21 min read

Accountable HQ's HIPAA Content, Fact-Checked Against the Regulation

Accountable HQ markets a "HIPAA certification", which HHS says it does not recognize. This review checks its HIPAA content against the regulation text.

HIPAA Compliance Consultant | Certified HIPAA Professional (CHP)

Accountable HQ sells HIPAA software from $169 a month billed annually and markets a "HIPAA certification", which HHS says it does not recognize. This review checks Accountable's public HIPAA content against the regulation text, and lists what it gets right.

If you are reviewing HIPAA compliance software, confirm the provider understands the rules it claims to support. This review compared statements on Accountable's public pages with the HIPAA regulation text in 45 CFR Parts 160 and 164. Accountable publishes a very large library of articles, so this is not a review of every page. Each finding below names the page it comes from and the date that page was checked: September 29, 2026.

The review found nine discrepancies worth a practice owner's attention. Some are wording problems. Others could lead a practice to make decisions on guidance that differs from the text of the rule.

This article is not a feature comparison. That lives on a separate page. This article is about accuracy: where Accountable explains the law correctly, where its wording departs from the text, and what the text actually says.

Accountable HQ Review: What the Fact-Check Found

Each finding gives the Accountable page, the date it was checked, and the section of the regulation it is measured against.

1. HHS Does Not Certify HIPAA Compliance

Accountable sells certification by name. Its homepage title, checked September 29, 2026, reads "Accountable | The most trusted HIPAA certification", and the same page tells buyers "you'll receive a HIPAA Certificate backed by Accountable". Its audit protection page (page title "Compliance Gameplan | Accountable") lists a stage called "Becoming a HIPAA CERTIFIED", with the line "Receive a HIPAA Certification Badge for internal and external assurance". Its pricing page closes with "We make it easy to get your own HIPAA Certification and build trust with your customers and patients."

The problem: HHS does not recognize private HIPAA certifications. It has said so in two places:

  • HHS FAQ #2003: "HHS does not endorse or otherwise recognize private organizations' 'certifications' regarding the Security Rule, and such certifications do not absolve covered entities of their legal obligations under the Security Rule."
  • OCR Misleading Marketing Claims guidance: HHS and OCR "do not certify any persons or products as 'HIPAA compliant.'"

In fairness, Accountable's own seal page makes a related point in its FAQ. Asked "Is this an official certification?", it answers: "No, the HIPAA Seal of Compliance is not issued by the government." That answer is accurate. The homepage title and the certification stage appear on the homepage and the audit protection page; the FAQ answer is on a separate seal page.

This matters because the word "certification" suggests a status someone official granted. For HIPAA, no such status exists. A business that believes it has been "certified" may stop the ongoing work the rules call for, because it thinks the work is done. One example is the maintenance standard at 164.306(e): a covered entity or business associate "must review and modify the security measures implemented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information".

Two related phrases appear on Accountable's blog, both checked September 29, 2026:

  • "HIPAA HITECH Certification" in the article HIPAA-Compliant Call Center Software for Healthcare (dated March 24, 2024 on the page), which presents it as what buyers look for: "Many buyers look for HIPAA HITECH Certification as shorthand for strong controls." The next sentence adds that "HIPAA itself does not certify vendors," so the article partly corrects itself. The phrase still pairs HIPAA with a kind of certification that HHS says it does not recognize (the HHS and OCR statements quoted above).
  • "HIPAA encryption standards", four times in the article Best HIPAA-Compliant EMR Software (dated March 24, 2024 on the page). The regulation text names no encryption algorithm or standard. Section 164.304 defines encryption as "the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key", and the Security Rule makes encryption an addressable implementation specification. Section 164.312(a)(2)(iv) reads "Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information." Section 164.312(e)(2)(ii) reads "Encryption (Addressable). Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate." The breach rule's definition at 164.402 points to guidance: unsecured PHI is protected health information "not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of Public Law 111-5." HHS published an updated version of that guidance in the Federal Register on August 24, 2009 (74 FR 42740), and it lists encryption processes that "have been tested by the National Institute of Standards and Technology (NIST) and judged to meet this standard". That guidance, not the regulation text, is where specific encryption processes are named.

