Make HIPAA Compliant: 7 Steps to Follow (2026 Guide)

You can't buy a HIPAA certificate, because no government body issues one.

You become compliant by meeting the Privacy, Security and Breach Notification Rules and by keeping documents that prove it, starting with a written risk analysis, whether you track those records by hand or through a workflow tool such as Activepieces.

HIPAA Compliance Requirements and Scope

Everything below is drawn from HHS guidance as read on 2026-10-18.

HHS doesn't certify or endorse products, vendors or training programs. HIPAA is a federal law, and HHS enforces it through regulations called rules.

A "HIPAA certified" badge is a marketing claim, and an auditor will ask for your analysis, policies and records, not the badge. The practical consequence is that compliance is a condition you maintain and can be asked to demonstrate, not a purchase you complete.

Covered entities and business associates

A covered entity is a health plan, a healthcare clearinghouse, or a provider that transmits health information electronically in connection with standard transactions such as billing insurers (HHS).

The practical consequence is that compliance is a condition you maintain and can be asked to demonstrate, not a purchase you complete.

A business associate is any outside party that handles protected information on a covered entity's behalf (HHS). The two are bound differently, and the contract between them must say so.

Until you establish otherwise, treat every connection that moves data to a third party as a business associate relationship.

Protected Health Information (PHI) Definition and Identifiers

PHI is individually identifiable health information that a covered entity or business associate creates, receives, maintains or transmits. HHS's de-identification guidance lists 18 identifiers, including names, dates tied to a person, and geographic detail below state level (HHS).

That means a record with no name can still be PHI if it carries a visit date and a ZIP code, so stripping the obvious field isn't a control.

Where HIPAA applies in practice: clinics, billing firms, SaaS vendors

A clinic is usually a covered entity. A billing firm that processes its claims is a business associate, and so is a software vendor that stores or relays its records.

Activepieces is judged by the same logic when a team wires appointment data through it: its MIT-licensed core ships 741 integrations, any of which can become a destination for PHI, and whether PHI reaches one decides what you owe, not its category.

Each term reduces to one test:

• Covered entity: you are a health plan, a clearinghouse, or a provider that bills electronically for care.
• Business associate: you create, receive, maintain or transmit PHI for a covered entity, and you aren't part of its workforce.
• PHI: the data relates to health, care or payment, and it can be tied to a person through any of the 18 identifiers.
• The three rules: Privacy governs who may use or disclose PHI, Security governs how electronic PHI is protected, and Breach Notification governs what you must report and when. They apply to you if either of the first two tests does.

If any test returns a yes, the next question is what your risk analysis must contain and who signs it.

Seven Steps to Make a Business HIPAA Compliant

Seven steps, taken in order, make a business HIPAA compliant, and the second one, the written risk analysis, is the step that matters most because every later decision depends on it.

The sequence below shows what each step produces, so that at the end you hold seven documents an auditor can ask for and you can hand over.

HHS builds its Security Rule guidance around the same logic: know what you hold, assess the risk, then act on what you found.

Each step below names the artifact it should leave behind.

Artifact: a PHI inventory. List every system, device, vendor and automation that creates, stores or transmits protected health information. Include the unglamorous places, such as shared inboxes, spreadsheets and scanned forms.

Anything missing here is invisible to every later step, so it becomes an unassessed risk. Small practices can finish this quickly; larger ones need interviews with each department.

Step 2: Complete a written risk analysis

Artifact: a dated risk analysis document. For each item in the inventory, record the threat, how likely it is, the impact, and the safeguard in place. Name the person who signed it.

Most penalties trace back to this step: an organization with good tools but no documented analysis can't show it knew what it was protecting. Budget the most time here, and expect it to be the longest stage.

Step 3: Apply administrative, physical and technical safeguards

Artifact: a remediation record tied to the risk analysis. Access controls, encryption, audit logging, locked equipment and workforce sanctions all belong here, but only as responses to risks you identified.

Every control should point back to a line in the analysis. Spending on a control with no matching risk has no evidence behind it.

Step 4: Sign business associate agreements

Artifact: a signed agreement for every vendor that touches PHI. This covers cloud hosts, billing services and any automation platform that moves patient data.

Where a vendor won't sign, the data shouldn't go to that vendor. Treat each new connection as a liability until the agreement is on file.

Step 5: Write policies and train staff

Artifact: written policies and a training log. Policies state who may see what and what happens when rules are broken.

The log records who was trained, on what, and when. Training without a record can't be shown to anyone, so for audit purposes it didn't happen.

Step 6: Prepare a breach response plan

Artifact: a breach response plan. Define who decides whether an incident is a reportable breach, who notifies patients and regulators, and how evidence is kept. Test it once with a realistic scenario, because a plan first read during an incident is a draft.

