HIPAA compliance that's actually maintained, not just claimed.
There's no such thing as a HIPAA certificate — compliance is an ongoing process. We run that process for you: risk assessment, safeguards, training, and breach response, kept current as your business changes.
HIPAA compliance, answered directly
By Joe Engelking, CEO. Updated October 2026.
Who has to comply with HIPAA?
HIPAA applies to covered entities, which are healthcare providers, health plans, and healthcare clearinghouses, and to business associates, which are vendors that handle protected health information on their behalf. A small practice, a billing company, or an IT provider with access to patient data can all be covered.
What does a HIPAA risk assessment cover?
A risk assessment identifies where protected health information lives, who can access it, which safeguards exist, and where the gaps are. It documents threats such as lost devices, weak passwords, and unencrypted email, then produces a plan to fix them. It has to be repeated as your systems and staff change.
What are the HIPAA safeguards?
HIPAA requires three kinds of safeguards. Administrative safeguards cover policies, training, and a designated privacy and security officer. Physical safeguards cover facilities and devices. Technical safeguards cover access controls, encryption, audit logging, and secure transmission. A compliant practice documents all three and keeps them current.
How should a small practice prepare for a HIPAA audit or security questionnaire?
Keep your risk assessment, policies, staff training records, business associate agreements, and breach response process organized and current. Partners and insurers also send detailed security questionnaires, and your answers must match reality. We help practices complete them and make sure the controls described are actually in place.
| Requirement | What it involves | How we handle it |
|---|---|---|
| Risk assessment | Find where patient data lives and where the gaps are | We run the cybersecurity risk assessment and repeat it |
| Privacy and security officer | Name someone responsible for the program | We help designate and support that role |
| Safeguards and training | Administrative, physical, and technical protections plus staff training | We roll out safeguards and train staff |
| Business associate agreements | Agreements with every vendor that touches patient data | We collect and track them |
| Breach notification | A defined process for responding to a breach | We build the process before you need it |
Managing security and compliance for healthcare practices
The American Board of Psychiatry and Neurology in Buffalo Grove, Isaac Ray Center in Chicago, and Dr. Roma Franzia’s practice in Winnetka rely on us to manage their security and make sure they stay compliant. We run HIPAA as an ongoing process, not a one-time project.
Joe Engelking, CEO
What we actually do, not just paperwork.
Cybersecurity Risk Assessment
We identify vulnerabilities in your systems and document exactly what needs to change to close the gaps.
Privacy & Security Officer role
We co-manage this role with you, making sure your HIPAA policies and procedures are actually followed, not just written down.
Safeguards & staff training
Administrative, physical, and technical safeguards implemented and reinforced with training your staff will actually remember.
The path to HIPAA compliance.
- Cybersecurity risk assessment (CSRA)
- Privacy & Security Officer designation
- Administrative, physical & technical safeguards
- Safeguard rollout & staff training
- Business Associate Agreement (BAA) collection
- Breach notification process
There is no HIPAA certificate.
No government body issues one. What matters is meeting privacy requirements, maintaining cybersecurity standards, training staff, and keeping documentation current — an ongoing process, not a one-time task. We keep that process running so you're not scrambling to reconstruct it during an audit.
Trusted by local businesses.
American Board of Psychiatry and Neurology in Buffalo Grove, Isaac Ray Center in Chicago, Dr. Roma Franzia's practice in Winnetka.
Real businesses, real relationships.
“They deliver on a wide breadth of IT services and ensure everything works correctly. With the personal touch of a small team, LME communicates efficiently and is instantly responsive by email or phone.”
“I can’t say enough great things about LME Services. I’ve trusted them for years with my computer support needs. They are reliable, knowledgeable, and always willing to help.”
Common questions
No — there's no formal certification process run by HHS or any government body. Some third-party programs issue training certificates, but those don't guarantee full compliance on their own.
If any third-party vendor — a cloud provider, billing service, or software vendor — accesses, stores, or transmits your patients' protected health information, you need a signed BAA with them. We collect and manage these for you.
No — it's ongoing. Safeguards need updating as technology changes, staff need periodic retraining, and documentation needs to stay current. We treat it as continuous, not a box to check once.
We establish a breach notification process ahead of time — how to detect, investigate, and respond to a breach of protected health information — so you're not improvising under pressure.
Let's talk about your IT.
See how this fits into our full Compliance & Regulated Industry IT Guide, organized by industry: healthcare, legal, finance, non-profit, and manufacturing.
See the Full Guide