Question 1

What is actually in scope: Security Rule, Privacy Rule, or both?

Accepted Answer

Both apply to Covered Entities. Business Associates are directly liable for the Security Rule and the parts of the Privacy Rule incorporated into their BAA. The Breach Notification Rule applies to both and triggers the 60-day OCR clock. Our build-out covers all three. Most Business Associates underestimate Privacy Rule exposure because their BAA pulls in obligations beyond the Security Rule baseline.

Question 2

Who needs a HIPAA program: Covered Entities, Business Associates, or both?

Accepted Answer

Covered Entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically. Business Associates are anyone who creates, receives, maintains, or transmits PHI on behalf of a Covered Entity. HealthTech SaaS, billing companies, EHR vendors, AI clinical decision support, and marketing agencies handling PHI all qualify as BAs. If you sign a BAA, you have direct OCR liability, not derivative.

Question 3

How long does a HIPAA build-out take and what does it cost?

Accepted Answer

Initial build-out runs 8 to 14 weeks for a typical mid-market organization. Fee range is $40K to $120K depending on org size, system complexity, and BAA inventory size. Annual SRA refresh runs $15K to $35K. Ongoing program ownership (access reviews, BAA management, training tracking, audit log oversight) is delivered on a monthly retainer.

Question 4

What does the OCR actually look at during an audit or investigation?

Accepted Answer

First request is almost always your Security Risk Assessment, your Risk Management Plan, and your written policies. They want to see PHI flows mapped to systems mapped to controls. Then workforce training records (per-employee completion), audit log review evidence, BAA inventory, and breach response procedures. A generic template SRA without your specific systems, vendors, and PHI workflows named is the fastest way to escalate an investigation.

Question 5

How does HIPAA differ from HITRUST or SOC 2 for healthcare?

Accepted Answer

HIPAA is law. SOC 2 and HITRUST are voluntary attestations that map controls onto HIPAA requirements. SOC 2 is widely accepted by enterprise customers. HITRUST CSF is the gold-standard healthcare audit and is increasingly required by hospital systems and large payers. Many HealthTech companies need both: HIPAA as the legal floor, plus SOC 2 or HITRUST as the commercial signal.

Question 6

What is the difference between a real BAA program and a stack of signed BAAs?

Accepted Answer

A signed BAA is one artifact. A real BAA program is the inventory of every vendor touching PHI, the BAA negotiation history, vendor risk reviews on inbound questionnaires, renewal tracking, and the offboarding process when a vendor relationship ends. We routinely find active BAA rosters that miss 30 to 40 percent of the actual vendor list because vendors were acquired, swapped legal entities, or quietly changed terms.

HIPAA Compliance Services

HIPAA done by people who have actually faced an OCR audit

Who we work with

What we deliver

Where most HIPAA programs actually fail

Engagement structures

Related

A confidential, structured engagement.

Confidential Consultation

Scoped Engagement

Investigation and Findings

Same firm. Same legal entity. Same Quinn.
Also available through varcoe.ai for B2B buyers.

Witness (you are here)

Varcoe (B2B sister brand)

Quinnlan Varcoe

Frequently asked about HIPAA compliance

Schedule a confidential consultation