Accountable markets a "HIPAA certification," but HHS does not recognize private HIPAA certifications. This review checks Accountable's public HIPAA content against the regulation text and notes where wording departs from the rule. It also lists what Accountable gets right. Confirm vendor claims against 45 CFR Parts 160 and 164 and OCR guidance before relying on "certification" language.
Accountable HQ sells HIPAA compliance software from $169 a month billed annually. It publishes a very large library of articles, so this is not a review of every page. What was checked, all on September 29, 2026:
- Marketing pages: homepage, pricing, audit protection, seal, risk assessment, vendor management and vendor monitoring pages.
- Free HIPAA training page: its visible copy and its Course structured data.
- Blog articles: call center software, EMR software, patient authorization, breach notification, consent, disclosures without consent, and the cost of violations.
Each was measured against 45 CFR Parts 160 and 164, HHS FAQ #2003, and OCR's misleading marketing claims guidance. This review does not include named customer outcomes or vendor client case studies. Features and pricing are covered in a separate comparison.
Key terms used in this review:
- HIPAA (Health Insurance Portability and Accountability Act of 1996).
- Security Rule (the HIPAA regulation requiring confidentiality, integrity, and availability of electronic protected health information).
- ePHI (electronic protected health information).
- BAA (business associate agreement that provides satisfactory assurances in written contract).
Accountable HQ Review: What the Fact-Check Found
The review found nine discrepancies. Some are wording problems. Others could lead a practice to act on guidance that differs from the rule.
The nine findings at a glance (Accountable pages checked September 29, 2026):
| # | Accountable page | What it says | What the regulation says | Section |
|---|---|---|---|---|
| 1 | Homepage, pricing and audit protection pages | Sells a "HIPAA certification" | HHS does not recognize private HIPAA certifications | HHS FAQ #2003 |
| 2 | Free training page (course structured data) | "Health Insurance and Portability and Accountability Act" | Health Insurance Portability and Accountability Act, no "and" | Public Law 104-191 |
| 3 | Free training page (course structured data) | Security Rule protects confidentiality and availability | Confidentiality, integrity, and availability | 164.306(a)(1) |
| 4 | Audit protection page | Risk assessment in stage 4, policies in stage 2 | Policies take risk into account | 164.308(a)(1)(ii)(A), 164.316(a) |
| 5 | Patient authorization article | Psychotherapy notes "may require" a separate authorization | May only be combined with another psychotherapy notes authorization | 164.508(b)(3)(ii) |
| 6 | Breach notification article | Media notice at "500 or more" residents | Media notice at "more than 500" residents | 164.406(a) |
| 7 | Consent form and disclosure articles | Consent and authorization used loosely | Consent is optional; authorization is required for uses not otherwise permitted | 164.506, 164.508 |
| 8 | Cost of violations article | Penalty tiers with no dollar amounts | Amounts updated yearly and published at 45 CFR Part 102 | 160.404(a) |
| 9 | Vendor management page | Vendor compliance called a Security Rule requirement | Satisfactory assurances in a written contract (the BAA) | 164.308(b)(1) and (b)(3) |
1. HHS Does Not Certify HIPAA Compliance
Accountable sells certification by name. Its homepage title reads "Accountable | The most trusted HIPAA certification". Its audit protection page lists a stage called "Becoming a HIPAA CERTIFIED", and its pricing page offers to help buyers "get your own HIPAA Certification".
HHS does not recognize private HIPAA certifications and does not certify any person or product as "HIPAA compliant" (HHS FAQ #2003; OCR misleading marketing claims guidance). A business that believes it is "certified" may stop the ongoing review the rule calls for at 164.306(e). In fairness, Accountable's own seal page says its seal "is not issued by the government," and its call center article adds that "HIPAA itself does not certify vendors."
Its EMR software article also refers to "HIPAA encryption standards" four times. The regulation names no encryption standard. Encryption is an addressable specification at 164.312(a)(2)(iv) and (e)(2)(ii), and specific processes are named only in HHS guidance (74 FR 42740, August 24, 2009).
Next step: Treat any "HIPAA certified" badge as marketing. Keep your own evidence instead: a current risk analysis (45 CFR 164.308(a)(1)(ii)(A)), periodic evaluations (164.308(a)(8)), and security measures reviewed as needed (164.306(e)).
2. The Course Data Misnames the Law
The free training page's Course structured data, the machine-readable text search engines read, says "HIPAA Stands for the Health Insurance and Portability and Accountability Act of 1996". The law is the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, with no "and" after "Insurance". The visible page names it correctly, so this is likely a typo, but it is the first entry in the course data.
Next step: Check that any workforce training you assign names the law and its rules correctly. Privacy Rule training on your own policies is required for every workforce member (45 CFR 164.530(b)(1)).
3. Their Security Rule Course Summary Leaves Out Integrity
The same structured data says the Security Rule section covers ePHI safeguards "including maintaining its confidentiality and availability." Integrity is missing. Section 164.306(a)(1) requires covered entities and business associates to "Ensure the confidentiality, integrity, and availability of all electronic protected health information". The course videos were not reviewed, so this finding covers the written description only, the kind of outline an OCR audit could read.
