HIPAA compliance (consulting and training)
HIPAA protects health information in the United States and reaches overseas vendors that handle it as business associates. There is no official HIPAA certification, and HHS does not endorse private certificates. ICFC helps you confirm your obligations, run a Security Rule risk analysis, build policies and safeguards, and train your workforce.
Cybersecurity, IT and Data Protection
- Standard or scheme
- HIPAA
- US Department of Health and Human Services (HHS)
- Type
- Regulation
- No official certification
- Funding
- Not on the EDGE Standards list
- Non-grant engagement
What is HIPAA?
HIPAA is the US law that protects health information.
Its Privacy, Security and Breach Notification Rules apply to US covered entities, such as health plans and most healthcare providers, and to their business associates, including overseas vendors that create, receive, keep or send protected health information for them. The Security Rule asks for a documented risk analysis and administrative, physical and technical safeguards for electronic health information.
Who is HIPAA for?
Singapore and regional organisations that serve US healthcare clients, such as health-tech and SaaS firms, medical billing and coding, transcription, contact centre, clinical research and IT service providers that sign business associate agreements.
Key details
Key obligations
A documented, organisation-wide risk analysis and risk management plan; policies and workforce training; access, audit and integrity controls for electronic health information; business associate agreements; and breach notification without unreasonable delay and no later than 60 days after discovery.
Rule changes to watch
HHS proposed major Security Rule updates in January 2025. When we checked on 12 October 2026 they were not final, and HHS's regulatory agenda pointed to July 2027. We plan to the current rule and flag the proposed changes.
Singapore context
Health data about people in Singapore is governed by the PDPA and Singapore's own healthcare rules, not HIPAA. Where you handle both, we map HIPAA safeguards to the PDPA, ISO/IEC 27001 and the CSA Cyber Essentials and Cyber Trust marks, so one set of controls serves all.
Our role
Consulting and training only. ICFC is not a law firm and does not give legal advice; for contract or liability questions, consult a qualified US lawyer.
No grant found when checked - Non-grant engagement
We did not find this framework on the EDGE Standards list when we checked, so we quote it as a non-grant engagement. Check Enterprise Singapore before you assume any grant support.
Impartiality
Impartiality comes first. Every engagement begins with a conflict-of-interest check. We keep consulting and auditing roles separate, and our auditors never audit, on behalf of a certification body, an organisation that ICFC has consulted on the same scope within the period set by that body.
Our certification role
We do not certify organisations ourselves; certificates are issued by accredited certification bodies or scheme owners.
How we help
No official certification
HHS states that it does not certify people or products as HIPAA compliant and does not recognise private HIPAA certificates. ICFC does not issue HIPAA certificates.
Compliance evaluations
First-party evaluations of your safeguards against the Privacy, Security and Breach Notification Rules, including the periodic technical and non-technical evaluation the Security Rule asks for, with a prioritised action list.
Business associate reviews
Second-party reviews of subcontractors that handle protected health information for you, checked against your business associate agreements.
Funding
We explain which scheme, if any, applies and what it requires before you commit.
Non-grant
A fixed-scope engagement: gap assessment, documentation, implementation coaching, internal audit and management review, and support through the formal audit or assessment.
How we work
Practical, proportionate systems that your staff can run after we leave.
Classroom
Public and in-house classroom sessions. Courses on HIPAA: workforce awareness of the Privacy, Security and Breach Notification Rules, Security Rule risk analysis, and business associate obligations.
Online LMS
Self-paced and live-online courses on the ICFC Digital LMS, with progress tracking and certificates of completion.
Funding
Funding depends on each course's approval status, shown on the course page in the LMS.