Covered entities & business associates
Everything you need to reach and hold HIPAA compliance — automation software, expert implementation, and independent assessments. One vendor, published pricing, no certificate theatre.
18 standards 54 implementation specifications 3 safeguard categories 1 vendor for software, services & assessments
Start here
HHS runs no certification programme — so the strongest position you can hold is a compliance program backed by evidence: a current, asset-based risk analysis, implemented safeguards with documented rationales, workforce records tied to policy versions, and a signed BAA for every vendor touching ePHI.
That is exactly what SuperHIPAA builds with you — and what regulators, enterprise customers, and cyber-insurance underwriters actually accept. Get there in weeks, keep it current automatically, and hand over an independent assessment report whenever anyone asks you to prove it.
Everything you need
Continuous HIPAA automation: risk register, policies, training, BAAs, evidence, and an audit trail that does not depend on anyone remembering to take a screenshot.
Our own healthcare compliance team does the work — gap assessment, risk analysis, remediation, and the Privacy and Security Officer role if you need it filled.
Independent third-party reports you can hand to an enterprise customer, a cyber-insurance underwriter, or an investigator — with a date on them.
Why teams switch
| SuperHIPAA | HIPAA-only platforms | |
|---|---|---|
| Compliance automation | Yes | Yes |
| Gap assessment & risk analysis in-house | Yes | Referred out |
| Independent third-party report | Yes | No |
| Virtual HIPAA Officer | Yes | Rarely |
| Add SOC 2 / ISO 27001 later | Same control set | New vendor |
| Published pricing | Yes | Varies |
| Price lock | 3 years | Annual renegotiation |
Industries
Free, ungated after one email
Every standard and implementation specification, marked required or addressable, with the evidence each one expects. Twelve pages. Use it to audit yourself before someone else does.
Also free: risk assessment workbook, BAA template, 28 policy templates, cost calculator.
Guides
The largest safeguard category and the source of most findings — nine standards and what each demands operationally.
Read →A working checklist organised by rule and safeguard category, with the required-versus-addressable distinction made explicit.
Read →How HIPAA interacts with California's CMIA, the CCPA/CPRA medical-data carve-outs, and state breach notification rules — in plain terms.
Read →How the NY SHIELD Act's reasonable safeguards and breach notification rules interact with HIPAA, and what New York organisations must add.
Read →How the Florida Information Protection Act layers a 30-day breach clock and per-record penalties on top of HIPAA, and what to build into your plan.
Read →How Texas HB 300 and the Texas Medical Records Privacy Act extend HIPAA — broader covered entities, faster records access, mandatory training.
Read →FAQ
SuperHIPAA is HIPAA compliance software with expert services and independent assessments in one place, for US covered entities and the business associates that serve them. It is a LowerPlane product.
Starter is $399 a month and Growth is $899 a month, both billed annually. Enterprise starts at $2,400 a month. Every plan has a 14-day trial and a 3-year contractual price lock, with no per-integration fees, storage overage or export fee.
No one can. HHS operates no HIPAA certification programme. SuperHIPAA issues independent assessment and readiness reports that show where your program stands against each required and addressable specification.
Yes. SuperHIPAA signs a BAA with every customer, and you can read it on the Trust Center before talking to sales.
Yes. Fixed-fee services include a gap assessment from $4,500, a risk analysis from $6,500, implementation from $18,000, an annual review from $4,000 and a Virtual HIPAA Officer from $2,500 a month.
Yes. On the Growth plan and above, SOC 2 and ISO 27001 can be added on the same control set, so HIPAA evidence is reused.
24 questions. Scored report. No call required, and no “a specialist will reach out.”