When a compliance platform attaches HIPAA's name to a certification that HHS says it does not recognize, the buyer has to work out which parts come from the regulation and which do not.

2. The Course Data Misnames the Law

Accountable's free training page (accountablehq.com/free-hipaa-training, checked September 29, 2026) carries a Course description in its structured data, the machine-readable text that search engines read. The syllabus entry "What is HIPAA Compliance?" says: "HIPAA Stands for the Health Insurance and Portability and Accountability Act of 1996". That text did not appear in the page's visible copy as fetched; it sits in the page code. The page's visible copy names the law correctly: "the Health Insurance Portability and Accountability Act (HIPAA)".

The actual name is the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191. There is no "and" between "Insurance" and "Portability".

This is a small mistake, almost certainly a typo. It is still the first entry in the course's structured data, so it is worth correcting.

Practices use courses like this one for workforce training, so the course data should name the law the way the visible page already does.

3. Their Security Rule Course Summary Leaves Out Integrity

The same structured data describes the course's Security Rule section this way: "We will cover the Security Rule which laid out the safeguards for the protection of electronic Protected Health Information (ePHI) including maintaining its confidentiality and availability." Two of the three objectives are named. Integrity is missing.

Under 164.306(a)(1), covered entities and business associates must "Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits." The three objectives are listed side by side. The definitions section, 164.304, says integrity "means the property that data or information have not been altered or destroyed in an unauthorized manner."

A course description that names two of the three is an incomplete summary of the standard. The course videos were not reviewed for this article, so this finding is about the written description only. A written training outline is part of what could be read during an OCR audit or investigation.

4. Where the Security Risk Assessment Sits in the Stage List

Accountable's audit protection page (checked September 29, 2026) lays out its process in six stages: Sign Up, Onboarding, Compliance Implementation, Full Scope Compliance, "Becoming a HIPAA CERTIFIED", and Ongoing Monitoring & Support. The Security Risk Assessment (SRA) appears in the fourth stage, "Full Scope Compliance", as "Conduct Security Risk Assessment(s) using Accountable's guided tools". The second stage, Onboarding, already includes "Align policies and procedures".

The regulation text sets no order of steps. It does list the risk analysis first among the implementation specifications of its security management process standard. Section 164.308(a)(1)(ii)(A) reads: "Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate."

The rule also ties the choice of safeguards, and the policies, to risk. Section 164.306(b)(2) says "In deciding which security measures to use, a covered entity or business associate must take into account the following factors", and one of them, at 164.306(b)(2)(iv), is "The probability and criticality of potential risks to electronic protected health information." Section 164.316(a) applies the same factors to policies: a covered entity or business associate must "Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv)".

Read as written, the stage list puts "Align policies and procedures" two stages ahead of the risk assessment. Under 164.316(a), policies are to take the probability and criticality of potential risks into account. The page does not show how the product itself sequences the work, and "align" may mean less than writing the policies, so this finding is about the stage list as published.

Accountable's Security Risk Assessment Software page (checked September 29, 2026) also blends three different exercises into one sentence: "Accountable's Security Risk Assessment (SRA) and Data Protection Impact Assessment (DPIA) provide a structured approach to gap analysis".

  • Security Risk Assessment (the risk analysis the Security Rule calls for at 164.308(a)(1)(ii)(A))
  • Gap analysis (an operational exercise comparing current practice with regulatory requirements)
  • Data Protection Impact Assessment (a concept from the EU's GDPR, not from HIPAA; the same page pairs it with "HIPAA and GDPR requirements")

These serve different purposes and produce different outputs. Treating them as one can lead a business to believe it completed a valid SRA when it actually performed a different type of assessment.

