How we verify every fact
Every factual claim on this site links to its source and shows when it was last checked. This page explains exactly how we get there.
Methodology at a glance
hipaa.systems treats each claim as a separate, sourced and dated fact. Legal statements are checked against the text of 45 CFR, vendor statements against the vendor's own BAA, trust center or documentation, and secondary sources are used only when primary sources are unavailable. Facts older than 90 days are flagged on the page, and no vendor pays us for listings or rankings.
| Unit of research | One fact: a claim, its source URL and the date it was checked |
|---|---|
| Law | 45 CFR Parts 160 and 164, then HHS / OCR guidance |
| Vendors | Their own BAA, legal terms, trust center and documentation |
| Re-check | Flagged after 90 days; vendor pages monitored for changes |
| Commissions | None — no vendor pays us |
Source hierarchy
We use the highest source available and say which one we used:
- The regulation — 45 CFR Parts 160 and 164 (eCFR).
- HHS and OCR guidance — FAQs, guidance documents, enforcement actions.
- The vendor's BAA and legal terms.
- The vendor's trust center or compliance page.
- The vendor's technical and support documentation.
- Secondary sources — only when a primary source can't be read, and never as the sole basis for a legal statement.
Vendor verification protocol
For every product, we record each of these as a separate fact with its own source and date:
- whether the vendor signs a BAA — yes, no, or only under conditions;
- how you get it — included in standard terms, accepted in settings, or requested from sales;
- which plans and which services the BAA covers, and which are excluded;
- what you still have to configure for safe use;
- how the product does against our criteria for its category (encryption, MFA, audit logs and others).
When a value can't be confirmed from a source, we show Not verified rather than guess. We never label a product "HIPAA compliant" — no product is compliant on its own.
Dates and re-checks
Each fact shows when it was last checked. Facts not re-checked for 90 days are flagged on the page. We monitor vendors' BAA, trust-center and pricing pages for changes, and a person confirms every change before it is published. Changes that alter our data are logged in Updates.
Same criteria for everyone, and no commissions
No vendor pays us for listings, rankings or referrals. Every product is evaluated on the same criteria and listed alphabetically. Products we sell ourselves are judged the same way and always labeled — see how we make money.
How we use AI
We use AI tools to help research, draft and check pages. AI never decides a fact: every claim is tied to a source, legal statements are checked against the regulation text, and a person reviews each page before it is published.
Review
Explanatory pages are reviewed by a named, qualified reviewer. Until that review is complete, a page says "Expert review pending" next to its sources. Nothing on this site is legal advice.