Is there such a thing as HIPAA certification?

What HHS actually says

This is not our interpretation. Asked directly whether a covered entity must certify its compliance with the Security Rule, the Office for Civil Rights answers:

No, there is no standard or implementation specification that requires a covered entity to “certify” compliance. … It is important to note that HHS does not endorse or otherwise recognize private organizations’ “certifications” regarding the Security Rule, and such certifications do not absolve covered entities of their legal obligations under the Security Rule.

And on the vendors who imply otherwise, OCR keeps a standing notice about misleading marketing claims:

HHS and OCR do not endorse any private consultants’ or education providers’ seminars, materials or systems, and do not certify any persons or products as “HIPAA compliant.” The Privacy Rule does not require attendance at any specific seminars.

That notice ends with an address. If a vendor tells you their course or software is endorsed or required by HHS, OCR asks to be told: ocrcomplaint@hhs.gov.

What to build instead

Everything a certificate is imagined to prove, the regulation asks for directly. These are the five things a client’s security review and an OCR investigation both reach for.

• A current risk analysis

  The Security Rule's first requirement and the first thing an investigator asks for. Not a questionnaire score — an assessment of where patient information actually lives in your systems, what could go wrong, and what you decided to do about each finding.

• Written policies your staff have actually read

  Versioned, dated, and acknowledged per person. A policy nobody signed is a document, not a control, and the acknowledgement record is the part that gets requested.

• Workforce training with per-person records

  Required by 45 CFR 164.530(b) for the Privacy Rule and 164.308(a)(5) for security awareness. The deliverable is the dated record of who completed what — which is the legitimate certificate, held by a person rather than the company.

• A signed agreement with every vendor that touches patient data

  Who they are, what they can see, what is signed, and when it renews. This is the register that a client's security questionnaire is usually really asking about.

• The periodic evaluation at 164.308(a)(8)

  The closest thing the rule has to the idea people mean by certification: a periodic technical and non-technical evaluation of how far your policies and procedures meet the requirements. HHS says it may be done internally or by an outside firm — and that buying it from an outside firm changes none of your obligations.

Common questions

Does HIPAA certification expire?

The question has no answer because the thing does not exist: there is no organizational designation to expire. What can expire is an individual's certificate of completion from a training course, and its validity period is set by whoever sold the course — commonly one year — not by any regulation. The obligation that genuinely recurs is training itself, plus the periodic evaluation at 45 CFR 164.308(a)(8).

How long does HIPAA certification last?

Nothing lasts, because nothing is issued. No government body certifies an organization, and HHS states plainly that it does not recognize private organizations' certifications regarding the Security Rule. A training vendor's certificate typically carries a one-year validity the vendor chose. Treat the annual cycle as good practice with a defensible paper trail, not as a credential with an expiry date.

How long does it take to get HIPAA certified?

An individual can finish a training course in one to three hours and receive a dated certificate of completion. An organization cannot be certified at all, at any price, in any timeframe — no such designation exists. Building the programme a client or an investigator will actually ask about takes weeks: a risk analysis, written policies, trained staff, signed agreements and the records that prove each one.

What are the HIPAA certification requirements?

There are none, because no such designation exists to have requirements. HHS: “there is no standard or implementation specification that requires a covered entity to certify compliance.” The requirements that do exist are the Privacy and Security Rules themselves — risk analysis, policies, workforce training, business associate agreements, and six years of documentation.

Is a HITRUST or SOC 2 certification the same thing?

No, but they are real, unlike the HIPAA version. HITRUST CSF certification and a SOC 2 report are private attestations against private frameworks, issued by private assessors. A client may legitimately ask for one and they can be strong evidence. Neither is issued by HHS, neither is required by the regulation, and neither prevents HHS from finding a violation.

Sources

Both read directly on August 10, 2026. Every quotation above is verbatim.

1. Are we required to “certify” our organization’s compliance with the standards of the Security Rule? — U.S. Department of Health and Human Services, Office for Civil Rights.
2. What You Should Know About OCR HIPAA Privacy Rule Guidance Materials: be aware of misleading marketing claims — U.S. Department of Health and Human Services, Office for Civil Rights.