Is there certification for HIPAA compliance?

The short answer is no.

Unlike PCI, there is no one that can “certify” that an organization is HIPAA compliant. The Office for Civil Rights (OCR) from the Department of Health and Human Services (HHS) is the federal governing body that determines compliance. HHS does not endorse or recognize the “certifications” made by private organizations.


There is an evaluation standard in the Security Rule § 164.308(a)(8), and it requires you to perform a periodic technical and non-technical evaluation to make sure that your security policies and procedures meet the security requirements outlined in the rule. HHS doesn’t care if the evaluation is performed internally or by an external organization—just as long as it happens.

That said, being evaluated by an independent, third party auditor is still a really good idea. Even though it’s not official you should still do it. There are a number of great companies that can help you with this process. For example, Coalfire Systems and ComplySmart offer HIPAA Assessments that can let you know how you stack up to the requirements outlined by the legislation.

This is important: Even if you get a “certification” from an external organization, HHS can still come in and find a security violation. Third party audits and “certifications” do not absolve you from your legal obligations under the Security Rule.