5. Compound Authorizations, Stated More Softly Than the Rule

Accountable's article HIPAA Patient Authorization Form: Step-by-Step Guide and Compliance Checklist (dated January 24, 2024 on the page; checked September 29, 2026) covers the core elements of a valid authorization.

On psychotherapy notes, the article says they "may require a separate or more specific authorization." Its checklist adds the line "No prohibited compound authorization or unlawful conditioning of treatment or benefits" without saying which combinations are prohibited.

The rule is firmer than that. Section 164.508(b)(3)(ii) states: "An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes." Under 164.508(b)(2)(iv), an authorization is not valid if "The authorization violates paragraph (b)(3) or (4) of this section, if applicable". A practice that reads the article's wording as optional could put psychotherapy notes on the same form as other disclosures, which is the combination the text rules out.

6. The Breach Notification Media Threshold

Accountable's article HIPAA Breach Notification Rule Explained: Requirements, Timelines, and Reporting Obligations (dated April 27, 2024 on the page; checked September 29, 2026) gets most of the breach notification timeline right. It states the 60-day outer limit for notifying individuals and the yearly log-and-report duty for smaller breaches.

Where it departs from the text is the media threshold. The article says: "If a single breach involves 500 or more residents of a state or jurisdiction, you must provide Media Outlet Notification to prominent media in that area".

The rule at 164.406(a) reads: "For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, a covered entity shall, following the discovery of the breach as provided in § 164.404(a)(2), notify prominent media outlets serving the State or jurisdiction."

The text's threshold is "more than 500". The article's is "500 or more". The difference is one resident, and it errs toward more notice, not less. It is still not what the text says. The figure that does include 500 sits in a different provision: notice to the Secretary under 164.408(b), for breaches "involving 500 or more individuals".

The timing rule deserves one more reading. Under 164.404(b), a covered entity must provide the notice "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." The 60 days is an outer limit, not a target. OCR's first HIPAA enforcement action for lack of timely breach notification settled for $475,000 (January 9, 2017).

7. "Consent" and "Authorization" Are Not the Same Thing

Fact-check graphic: consent and authorization are legally distinct terms under HIPAA

Two Accountable articles checked September 29, 2026 use "consent" and "authorization" loosely in places. HIPAA Compliance Consent Form (dated January 16, 2025 on the page) has a section headed "Distinguishing Consent vs. Authorization" that separates the two: "they serve distinct functions under HIPAA regulations". Elsewhere, though, its "Key Elements of a Valid Consent" list gives elements that belong to an authorization, including an expiration date or event, and it says a sample consent form "typically outlines the duration of the authorization". When Can PHI Be Disclosed Without Consent? (dated August 15, 2025 on the page) says "Most sharing of medical information still requires patient authorization", although its next sentence lists "treatment, payment, operations" among the scenarios where PHI may be used or disclosed without consent. Under HIPAA, consent and authorization are legally distinct concepts with different rules.

  • Consent (164.506) is optional. Section 164.506(b)(1) reads: "A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations."
  • Authorization (164.508) is the permission the Privacy Rule requires for uses and disclosures it does not otherwise permit or require. Section 164.508(a)(1) states: "Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section." The rule names psychotherapy notes (164.508(a)(2)) and marketing (164.508(a)(3)) among the cases that need one.

An authorization has required elements under 164.508(c): a description of the information, the persons authorized to make and to receive the disclosure, the purpose, an expiration date or event, a signature and date, and required statements about revocation, conditioning, and redisclosure. A consent under 164.506 carries no such list.

The two cannot be swapped. Section 164.506(b)(2) says consent "shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required". For the second article, the problem is the summary line's "Most sharing", and its own next sentence already points the right way. Most treatment, payment, and health care operations uses and disclosures need no authorization. Section 164.506(a) permits them "Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) through (4)", and 164.506(c)(1) reads "A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations."

