What “HIPAA-Aligned” Means — and Why We Don't Say “HIPAA Certified”

There is no official HIPAA certification. Here's what honest vendors claim instead, what to ask any software provider, and how Almare builds for regulated care data.

Here's something most software vendors won't lead with: the U.S. government does not certify anyone as “HIPAA compliant.” No agency issues that badge. Every seal you've seen on a website is self-declared or bought from a third party with no official standing. So when a vendor's homepage says “HIPAA certified,” you've learned something — just not what they intended.

What HIPAA actually asks of software

HIPAA regulates covered entities and their business associates, not products. Software supports compliance when it provides the safeguards the Security Rule expects — access controls, encryption, audit logging, integrity protections — and when the vendor will sign a Business Associate Agreement (BAA) before handling protected health information.

What “HIPAA-aligned” means at Almare

• Encryption in transit and at rest, with documents behind short-lived signed links rather than public URLs.
• Role-based access enforced in the database itself — not just hidden menu items.
• Append-only audit trails on sensitive actions: who, what, when, from where.
• Hard tenant isolation: each organization's data is walled off at the database layer.
• A staged approach to PHI: charting and clinical records ship only behind the full BAA and safeguards they require.

Questions to ask any vendor (including us)

• Will you sign a BAA before we put any PHI in the system?
• Is access control enforced in the database, or only in the app's interface?
• Can you show me the audit trail for a specific record?
• What happens to our data — and your subprocessors' copies — when we leave?

A vendor who answers those four plainly is worth talking to. A vendor who answers with a badge is telling you the marketing department got there before the engineers. We'd rather earn the harder version of your trust: the one that survives an auditor's follow-up question.