Step 7: Document everything and review annually

Artifact: a review file. Revisit the inventory and risk analysis at least yearly and whenever you add a system, vendor or workflow. Keep the previous versions, since the history of your decisions is the evidence of compliance.

HIPAA Compliance Costs and Penalty Figures

A single enforcement action costs many times what the documentation that makes you compliant does, which is a few thousand dollars a year. That gap is the case for doing the paperwork.

HIPAA Penalty Tiers and OCR Fine Ranges

Per violation, HHS's Office for Civil Rights (OCR) sets a penalty range according to how much the organisation knew and how it responded.

Tier 1 runs from $145 to $73,011, and Tier 2 from $1,461 to $73,011, meaning Tier 1 enforcement reaches organizations one-tenth the size of Tier 2's minimum. Tiers 3 and 4 sit above them.

The top of Tier 1 is the same as the top of Tier 2, so a violation you didn't know about can be fined as heavily as one you should have known about.

What you can show you knew and did decides the tier. A dated risk analysis with actions taken is your evidence for the lower tiers.

Realistic budget lines for a small organisation

Accountable HQ puts three baseline items in small-practice terms:

1. A risk assessment costs $1,500 to $6,000. This is the one step most penalties trace back to, so it's the line to protect last.
2. Policy templates cost $1,000 to $4,000, which covers the written procedures the assessment should drive.
3. According to Accountable HQ, annual training costs $300 to $1,500, and it recurs, so budget it every year.

Together that's $2,800 at the low end and $11,500 at the high end. Most of the spread comes from how much of the work you do in-house, which makes it a choice about staff time.

Notable HIPAA Settlements and Healthcare Breach Costs

Sunhawk Consulting's 2025 enforcement summary lists the largest 2025 OCR settlements:

• BayCare Health: $800,000
• Northeast Radiology: $350,000
• USR Holdings: $337,750
• BST & Co. CPAs: $175,000
• VPN Solutions: $90,000
• Elgon Information: $80,000

Look at the spread rather than the top figure. Even the smallest, $80,000, is nearly seven times the $11,500 ceiling of the baseline budget above.

The list also includes an accounting firm and a technology vendor alongside a health system and a radiology practice, so enforcement isn't limited to hospitals. If you handle protected health information for someone else, expect to be held to the same standard.

Common HIPAA Mistakes That Trigger Enforcement

Enforcement tends to follow a short list of repeatable failures: no documented risk analysis, no business associate agreement, unprotected devices and access, and PHI copied into tools nobody inventoried. The same rules apply whether you're the provider or the vendor serving one.

374,322 complaints have reached the HHS Office for Civil Rights, and it has investigated 46,752 of them, about one in eight. The funnel below shows how quickly that narrows.

Of those investigations tracked by HHS Office for Civil Rights, 31,191 ended in corrective action and only 152 in a monetary penalty. Because a fine is rare, the exposure isn't the odds of being caught but what the investigator finds once you are.

Resolution agreements keep citing the same four gaps, and each has a fix.

Skipping the HIPAA Security Risk Analysis

The most cited failure is the absence of an enterprise-wide risk analysis. In the 2016-2017 OCR audits, only 14 of 100 covered entities and 17 of 100 business associates had a satisfactory one, as the chart shows.

More than eight in ten audited organizations, then, had nothing an investigator could accept as the basis for their safeguards. The fix is to inventory every system that touches PHI, rate each risk, record your decisions, and repeat the exercise whenever you add a system.

Using vendors without a business associate agreement

However secure the vendor is, sharing PHI with one that hasn't signed a business associate agreement (BAA) is a violation on its own.

List every vendor that can see PHI, get the agreement signed before data moves, and keep the signed copies where an auditor can find them.

Neglecting Encryption and Access Controls for HIPAA

One lost device becomes a reportable breach, which is why unencrypted laptops and phones recur in resolution agreements. Over-broad access does similar damage: when everyone can open every record, you can't show who saw what.

Encrypt every device, and give each role only the records it needs. Review those permissions on a schedule, and keep the review notes.

Automations and spreadsheets that quietly copy PHI

Every time two systems are connected, another copy of the data exists and so does another place for it to leak.

When a workflow exports patient rows to a shared spreadsheet, or pastes notes into a consumer chat tool, PHI moves outside every control you documented.

Add each automation to the risk analysis as its own line item. Confirm a BAA covers every service it touches, and take PHI out of any tool you can't cover.

Automation Platforms and HIPAA: What Activepieces Offers

Activepieces gives a regulated team SOC 2 Type II, SSO, custom role-based access control and audit logs, plus a self-hosted edition that keeps data in its own environment.

It states no HIPAA certification and no BAA, so the risk analysis and the decision about each connection stay with you.