8. A Penalty Article Without the Penalty Numbers

Accountable's article The Cost of HIPAA Violations, Explained with Real-World Scenarios (dated March 13, 2025 on the page; checked September 29, 2026) describes the four-tier penalty structure, with "smaller per-violation fines and lower annual caps" at the low end, but gives no dollar amounts. The amounts are public. Section 160.404(a) says they "will be updated annually and published at 45 CFR part 102."

In fairness, a different Accountable article, How Much Does a HIPAA Violation Cost in 2024? Fines and Penalties Explained (dated March 10, 2026 on the page), does list the 2024 per-violation amounts. A reader who lands on the first article does not get them. A practice weighing its compliance risk needs the actual exposure, not only that penalties "scale with culpability". The current amounts are covered in HIPAA fines and penalty amounts.

9. The Vendor Duty, Stated More Broadly Than the Rule

Accountable's Healthcare Vendor Management System page (checked September 29, 2026) says that ensuring vendors are HIPAA-compliant "reduces your liability, protects patient data, and is a requirement under the HIPAA Security Rule." The Security Rule's text asks for something narrower: satisfactory assurances, documented in a written contract or other arrangement.

Section 164.308(b)(1) reads: "A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information." Section 164.308(b)(3) adds that those assurances are documented "through a written contract or other arrangement with the business associate". That document is the Business Associate Agreement.

Accountable's Third-Party Security Monitoring Software page (checked September 29, 2026) sells continuous monitoring of vendors, and it presents that as a practice rather than a rule: "Continuous monitoring of these partners helps organizations maintain control and compliance." That is fair. The words continuous monitoring appear nowhere in 45 CFR Parts 160 and 164. Continuous vendor monitoring may be a sound operational practice. The regulation text does not make it a mandate.

Where Accountable Gets It Right

Accountable HQ HIPAA fact-check graphic marking where Accountable's content gets the regulation right

Accuracy matters in both directions. Several Accountable pages checked September 29, 2026 are solid:

  • Its own seal FAQ. The seal page answers "Is this an official certification?" with "No, the HIPAA Seal of Compliance is not issued by the government."
  • Breach notification timing. HIPAA Breach Notification Rule Explained states the 60-day outer limit for notifying individuals and the yearly reporting duty for breaches affecting fewer than 500 people, which is what 164.404(b) and 164.408(c) set out.
  • Record retention. HIPAA Data Retention Requirements Explained (dated June 13, 2025 on the page) separates the six-year rule for HIPAA documentation from medical record retention, saying "HIPAA does not dictate how long you must keep clinical or billing records." Section 164.530(j)(2) applies to "the documentation required by paragraph (j)(1) of this section".
  • Enforcement. Who Enforces HIPAA Regulations? (dated February 4, 2025 on the page) includes a section on the role of the Centers for Medicare & Medicaid Services (CMS) alongside the Office for Civil Rights.
  • Group health plans. Employee Wellness Programs and HIPAA: What Health Data Employers Can Access (dated December 14, 2024 on the page) explains that individual PHI reaches an employer acting as plan sponsor only for plan administration under certified plan documents or with a valid authorization, the subject of 164.504(f).
  • De-identification. The 18 PHI Identifiers lists the identifiers and describes both de-identification methods, Safe Harbor and Expert Determination.
  • Business associate duties. Its guide What is a HIPAA Business Associate Agreement? All About BAAs covers the clause that carries the same restrictions down to subcontractors.
  • Authorization form basics. The authorization checklist article identifies the core elements required under 164.508(c), even though it is soft on compound authorizations.

Credit where it is due. Accountable has built a substantial content library, and much of it reflects genuine familiarity with the law.

What This Means for Your Organization

Accountable HQ HIPAA fact-check graphic on what the review findings mean for your organization

A platform that sells a "HIPAA certification", uses consent and authorization loosely in places, and leaves integrity out of its course's Security Rule summary gives its customers reasons to check its work.

This does not mean every business using Accountable is out of compliance. It means that your compliance cannot be better than the accuracy of the guidance you follow. A stage list that aligns policies before the risk assessment invites policy work that does not yet rest on the risk picture. If a platform's wording runs consent and authorization together in places, a practice's forms may not do what the rule asks of them.

