The HIPAA Act of 1996 is a federal mandate that requires specific security and privacy protections for Protected Health Information (PHI). HIPAA was expanded in 2009 to include Health Information Technology for Economic and Clinical Health Act (HITECH) to promote the adoption and meaningful use of health information technology in the U.S. In 2013, the final HIPAA Omnibus Rule set further statutory requirements, which greatly enhanced a patient’s privacy rights and protections, including holding all custodians of PHI — including HIPAA Business Associates (BA) — subject to the same security and privacy rules as covered entities under HIPAA.

While there are no specific industry certifications for HIPAA compliance, SSAE16 SOC 1 TYPE II audits include a HIPAA Matrix attesting that companies’ administrative actions, policies and procedures properly conform to HIPAA regulations. Yearly audits are performed and evaluated by an independent, third-party auditor who issues an evaluation report that details the controls Webair has in place to meet HIPAA requirements in regards to data privacy and security.

The Sarbanes-Oxley Act of 2002 was created to protect investors from accounting fraud, specifically that which is related to shares sold by publicly traded corporations. The Sarbanes-Oxley Act is a deliberate effort to mandate strict reforms regarding how corporations make financial declarations. This law mandates increased vigilance with regards to disclosures related to the financial state of the company, particularly when it comes to earnings and profitability.

Publicly traded corporations are those that sell shares of stock to private and institutional investors. The investors and potential shareholders agree to the listed price of the company's shares based on the company's overall value, which includes future earnings and current performance. Thus, there is significant motivation for companies to fraudulently manipulate data in order to indicate that it is more beneficial to invest in their company rather than that of their competitors.

The State on Auditing Standards No. 70 (SAS 70) Type II certificates were awarded to data centers that adhere to the industry’s strictest criteria.

A SAS 70 security audit is a detailed report by a certified public accountant (CPA) or a licensed public accounting firm. Either the CPA or the firm must perform the audit according to specific industry standards regarding the planning, execution, and supervision of the audit.

These SAS certifications guidelines were established by the AICPA and firms are required to undergo peer reviews to ensure that the audit’s integrity remains intact. Non-CPA professionals that are relevant to the business industry may be used to perform the report but the final report requires the review and signature of a licensed CPA.