Straight talk on HIPAA — and a Business Associate Agreement ready when you need one.

Compliance is a legal obligation your organization carries — not something a vendor can sell you a certificate for. Here's what we actually provide, and what to ask any IT vendor handling PHI.

"HIPAA certified" isn't a real credential. Here's what is.

No government body or private credentialing organization issues an official "HIPAA certification" to vendors. HIPAA compliance is a legal responsibility your organization holds — third-party providers support it through signed agreements and documented safeguards, not a badge.

Not a Real Thing

"HIPAA Certified" Marketing Claims

Phrases like "HIPAA certified software" or "certified HIPAA compliant" usually mean a vendor completed a self-assessment — not that any government agency reviewed and approved them.

What We Actually Offer

A Signed BAA & Documented Safeguards

A Business Associate Agreement on request, plus specific, documented controls for access, encryption, logging, and physical security — the things that actually support your compliance.

What we put in place as your Business Associate

When we provide managed IT, hardware, network infrastructure, or security systems to a healthcare client, we operate as a Business Associate under HIPAA — with obligations that follow, whether or not a BAA has been signed yet. Here's what that covers.

Audit Logging Access to systems and data is logged and retained; unusual access attempts (failed logins, after-hours activity) are detectable.
Access Controls Role-based access, automatic logoff after inactivity, multi-factor authentication for remote access, and immediate removal of access for departed staff.
Encryption Data at rest and in transit encrypted; removable media and retired hard drives encrypted or securely destroyed and documented.
Physical Security Restricted access to server and network rooms, visitor logging, CCTV coverage of data center areas, and secure disposal of retired hardware.
Incident Response Prompt notification to you of any security incident, with a documented investigation — your organization retains responsibility for notifying HHS and affected individuals.
Risk Assessment Ongoing risk assessment and remediation as systems, threats, and your environment evolve.

Why on-premise infrastructure helps

Much of our work keeps your systems on hardware you own, on-site — which changes the compliance conversation in your favor.

Aspect	On-Premise, ArcAngel-Managed	Cloud-Only Vendor
Physical Control	You own the hardware and facility; we manage it locally	Vendor controls the data center; you rely on their security
Data Location	Stays on-site — no cloud transmission	Travels to vendor infrastructure
Audit Access	You can inspect systems in person	Limited to the vendor's own audit reports
Vendor Lock-In	Lower risk — you can migrate providers	Higher effort to export and migrate data
Control Customization	Configured for your specific requirements	Generally one-size-fits-all policy

Ask for the BAA before you ask anything else.

A BAA is required by law for any vendor handling PHI on your behalf — regardless of how much you trust them. We keep a BAA ready to sign, and we'd rather you ask for it up front than discover the gap later.

→ "Do you have a BAA template ready?" — Yes.
→ "What auditing and logging do you maintain?"
→ "What's your incident notification process?"
→ "How is data encrypted at rest and in transit?"
→ "Can we audit your systems?"
→ "What happens to our data if we end the contract?"

Request Our BAA

Our Part

Supporting Your Compliance

We implement and document the technical, physical, and administrative safeguards for the systems we manage, sign a BAA, and notify you promptly of any incident.

Your Part

Your Legal Obligation

HIPAA compliance is your organization's legal responsibility. You determine what PHI can be discussed where, train your staff, and notify HHS and affected individuals if required. We can advise, but we can't carry that obligation for you.

This page is intended for general information about how ArcAngel Technical Services supports HIPAA-covered clients and does not constitute legal advice. HIPAA compliance is a legal obligation specific to your organization — consult qualified legal counsel to confirm what applies to your circumstances. For more, see our FAQ.