Become HIPAA compliant,
and stay that way
If your organization touches protected health information, HIPAA isn't optional - and the penalties for getting it wrong are real. We guide covered entities and business associates through the whole thing: audit, policies, training, and the ongoing upkeep that keeps you compliant after the paperwork is done.
What HIPAA actually requires
HIPAA is the federal law that governs how protected health information (PHI) is handled, stored, and shared. If your organization creates, receives, or maintains PHI, the law expects you to protect it - and to prove you're doing so.
Compliance comes down to three things the law requires:
- A risk analysis and audit measuring your organization against the regulation
- Policies and procedures governing how your team handles PHI
- Training so your people know their responsibilities
HIPAA splits the organizations it governs into two groups:
Covered entities
healthcare providers, health plans, and clearinghouses that handle PHI directly.
Business associates
any organization that handles PHI on behalf of a covered entity. Answering services, SaaS vendors, billing companies, IT providers - if you touch PHI for a client, you're a business associate, and the law applies to you too.
Two rules do most of the work:
The Privacy Rule
sets the standards for how PHI can be used and disclosed - who's allowed to see it, and under what circumstances.
The Security Rule
covers electronic PHI specifically - the safeguards you need in place to keep it secure.
Both are on the hook. And a covered entity is responsible for making sure its business associates are compliant, which is why a signed business associate agreement (BAA) matters so much.
Who needs to comply
If your team handles protected health information in any form, HIPAA applies.
- Healthcare providers and practices handling patient data directly
- SaaS and health-tech vendors building on or storing PHI
- Answering services and call centers taking calls that include patient information
- At law firms that are building on or storing PHI for their cases
Not sure which bucket you're in? That's one of the first things we sort out together.
One approach, shaped around your team
Every program we run stands on the same three legs, plus the support that keeps it standing.
01
Audit and analysis
We measure your organization against the regulation and find the gaps that matter.
02
Policies and procedures
We build the documentation that governs how your team handles data.
03
Training and education
We train your people so the program holds up day to day - and under audit.
What you get
Every HIPAA engagement is shaped around your team, so no two look exactly alike. A typical program includes:
HIPAA audit and remediation report
where you stand and what to fix
Policies and procedures framework
built for your organization
Training licenses
for your whole team, including role-based versions
Monthly check-ins
So you're never guessing what's next, we provide clear guidance and updates to keep you informed.
A dedicated project coordinator
one point of contact who knows your account
Ongoing support
through renewals, updates, and new requirements
HIPAA is federal law. Treat it like one.
HIPAA carries real fines and real enforcement - the Office for Civil Rights investigates violations, and settlements run into the millions. A dashboard full of green checkmarks won't help you when an investigator asks whether the control behind one actually works.
We're a firm, not a platform. Real people audit your controls, fix what's broken, and stand behind the report.
- A human verifies your controls - not an algorithm assuming they exist
- Evidence that holds up - defensible under real OCR scrutiny
- The same team at renewal - we don't hand you a certificate and vanish
Healthcare teams trust us with this
Benjamin Pure
VP Client Solutions, Patient Connect
“Before VanRein, audits were a constant source of stress. Since putting their recommendations in place and building out our Book of Evidence, onboarding new clients is simple — we just submit and move forward. VanRein lets my team focus on delivering excellent service instead of worrying about HIPAA compliance.”
Lori Horton
President, A Professional Image
“We are so thankful to have partnered up with VanRein. Anyone needing help with HIPAA compliance should connect with them. I only wished we would have found them before our first audit.”
Jill L.
CEO, eLivelihood
“The team at VanRein is fantastic. They have been our compliance partner for 2 years and we've been very impressed. They've been on top of our compliance and ongoing training, extremely responsive to any questions we've had, and made our experience a positive one.”
Kim H.
Carolyn's Communication
“There is no shortage of excellence from VanRein Compliance, Rob and Dawn Van Buskirk, when it comes to their clientele. We relied heavily on them to ensure compliance across our company.”
Nathan C.
Northsite Data
“My business partner and I came to Rob needing help to become HIPAA compliant. Rob and his team are absolute professionals. They know how to audit, identify areas that need improvement, and set up processes to get us further down the path each year.”
Michelle Mata
“A huge thank you to VanRein for making HIPAA compliance smooth and stress-free! Their professionalism and guidance have been outstanding every step of the way. Truly the best partner we could ask for! Rob is the best for helping us get everything in order and keep us up to date on HIPAA compliance.”
Andrew Charles
AMBS Call Center
“The Ambs Call Center team loves working with VanRein Compliance for our HIPAA compliance certification!”
Aidan Brooks
“Working with VanRein Compliance has been instrumental in helping us move forward with confidence. Their support gave us the structure and clarity we needed to take meaningful steps toward protecting patient information.”
Brianna Burke
Nationwide Inbound
“We've had an exceptional experience partnering with VanRein Compliance for our data security and HIPAA compliance needs at Nationwide Inbound. Their proactive approach, tailored solutions, and unwavering support have provided us with invaluable peace of mind. Rob, Dawn and team's expertise and dedication shine through in every interaction, making them an indispensable asset to our organization. We wholeheartedly recommend VanRein Compliance to any business in need of a top-tier partner to help navigate the ever-evolving arena of data security regulations. Thank you, VanRein Compliance, for your outstanding service and commitment to our data security!”
Julia Szwed
“The entire team at VanRein Compliance is exceptional. They are well organized, professional and have superb customer service. During our annual reviews they help us to ensure that we are running our business with safeguards in place to protect us and our clients. I would give VanRein 10 stars for their work as the value is immeasurable. Grateful!”
Shari Brown
“We have worked with Rob and Dawn at VanRein Compliance for several years. We have a medical practice and they have been invaluable to us in navigating the requirements of our profession! They are quick to respond to any questions or concerns and make it simple to understand and implement processes and procedures to keep us compliant with regulations. Well worth it to partner with this company!”
Prisca Gloor
“We are very impressed with VanRein Compliance. They are very knowledgable, they explain the process so it is understandable, they are there for us at any step, and the people are really nice. Out of the companies we checked to go through this process, VanRein Compliance was the best and they have exceeded our expectations. We are so happy we went with them and we highly recommend them.”
Trusted By
HIPAA questions we hear a lot
See more QuestionsWho has to comply with HIPAA?
Any covered entity (healthcare providers, health plans, clearinghouses) and any business associate handling PHI on their behalf. If your team touches protected health information, the law almost certainly applies to you.
How much does HIPAA compliance cost?
It depends on your size, your systems, and how much you need - a standalone audit is different from a full program. We scope it to your organization rather than quoting a one-size number, and we'll give you a clear picture early in the conversation.
How long does it take?
That varies too, based on where you're starting and how quickly your team can move on remediation. We map out the timeline up front so there are no surprises.
What are the penalties for non-compliance?
HIPAA violations carry federal fines, and serious breaches can climb into the millions - on top of the client trust and contracts you stand to lose. The OCR enforces it.
Is training required?
Yes. HIPAA training is a legal requirement, not a nice-to-have - which is why it's built into every program we run.
What is a business associate agreement (BAA)?
It's the contract that spells out how a business associate will protect the PHI it handles for a covered entity. If you work with vendors who touch PHI - or you are one - you need BAAs in place.
Let's talk about where you stand
Whether you're starting from scratch or shoring up a program you already have, the first step is a straight conversation about your organization and your risk.