In brief
How long HIPAA compliance takes: there is no HIPAA certification; the time goes into risk analysis, policies, safeguards and training, weeks to months.
How long does HIPAA compliance take? It depends on what you already have, because there is no HIPAA certification and no finish date. The time goes into a risk analysis, adopted policies, implemented safeguards and workforce training, usually a few weeks to a few months from a standing start. After that, the same obligations recur.
What does HIPAA compliance actually mean?
HIPAA is a US federal law; its rules sit in 45 CFR Parts 160 and 164 (the Privacy, Security and Breach Notification Rules). No body issues a "HIPAA certification". Compliance means you have implemented the required safeguards for electronic protected health information (ePHI), documented them, and can show them when a customer asks or when the HHS Office for Civil Rights (OCR) investigates.
A software company that handles PHI for a US healthcare customer is usually a business associate. Business associates are directly subject to the Security Rule (45 CFR 164.302) and must report breaches to the covered entity (45 CFR 164.410).
What are the phases of a HIPAA program, and how long does each take?
The order follows the Security Rule: you need a risk analysis before you know which safeguards to prioritize. The ranges below are reference estimates for a 20–100 person cloud-hosted healthtech company starting from almost nothing. They are not a promise.
| Phase | What happens | Basis | Reference estimate |
|---|---|---|---|
| Determine your role (covered entity or business associate), name a Security Official, set scope | 164.308(a)(2) | 1–2 weeks |
| Inventory where ePHI lives, assess threats, likelihood and impact | 164.308(a)(1)(ii)(A) | 2–4 weeks |
| Security policy, incident response, contingency plan, sanctions, BAA management | 164.308, 164.316 | 3–6 weeks |
| Access control, unique user IDs, audit logs, encryption, automatic logoff, transmission security | 164.312 | 2–6 weeks, in parallel with phase 3 |
| Train the workforce, keep completion records, schedule periodic evaluation | 164.308(a)(5), 164.308(a)(8) | 1–2 weeks, then recurring |
If MFA, central logging and encryption are already in place, most of the time goes into the risk analysis and policies. If they are not, implementation becomes the bottleneck, and no tool removes it.
How long did it take in a real case?
One published pTrackly customer, a healthtech company, reached HIPAA audit readiness in 2 weeks and then went through a 4-week independent audit. That is one case, not a promise: scope, starting infrastructure and the team's focus all change the number. The full write-up is in how a healthtech company reached HIPAA readiness in 2 weeks.
Where do teams lose time?
The slow parts are rarely the writing itself; they are the tasks that need several people.
- Nobody knows where ePHI lives. The risk analysis needs a list of databases, storage buckets, SaaS tools, backups and staging environments that hold ePHI. Most startups do not have one, and building it means tracing data flows across teams.
- Policies written while learning HIPAA. The engineer drafting the first incident response plan is also finding out what HIPAA expects it to contain.
- Business associate agreements. Every vendor that creates, receives, maintains or transmits PHI for you needs a BAA, and the list (hosting, email, support tools, monitoring) is longer than most teams expect.
- No one tracking ownership. Each task competes with product work. Without a list of owners and due dates, weeks pass unnoticed.
How HIPAA work fits into engineering sprints is covered in HIPAA tracking in DevOps sprints, and running HIPAA next to other frameworks in HIPAA and ISO 27001 together.
What recurs after initial readiness?
HIPAA is ongoing. The main recurring obligations:
- Re-evaluate the risk analysis and safeguards periodically and whenever your environment changes (a new system, a new vendor, a new data flow), per 45 CFR 164.308. Many organizations choose an annual cycle.
- Train the workforce on security awareness, and update training when policies change.
- Keep documentation for at least 6 years (164.316(b)(2)).
- Notify breaches on time: a covered entity notifies affected individuals without unreasonable delay and no later than 60 days after discovery (45 CFR 164.404); a business associate notifies the covered entity within the same 60-day limit. A BAA can set a shorter contractual deadline.
Civil penalties are tiered by culpability and adjusted for inflation each year (45 CFR 160.404).
What does pTrackly do, and what does it not do?
pTrackly includes a HIPAA framework with controls, policy templates and evidence tasks mapped to the rule, a Compliance Matrix, and a place to record the justification and alternative measure for each addressable specification you did not implement as written. The risk register scores each risk before and after controls. In Vendors you mark a vendor as a HIPAA business associate and track its BAA status (no BAA, draft, signed, expired). A built-in security awareness course records completions as evidence, and the privacy incident log runs the 60-day clock for the Breach Notification Rule.
pTrackly does not find your ePHI for you, sign BAAs on your behalf or issue a HIPAA certification, because no such certification exists. Your team still implements the safeguards and approves the risk analysis. More at pTrackly for HIPAA.
Frequently asked questions
Is there a HIPAA certification?
No. HHS does not certify HIPAA compliance and does not endorse any third-party certification. Some companies commission an independent assessment so they have a report to share with customers, but that is not a certification under the law.
How long does HIPAA compliance take for a startup starting from zero?
Usually a few weeks to a few months, depending on whether MFA, logging and encryption already exist and whether someone clearly owns the program. One pTrackly customer reached audit readiness in 2 weeks, then had a 4-week independent audit; that is one case, not a promise.
Is hosting on AWS, GCP or Azure enough for HIPAA?
No. The cloud provider signs a BAA for eligible services and is responsible for its part of the infrastructure; configuration, access control, logging and application-level encryption remain your responsibility.
Does a business associate need a Privacy Officer?
A privacy official is a Privacy Rule requirement for covered entities (164.530(a)). A business associate must name a Security Official under the Security Rule (164.308(a)(2)); many companies give the same person both roles.
