HIPAA compliance for Australian companies selling into US healthcare
From PHI mapping to evidence: we run the security risk analysis, implement the administrative, physical and technical safeguards, write the policies, and get you ready to sign Business Associate Agreements. Fixed fee agreed up front, and no fake certificates, because no official HIPAA certification exists.
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) is a United States federal law administered by the US Department of Health and Human Services (HHS). Its Privacy Rule and Security Rule set national standards for protecting protected health information (PHI). HIPAA applies to covered entities (healthcare providers, health plans and clearinghouses) and to their business associates, which includes Australian companies that create, receive, maintain or transmit PHI on behalf of a US healthcare customer.
Who this is for
When HIPAA compliance is the ask
HIPAA is usually a commercial requirement before it is a regulatory one: a US healthcare customer, a BAA on the table, or a questionnaire you cannot answer. If any of these sound familiar, this is the engagement.
A US hospital, clinic or health plan wants a signed Business Associate Agreement before the contract starts.
Customer security questionnaires from US healthcare buyers keep landing, and HIPAA questions take days to answer.
You are an Australian healthtech or SaaS company storing or processing US patient data, and compliance is blocking a deal.
An investor, acquirer or insurer wants evidence that your handling of protected health information stands up to scrutiny.
You are expanding from the Australian market into US healthcare and need one security programme that satisfies both.
What you receive
What the engagement includes
Everything a US covered entity's due diligence will ask for, built and evidenced before they ask.
Security risk analysis
The accurate and thorough risk analysis the HIPAA Security Rule requires: where electronic protected health information (ePHI) lives, what threatens its confidentiality, integrity and availability, and a ranked risk management plan.
Safeguard implementation
Administrative, physical and technical safeguards implemented with your team and your IT provider: access controls, audit logging, encryption in transit and at rest, workstation and device controls, and incident procedures.
Policies & procedures
The documented policies and procedures HIPAA expects, written for how your organisation actually operates rather than from a template, with named owners and review cycles so they stay current.
BAA readiness
Review and advice on Business Associate Agreements before you sign them, so the contractual obligations you take on match the safeguards you actually have, plus the subcontractor BAAs you owe downstream.
Workforce training
Security awareness and HIPAA training for the people who touch ePHI, because the Security Rule requires it and because your US customers will ask how you train staff.
Evidence & evaluation
Evidence collection set up to survive customer due diligence, and the periodic technical and non-technical evaluation the Security Rule requires, run the way an outside assessor would run it.
The process
How the engagement runs
Typical elapsed time from kick off to a defensible, evidenced compliance programme is three to five months for an organisation of about 50 staff. The starting maturity of your controls moves that number more than anything else.
Weeks 1–3
Gap assessment & PHI mapping
We map where ePHI is created, received, maintained and transmitted across your systems, and benchmark your current state against the Security Rule. The fixed-fee quote for the build follows from this.
Weeks 3–6
Risk analysis & treatment plan
The documented security risk analysis the Security Rule requires, with a ranked risk management plan covering what blocks customer deals, what carries real breach risk, and what is merely tidy.
Months 2–4
Safeguards & policies
Administrative, physical and technical safeguards implemented with your team, policies written and adopted, workforce training delivered, and evidence collection switched on.
Months 3–5
BAA readiness & customer assurance
Business Associate Agreements reviewed, subcontractor obligations mapped, and a due diligence pack assembled so you can answer US healthcare security questionnaires from evidence, not effort.
Ongoing
Evaluation & maintenance
The periodic evaluation the Security Rule requires, refreshed risk analysis as systems change, and breach notification procedures kept ready. Your team can own this, or our vCISO service runs it.
Already certified to ISO 27001? Much of the Security Rule's safeguard expectations overlap with your ISMS, so the work concentrates on the HIPAA-specific obligations: the risk analysis scoped to ePHI, Business Associate Agreements and breach notification procedures.
Pricing
What HIPAA compliance costs
One fixed consulting fee, quoted in writing after the gap assessment. No hourly billing.
The cost of HIPAA compliance has two lines, and only one of them is ours: our fixed consulting fee and your own team's time. Unlike ISO 27001 or SOC 2, there are no certification body or audit firm fees, because there is no official HIPAA certification to pay for. What you are buying is a working compliance programme and the evidence to prove it to US healthcare customers.
The fee is fixed by scope, which is why every engagement starts with a cybersecurity gap analysis: we map where PHI flows through your systems, benchmark you against the Security Rule, and quote the build as a fixed fee in writing. If you want a read on where you stand first, the free cybersecurity gap assessment takes a few minutes.
Straight answer
There is no official HIPAA certification
The US Department of Health and Human Services (HHS) is direct about this: no HIPAA standard requires an organisation to certify its compliance, and HHS does not endorse or recognise private HIPAA certifications. Anyone selling you a HIPAA certificate is selling you a piece of paper the US government does not recognise, and holding one does not protect you if the Office for Civil Rights investigates a breach.
What regulators and US healthcare customers actually look for is a working programme: a documented security risk analysis, the administrative, physical and technical safeguards of the Security Rule operating in practice, adopted policies, trained staff, signed Business Associate Agreements, and evidence that ties it all together. That programme is what we build. If a customer or insurer wants independent assurance on top, a third-party assessment against the Security Rule, or an ISO 27001 certification that covers the same safeguard ground, is the credible way to provide it.
Why CyberNinja
Why organisations choose us
Built for the US healthcare market
We work with Australian healthtech and SaaS companies selling into US healthcare, so the programme is built around what covered entities and their procurement teams actually ask for.
Auditors build your programme
Our consultants hold ISO/IEC 27001:2022 Lead Implementer and Lead Auditor certifications, so the safeguards, documentation and evidence are built the way they will be reviewed.
Independent advice
We hold no reseller agreements and take no vendor margin, and we do not sell HIPAA certificates, because no legitimate one exists. The advice you get is the advice that fits you.
Fixed scope, fixed fee
The engagement is scoped with you after the gap assessment and quoted as a fixed fee in writing. No hourly billing, no surprise extras.
Want the regulation itself first? Our HIPAA framework guide explains the Privacy Rule, Security Rule and Breach Notification Rule for Australian businesses, and the knowledge base goes deeper.
FAQ
HIPAA compliance FAQs
Prefer to read up first? Browse our Knowledge Base for compliance guides and articles.
Ready to win US healthcare customers?
Tell us who is asking for HIPAA compliance and when they need it. We will scope the work and give you a fixed price, so you know the cost before you commit.