Here is what to look for in any compliance tool or consultant:

  1. Do they cite the actual regulation? Vague references to "HIPAA requirements" without CFR citations are a red flag.
  2. Do they separate what HIPAA requires from what is only good practice? Good practice and legal mandate are different things.
  3. Do they acknowledge what HIPAA does not require? Overstating the law is a disservice to practices trying to right-size their compliance program.
  4. Do they keep their training materials accurate? If the basics are wrong, the advanced material deserves a closer look.

The same questions apply to any platform, including Compliancy Group. Your Privacy Officer, compliance committee, or legal counsel should be able to trace every policy, procedure, and training element back to a specific regulatory provision. If they cannot, the program has gaps, no matter which platform generated it.

FAQ

Is the AccountableHQ "HIPAA certification" recognized by HHS?

No. HHS says it "does not endorse or otherwise recognize private organizations' 'certifications' regarding the Security Rule," and OCR says HHS and OCR "do not certify any persons or products as 'HIPAA compliant.'" Accountable's own seal page, checked September 29, 2026, says its seal "is not issued by the government." A vendor that describes its product or its customers as "HIPAA certified" is using a term with no regulatory meaning.

Does AccountableHQ's training cover the full Security Rule?

The written course description on accountablehq.com/free-hipaa-training, held in the page's structured data as checked September 29, 2026, describes the Security Rule as maintaining the "confidentiality and availability" of ePHI. It leaves out integrity. The regulation at 164.306(a)(1) lists confidentiality, integrity, and availability together. The course videos were not reviewed, so this finding covers the written description only.

Does Accountable HQ state the HIPAA breach notification deadlines?

In the breach notification article checked September 29, 2026, yes. It states the 60-day outer limit for notifying individuals and the yearly reporting duty for breaches affecting fewer than 500 people. Its media notice threshold reads "500 or more residents". The regulation at 164.406(a) says "more than 500 residents of a State or jurisdiction".

Does HIPAA require continuous vendor monitoring?

The words continuous monitoring appear nowhere in 45 CFR Parts 160 and 164. Under 164.308(b)(1), a covered entity must obtain "satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information", documented in a written contract or other arrangement. Continuous monitoring may be a useful operational practice, but the regulation text does not make it a mandate.

How much does Accountable HQ cost?

Accountable's pricing page, checked September 29, 2026, lists Basic HIPAA at $169 a month billed annually ($2,028 a year) or $199 billed monthly, with 15 employees included and extra seats at $9 a month each. Plus is $254 a month billed annually or $299 billed monthly, and Pro is $679 a month billed annually, with 20 employees included. One Guy Consulting's Full-Scope plan is $120 a month, $1,300 for 12 months, or $2,300 for 24 months, with no per-user fees.

Accountable HQ's public pages sell a "HIPAA certification" of a kind HHS says it does not recognize. Several of its pages word consent, compound authorizations and the media notice threshold differently from the regulation text, and its stage list aligns policies before the risk assessment. Other pages get the law right, and they are credited above. Any compliance tool you evaluate should be held to the standard of the text it claims to implement.

One Guy Consulting is NOT representing any law firm and Chuck Weiselberg is NOT an Attorney. This article does not provide legal advice. It merely points out discrepancies between two sets of publicly available information. Please consult an Attorney for interpretations of the law.

Want help putting this in place? The Full-Scope plan from One Guy Consulting pairs the compliance software with 4 hours a month of 1:1 implementation calls with Chuck Weiselberg, C.H.P., to get your plan set up. It is $120 a month, $1,300 for 12 months paid upfront, or $2,300 for 24 months, with no per-user fees. See how it works or book a free HIPAA compliance review. No obligation, no pressure.

Sources

Related Reading

Related Reading
More from the blog

More archive content for healthcare teams working through HIPAA operations, policy, and risk.

All Articles
OGC-BotHi! What can I help you with?