Next step: Confirm your Security Rule training covers all three objectives: confidentiality, integrity, and availability (45 CFR 164.306(a)(1)), as part of the security awareness and training program (164.308(a)(5)(i)).
4. Where the Security Risk Assessment Sits in the Stage List
The audit protection page lists six stages. "Align policies and procedures" sits in stage 2, Onboarding. The Security Risk Assessment (SRA) sits in stage 4, "Full Scope Compliance".
The regulation sets no order of steps, but it ties policies to risk. Section 164.316(a) requires policies "taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv)", and 164.306(b)(2)(iv) is "The probability and criticality of potential risks to electronic protected health information." The page does not show how the product sequences the work, so this finding is about the published stage list.
The risk assessment software page also presents the SRA and a Data Protection Impact Assessment (DPIA) as "a structured approach to gap analysis". These are three different exercises. The SRA is the risk analysis at 164.308(a)(1)(ii)(A). A gap analysis compares practice with requirements. A DPIA comes from the EU's GDPR, not from HIPAA.
Next step: Finish the risk analysis before you finalize policies, so the policies reflect the risk factors in 45 CFR 164.306(b)(2) as 164.316(a) requires.
5. Compound Authorizations, Stated More Softly Than the Rule
Accountable's patient authorization article (dated January 24, 2024) says psychotherapy notes "may require a separate or more specific authorization." The rule is firmer. Section 164.508(b)(3)(ii) says a psychotherapy notes authorization "may only be combined with another authorization for a use or disclosure of psychotherapy notes." An authorization that breaks this rule is not valid under 164.508(b)(2)(iv).
Next step: Keep psychotherapy notes authorizations on their own form, combined only with other psychotherapy notes authorizations (45 CFR 164.508(b)(3)(ii)).
6. The Breach Notification Media Threshold
Accountable's breach notification article (dated April 27, 2024) gets the 60-day outer limit and the yearly log for smaller breaches right. Its media threshold reads "500 or more residents of a state or jurisdiction". Section 164.406(a) says "more than 500 residents of a State or jurisdiction". The difference is one resident and errs toward more notice, but it is not the text. "500 or more" is the threshold for notice to the Secretary under 164.408(b).
The 60 days is an outer limit, not a target: notice is due "without unreasonable delay" (164.404(b)). OCR's first enforcement action for late breach notification settled for $475,000 (January 9, 2017).
Next step: In your breach plan, set media notice at more than 500 residents of a State or jurisdiction (45 CFR 164.406(a)), and notice to HHS at the same time as individual notice for breaches of 500 or more people (164.408(b)).
7. "Consent" and "Authorization" Are Not the Same Thing
Accountable's HIPAA Compliance Consent Form article (dated January 16, 2025) separates the two terms in one section, then lists an expiration date, an authorization element, among the "Key Elements of a Valid Consent". When Can PHI Be Disclosed Without Consent? (dated August 15, 2025) says "Most sharing of medical information still requires patient authorization", though its next sentence lists treatment, payment and operations as exceptions.
- Consent (164.506) is optional. A covered entity "may obtain consent" for treatment, payment, or health care operations, which 164.506(c)(1) already permits.
- Authorization (164.508) is required for uses and disclosures the rule does not otherwise permit, such as psychotherapy notes and marketing, and must contain the elements in 164.508(c).
A consent cannot stand in for a required authorization (164.506(b)(2)).
Next step: Use an authorization with the required core elements (45 CFR 164.508(c)) for disclosures the Privacy Rule does not otherwise permit. Treatment, payment, and operations do not need one (164.506(c)(1)).
8. A Penalty Article Without the Penalty Numbers
Accountable's The Cost of HIPAA Violations (dated March 13, 2025) describes the four penalty tiers but gives no dollar amounts. A different Accountable article (dated March 10, 2026) lists the 2024 amounts, but a reader of the first article does not get them. The current amounts are in HIPAA fines and penalty amounts.
Next step: Look up the current penalty amounts in 45 CFR Part 102, which HHS adjusts every year (45 CFR 160.404(a)).
9. The Vendor Duty, Stated More Broadly Than the Rule
Accountable's vendor management page says ensuring vendors are HIPAA-compliant "is a requirement under the HIPAA Security Rule." The text asks for something narrower: "satisfactory assurances" that the business associate will safeguard ePHI (164.308(b)(1)), documented "through a written contract or other arrangement" (164.308(b)(3)). That document is the Business Associate Agreement. Its vendor monitoring page fairly presents continuous monitoring as a practice. The words appear nowhere in 45 CFR Parts 160 and 164.
Next step: Make sure every business associate has a signed BAA with the elements in 45 CFR 164.504(e) and 164.314(a). Treat continuous vendor monitoring as an optional practice.
