Guide · Privacy and security
What does HIPAA-aligned website engineering mean?
What does HIPAA-aligned website engineering mean?
HIPAA-aligned website engineering means designing a site and its workflows with privacy, security, access control, logging and human-oversight safeguards in mind, so a covered entity or business associate can meet its own obligations. It is not a certification: Oruanyi does not certify clients, become their covered entity or guarantee compliance. Final obligations depend on the client’s role and legal advice.
Last updated .
What it covers
- No protected health information on public forms: sensitive workflows are scoped separately.
- Role-based access, audit logging and clear approval boundaries in the system that is built.
- Human oversight on decisions that affect patients or members.
- A business associate agreement, where the client’s role requires one, before any sensitive workflow begins.
What it does not mean
- It is not a HIPAA certification. HHS does not endorse or recognize private “HIPAA certification” programs.
- Oruanyi does not become the client’s covered entity and does not guarantee the client’s compliance.
- Design language on a website is not legal advice; obligations depend on the organization’s role.
How Oruanyi scopes it
Discovery ($2,000 kickoff + $500/month keep-alive) records whether regulated data is involved and keeps it off public channels. Engine ($24,500–$48,000 one-time) builds HIPAA-aligned boundaries, audit logging, role-based access and CI/CD inside the client environment.
Sources
See every public price, read the FAQ, or run the free passive scan.