buy |
| HITRUST or ISO 27001 certificate | A framework assessment was completed | That it maps to your use of PHI |
| Penetration test summary | Someone tried to break in at one point in time | Ongoing exposure |
Each item is useful. None is a HIPAA seal. When a salesperson says "we are HIPAA certified," ask what they mean and request the underlying document.
How to read the claim
- Ask which entity and which product the report or assessment covers. Scope gaps are common.
- Check the dates. A report from two years ago describes an older system.
- Read exceptions and findings, not the cover page.
- Ask whether the vendor will sign your business associate agreement or just its own.
- Ask how subcontractors are vetted, since the vendor carries that duty under the rule.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how one control maps to several frameworks, and note that mapping evidence is not the same as being certified.
What a buyer should document
The rule also expects the buyer to document its decision. Keep the questionnaire, the evidence received, the date you reviewed it and who approved the vendor. If a regulator or customer asks why you trusted a vendor, that file is your answer. This is practical advice for engineering and procurement teams, and your counsel should confirm how it applies to you.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Does a SOC 2 report mean a vendor meets HIPAA?
No. SOC 2 is an attestation about controls the vendor chose to describe. It can support your review, but it does not decide HIPAA questions.
Can I trust a HIPAA compliant badge?
Treat it as a marketing claim until you see scope, dates and the documents behind it. The rule text has no vendor certificate, so ask what the badge refers to.
Sources
Last reviewed: 19 October 2026.
