HIPAA
US law governing how protected health information must be safeguarded by healthcare organizations and their vendors.
The Security Rule is the part that drives IT work. It requires administrative, physical, and technical safeguards, and it is deliberately non-prescriptive, describing outcomes rather than products so it stays relevant as technology changes.
That flexibility is why nothing can be HIPAA certified. Vendors can support compliance, and a risk analysis plus documented safeguards is what demonstrates it, not a badge.
Where this comes up
HIPAA sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.