How long does HIPAA take?
There is no HIPAA certificate to wait for. There is a program to build and keep running. Here is how long the first version takes, step by step.
- Security Rule program
- About 2 to 4 months
- Risk analysis, safeguards, policies, BAAs and training, in place and written down.
- Official certification
- None
- HHS does not certify companies. Buyers ask for your evidence, or an independent assessment.
- After that
- Ongoing
- Review your risk analysis and safeguards regularly. Keep your records for 6 years.
Counted from the day you start. Teams that already run SOC 2 are often faster. An optional independent assessment adds time.
14-day free trial. No credit card.
Where the time goes
All of it is work you control. That is why software makes HIPAA faster than most frameworks.
Scroll sideways to see the whole chart.
- You and Strac Comply
Bars show a typical case. The bracket shows the earliest and latest week.
Five steps to your HIPAA program
Strac Comply covers the HIPAA Security Rule and the Breach Notification Rule. Privacy Rule work is extra.
Step 1: Sign up, connect and find your ePHI
About 1 to 2 weeksYou, with Strac Comply
Connect your systems. Then list where electronic protected health information (ePHI) is stored, sent and used, and which vendors touch it.
Step 2: Do your security risk analysis
About 2 to 4 weeksYou, with Strac Comply
The Security Rule requires an accurate and thorough risk analysis (§164.308(a)(1)(ii)(A)). Find the risks to your ePHI and decide how you treat each one.
Step 3: Put your safeguards in place
About 4 to 8 weeksYou, with Strac Comply
Close the gaps your risk analysis found. For example:
- Turn on MFA, encryption and audit logs
- Approve your security policies
- Sign a BAA with each vendor that handles ePHI
- Write down your addressable decisions
Step 4: Train your team and review
About 1 to 3 weeksYou and your team
Run security awareness training, then check that your safeguards and records are complete.
Step 5: Show your buyers
When they askYou, or an independent assessor
Share your risk analysis, policies and evidence. If a buyer wants more, an independent firm can assess you. That is optional, and it adds time.
What nobody can promise you
There is no official HIPAA certification
HHS does not certify companies or recognize private certifications. A badge that says "HIPAA certified" is a vendor's own label.
An assessment is optional and independent
If a buyer asks for one, an independent assessor does it. Strac is never the assessor.
HIPAA does not end
You review your risk analysis and safeguards regularly, and you keep your records for 6 years.
Questions founders ask
Can I get HIPAA certified?
Not officially. HHS does not certify companies and does not recognize private certifications. What you can show is your risk analysis, your policies, your BAAs and your evidence, or an independent assessment.
How long does HIPAA take for a SaaS business associate?
Most startups build a documented Security Rule program in about 2 to 4 months. Teams that already run SOC 2 are often faster, because many controls are the same.
Do I need a BAA with my vendors?
Yes, with each vendor that creates, receives, keeps or sends ePHI for you. Your customers will also ask you to sign one with them.
Is HITRUST the same as HIPAA?
No. HITRUST is a separate certification with its own assessment. It takes longer: an e1 is often 3 to 6 months, and an r2 often 8 to 15 months.
What do I keep doing after?
Review your risk analysis and safeguards regularly, train new staff, and keep your HIPAA records for 6 years. If a breach happens, you notify within 60 days of finding it.
Does Strac Comply cover the Privacy Rule?
No. Strac Comply covers the Security Rule and the Breach Notification Rule. Privacy Rule work, such as patient rights, is extra.
How long does each framework take?
Typical times for a startup that uses Strac Comply, from the day you start.
SOC 2
About 4 months
To a first Type II report. A Type I takes about 1 to 2 months.
See the SOC 2 timelineISO 27001
About 3 to 6 months
To a certificate, after a Stage 1 and a Stage 2 audit.
See the ISO 27001 timelineHIPAA
About 2 to 4 months
To a documented Security Rule program. There is no official certification.
You are reading this one
PCI DSS
About 4 to 8 weeks
For a self-assessment (SAQ). A Level 1 assessment by a QSA takes about 4 to 8 months.
See the PCI DSS timeline
Your HIPAA program starts with your risk analysis. Start today.
Connect your systems, find your ePHI and see your gaps on day 1.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing · HIPAA in Strac Comply