I currently work for an IT security company that is looking to expand our services offered to clients. Two avenues we are looking at is reviewing FISMA and HIPAA compliance for our clients. I have been tasked with looking at getting our auditors "HIPAA/FISMA" certified. My main question is towards HIPAA right now but if someone can speak up for FISMA as well, that would be great.

What is HIPAA certified? Is there an actually reputable company that offers a certification track that means something? All the research I have reviewed suggests that there is no actual badge that I can wear saying "I am now certified to review clients for HIPAA compliance". It just seems that many companies offer their own flavor of HIPAA certification tracks(one I looked out seem to have a tier structure even), but are they reputable? I don't see companies like SANS or Comptia offering something like this, so if there is a reputable company, I would like to know that too.

End goal/bottom line: Company wants to be able to be able to put down that we have individuals certified to review HIPAA (and FISMA) compliance on a client's network. Looks better for us on request for proposals which means better chances of winning contracts. Thank you.

  • There is, to the best of my knowledge, no such certification; there are companies that will train you to do the evaluation, but HIPAA and FISMA are US government artifacts, and the US government isn't (yet) in the business of issuing certification. if you want to do this, your company will need to differentiate itself from the thousands of other companies that perform the function.
    – MCW
    Dec 14 '15 at 18:49
  • Thanks Mark. That is actually what I'm finding out right now. There are many of companies willing to train your professionals, but it's trying to find out which ones have good training and which ones are just going to rob you. Thanks for the quick reply. I'm going to leave this open for a little bit longer to see if anyone can recommend a company for training....
    – POSH Geek
    Dec 14 '15 at 18:52
  • Mark, do you have experience with HIPAA audits? I'm trying to find out how often they have to occur if an organization processes HIPAA documentation.
    – POSH Geek
    Dec 14 '15 at 22:14

Browse other questions tagged or ask your own question.