Where Accountable Gets It Right
Several Accountable pages checked September 29, 2026 are solid:
- Seal FAQ: says the seal "is not issued by the government."
- Breach timing: the 60-day outer limit and yearly reporting for breaches under 500 (164.404(b), 164.408(c)).
- Record retention: separates the six-year documentation rule (164.530(j)) from medical record retention.
- Enforcement: covers the role of CMS alongside OCR.
- Group health plans: explains plan sponsor access to PHI under 164.504(f).
- De-identification: lists the 18 identifiers and both methods.
- Business associates: covers the clause that carries restrictions down to subcontractors.
- Authorization basics: identifies the core elements in 164.508(c).
What This Means for Your Organization
This does not mean every business using Accountable is out of compliance. It means your compliance cannot be better than the accuracy of the guidance you follow. Questions to ask any compliance tool or consultant, including Compliancy Group:
- Do they cite the actual regulation? "HIPAA requirements" without CFR citations is a red flag.
- Do they separate legal requirements from good practice?
- Do they say what HIPAA does not require?
- Are their training materials accurate?
Your Privacy Officer or counsel should be able to trace every policy and training element to a specific provision.
FAQ
Is the AccountableHQ "HIPAA certification" recognized by HHS?
No. HHS does not recognize private HIPAA "certifications" and does not certify any person or product as "HIPAA compliant" (HHS FAQ #2003). Accountable's own seal page says its seal "is not issued by the government."
Does AccountableHQ's training cover the full Security Rule?
Its written course description names confidentiality and availability but leaves out integrity, which 164.306(a)(1) lists with them. The course videos were not reviewed.
Does Accountable HQ state the HIPAA breach notification deadlines?
Yes, in its breach notification article: the 60-day outer limit and yearly reporting for breaches under 500. Its media threshold reads "500 or more residents"; 164.406(a) says "more than 500".
Does HIPAA require continuous vendor monitoring?
No. The words do not appear in 45 CFR Parts 160 and 164. The rule requires satisfactory assurances, documented in a written contract or other arrangement (164.308(b)(1) and (b)(3)).
How much does Accountable HQ cost?
Accountable's pricing page, checked September 29, 2026, lists Basic HIPAA at $169 a month billed annually or $199 billed monthly, with 15 employees included. Plus is $254 or $299, and Pro is $679 a month billed annually. One Guy Consulting's Full-Scope plan is $120 a month, $1,300 for 12 months, or $2,300 for 24 months, with no per-user fees.
One Guy Consulting is NOT representing any law firm and Chuck Weiselberg is NOT an Attorney. This article does not provide legal advice. It merely points out discrepancies between two sets of publicly available information. Please consult an Attorney for interpretations of the law.
Want help putting this in place? The Full-Scope plan from One Guy Consulting pairs the compliance software with 4 hours a month of 1:1 implementation calls with Chuck Weiselberg to get your plan set up. It is $120 a month, $1,300 for 12 months paid upfront, or $2,300 for 24 months, with no per-user fees. See how it works or book a free 30-minute intro call. No obligation, no pressure.
Who wrote this review
Chuck Weiselberg, HIPAA Compliance Consultant, is Founder of One Guy Consulting, a HIPAA compliance and cybersecurity SaaS for healthcare entities. He has consulted since 2015 and has guided 3,500+ organizations on HIPAA compliance. His focus: compliance reviews, vendor risk, and actionable remediation steps for practices and offices. He is a Certified HIPAA Professional (CHP) and is not an attorney. Contact: hello@oneguyconsulting.com or 646-694-8025.
Sources
- 45 CFR Part 160
- 45 CFR Part 164
- 45 CFR Part 102 (penalty inflation adjustments)
- 45 CFR 160.404, 164.304, 164.306, 164.308, 164.312, 164.314, 164.316, 164.402, 164.404, 164.406, 164.408, 164.504, 164.506, 164.508, 164.530
- HHS FAQ #2003
- HHS OCR: Be Aware of Misleading Marketing Claims
- HHS OCR: first late breach notification settlement (2017)
- Public Law 104-191
- 74 FR 42740 (August 24, 2009)
- Accountable pages, all fetched September 29, 2026: homepage; pricing page; audit protection page; HIPAA Seal of Compliance page; free HIPAA training page; Security Risk Assessment Software page; Healthcare Vendor Management System page; Third-Party Security Monitoring Software page; HIPAA-Compliant Call Center Software for Healthcare; Best HIPAA-Compliant EMR Software; HIPAA Patient Authorization Form; HIPAA Breach Notification Rule Explained; HIPAA Compliance Consent Form; When Can PHI Be Disclosed Without Consent; The Cost of HIPAA Violations; How Much Does a HIPAA Violation Cost in 2024; HIPAA Data Retention Requirements Explained; Who Enforces HIPAA Regulations; Employee Wellness Programs and HIPAA; The 18 PHI Identifiers; What is a HIPAA Business Associate Agreement
Related Reading
Try three One Guy Consulting 3D staff training courses free →