The same product runs self-hosted or on cloud, its core is MIT-licensed on GitHub, and its enterprise governance feature set lists SSO, SCIM, custom RBAC and audit logs by name.

Any workflow that moves patient data falls under the Security Rule, and every step it touches is a place PHI can leak.

The surface grows fast. The connectors library lists 450 integrations, from Webhook and HTTP to Gmail and Google Sheets, sorted by popularity.

Before any of them enters a flow that handles patient records, each needs its own answer on coverage, because each is a possible new destination for PHI.

Requirement-by-requirement table

I checked these against Activepieces' own pages on 2026-10-18. Plan and pricing for the enterprise items come through sales, not a public price list.

Requirement	What Activepieces offers
Independent audit of controls	SOC 2 Type II
Central identity and offboarding	SSO and SCIM
Limit who can edit or run flows	Custom role-based access control
Evidence of who did what	Audit logs
Control over where data is processed	Managed cloud in an EU or US region
Data never leaves your network	Self-hosting, including air-gapped installs

Do not read SOC 2 Type II as a HIPAA certification; it is an audit report. It's useful evidence for your risk analysis, but it doesn't replace one.

SSO with SCIM matters because an account left active after someone departs is an access finding waiting to happen. Audit logs matter because they let you show, after an incident, which flow touched which data.

Self-hosting to keep PHI in your own environment

A regulated team can self-host Activepieces so workflow data stays inside infrastructure it already controls, including an air-gapped network with no outbound path.

The core is MIT-licensed and its source is public on GitHub, so a security reviewer can read what runs inside that environment; only the enterprise directories (packages/ee/) sit under a separate commercial licence.

Self-hosting also removes one outside party from the PHI path, which shrinks the number of agreements you must chase.

It also moves work onto you. You patch the server, back it up, restrict access to it, and document all of that in your risk analysis. Convenience goes down and control goes up, and the work lands on your staff, not the vendor's.

HIPAA Security Review Questions for Automation Platforms

• Which connectors in our flows will carry PHI, and does a BAA cover each service behind them?
• Does the plan we are buying include SSO, SCIM, custom roles and audit logs, or are some of them separate tiers?
• How long are audit logs kept, and can we export them?
• Where does workflow data sit on the managed cloud, and what stays out of logs?
• If we self-host, what are our patching and backup duties?
• Can we see the current SOC 2 Type II report?

Request the security documents and enterprise pricing before you build the first flow; the enterprise directories (packages/ee/) sit under a separate commercial licence from the MIT-licensed core, and the enterprise governance feature set lists SSO, SCIM, custom RBAC and audit logs by name, with both available at https://www.activepieces.com/sales.

File them with the risk analysis you're going to document anyway.

Frequently asked questions

These are the questions the vendor documents above tend to raise, and each answer returns to the same point: the risk analysis is the control, and everything else supports it.

Is there an official HIPAA certification?

No. The federal government doesn't certify businesses, software or products as HIPAA compliant. A vendor advertising "HIPAA certified" is selling its own badge or an outside assessment, which can be useful evidence but doesn't transfer compliance to you.

Your exposure stays with your own documented analysis and the actions you took on it.

Does a small practice with five staff need to comply?

Yes. The rules apply to any covered entity, and to the business associates that handle its data, regardless of headcount. Size changes how much safeguarding is reasonable, not whether you're in scope.

Often a small practice with a thin analysis is as exposed as a large one, with fewer people watching for gaps.

Is Google Workspace HIPAA compliant by default?

No. Google offers a business associate agreement that covers specific services in Workspace, but you have to accept it and configure those services appropriately.

Anything outside the covered list, and any setting left permissive, remains your liability. Your risk analysis should examine exactly these: sharing defaults and who can see which files.

How often must a HIPAA risk analysis be redone?

The rule sets no fixed interval, but it expects the analysis to be kept current.

Treat a regular scheduled review as the minimum, and redo the affected portion whenever something changes: a new system, a new vendor, a new automation that moves patient data, a staffing change or an incident.

Each new connection is a new place data can leak, so it belongs in the document before it goes live.

How long does it take to become HIPAA compliant?

There's no finish date, because compliance is a continuing practice rather than a status you reach. In a small organization with few systems, the first analysis can be done quickly.

Acting on what it finds is the slower part: fixing access, signing agreements, training staff and retiring tools you can't defend. An auditor looks for evidence that you identified the risks and worked through them.

Once you have these answers on record, the practical next step is to put the analysis, the agreements and the remediation log in one place where you can produce them on request.

Related reading

• HIPAA Compliant Automation: What It Is and Top Tools (2026)
• HIPAA Compliant AI Agents: A 2026 Requirements Guide
• GDPR Compliant workflow automation

References

• Accountable HQ
• HHS Office for Civil Rights
• Sunhawk Consulting