Nobody is HIPAA certified, because HIPAA has no certification. Here are the safeguards, contracts and workforce controls that exist instead, and the evidence to ask for.
Start with the thing most vendor conversations get wrong. There is no such thing as HIPAA certification. The Privacy, Security and Breach Notification Rules place obligations on covered entities and business associates. They do not establish a certifying body, an accreditation scheme or a badge. Any vendor telling you they are HIPAA certified is either describing a third-party assessment against a framework of somebody else’s choosing, or repeating a marketing line they have not examined. Either way you have learned something useful about them before the diligence starts.
What exists instead is specific: a set of safeguards, a contractual chain, workforce controls, and evidence that each of those is operating. That is what to build, and it is what to ask for.
Where Reliable Group stands, stated plainly
Reliable Group does not hold SOC 2, ISO 27001 or CMMC certification, and HIPAA has no certification regime. What we provide instead is reviewable security architecture and data-handling documentation for your IT, security and compliance teams. Control design for a specific regulated workload is scoped per engagement with your compliance team, and the resulting control set is written into the engagement documentation rather than agreed verbally. We would rather say that here than let a page about compliance imply a posture we do not hold.
The contract comes first
A business associate agreement is not a formality to clear after the commercial terms. It is the instrument that makes the obligations enforceable down the chain, and the terms that matter are the ones people skip.
Who is the business associate, exactly. If work is performed by an Indian entity, name that entity. A BAA with a US parent while the processing happens in a subsidiary that is not party to it leaves a gap precisely where the data is.
Subcontractor flow-down. Every subcontractor that touches protected health information needs an equivalent agreement, and you want the right to know who they are. Cloud infrastructure, a transcription tool, an offshore staffing partner and a document-scanning vendor are all in scope if PHI reaches them.
Breach notification timing. The regulation sets outer limits; a contract can and should be tighter. Specify the window in hours from discovery, define discovery, and say who is notified and how. A notification clause that says "promptly" is a clause you will argue about at the worst possible moment.
Return or destruction at termination. What happens to PHI when the engagement ends, on what timeline, with what certification, and what the exception is where return or destruction is genuinely infeasible. Write the exception down now rather than discovering it at exit.
Minimum necessary, in the contract. The agreement should limit access to the minimum necessary for the specific function, and that limit should be reflected in the actual permission model rather than only in the paperwork.
The safeguards, and what evidence each one produces
The useful discipline is to ask, for each safeguard, what artefact proves it is running. A safeguard nobody can evidence is a policy document.
Access control. Unique user identification, role-based access to the minimum necessary, and automatic session termination. Evidence: the access matrix by role, and the last quarterly access review with its findings and remediations. Ask to see the review, not the policy that says reviews happen.
Audit controls. Logging of access to and activity on systems holding PHI, retained for the applicable period. Evidence: a sample log record showing what is captured, plus the answer to who reviews the logs and how anomalies are escalated. Logs nobody reads are storage.
Encryption. In transit and at rest, with the standards named. Evidence: the configuration standard, and confirmation of where the keys live and who can reach them. Encryption where the operator holds the keys and the vendor holds the data is a different control from the reverse.
Integrity controls. Protection against improper alteration or destruction, and the ability to detect it. Evidence: how modification is logged and how a change is attributed to a specific identity.
Workforce training. Role-appropriate training at hire and periodically after. Evidence: completion records by named individual with dates, not an aggregate percentage. Aggregate completion rates hide exactly the people you would want to ask about.
Sanction policy. A documented consequence for workforce members who violate procedures, and evidence it has been applied when warranted. A sanction policy that has never been used in a large operation is worth a question.
Incident response. A written procedure, tested. Evidence: the procedure, the date of the last test, and what the test found. An untested incident procedure is a document, and the first real incident is not the moment to discover which.
Contingency planning. Backup, disaster recovery and the ability to operate in emergency mode. Evidence: the last restore test and its result.
Facility and device controls. Physical access to the workspace, and controls on the endpoints PHI can reach. Evidence: the access model for the floor, and the device policy including what happens to a lost laptop. We do not publish specific facility security detail, and neither should a vendor, but the model should be reviewable under NDA.
What operating from India changes
It changes implementation detail, not obligations. The obligations attach to the business associate relationship regardless of geography. Four things do need deliberate design.
Where the data physically resides, and whether it needs to move at all. The strongest posture is usually that PHI stays in your environment and the India team works inside it under your identity provider, rather than data being copied to a partner environment. That single decision removes a large category of questions.
Whose identity provider issues access. Access granted by your IT team and revocable by your IT team, without a support request to a vendor, is a materially different control from access administered by the partner.
The India entity’s own obligations. Indian data protection requirements apply alongside, not instead of, the US obligations. Your counsel needs to look at both, and the answer is jurisdiction and sector specific.
Endpoint posture in a shared workspace. Screen visibility, printing, removable media and personal device use all need explicit answers when the work happens on an operations floor.
The questions to ask, in order
Ask whether they claim to be HIPAA certified, and listen to the answer. Ask which legal entity signs the BAA and whether it is the one doing the processing. Ask for the subcontractor list. Ask for the access matrix and the last access review. Ask for the last incident-response test and what it found. Ask where the data sits and who issues access. Ask what happens to the data at termination.
Seven questions. A vendor who can answer all seven with artefacts is in a different category from one who answers with assurances, and none of it depends on a certificate that does not exist.