HIPAA Compliance
HIPAA as a security program, not a training video.
Risk analysis, safeguards, documentation and business associate management for covered entities and the vendors that serve them.
What it is
The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information with administrative, physical and technical safeguards, starting with a documented enterprise risk analysis. The Privacy Rule governs how PHI is used and disclosed. OCR enforcement almost always begins with one question: show us your risk analysis.
Who needs it
- Medical, dental and specialty practices
- Labs, imaging centers, surgery centers and behavioral health providers
- Billing, transcription, IT and software vendors that handle PHI as business associates
- Employers administering self-funded health plans
What we do
- Enterprise risk analysis and risk management plan
- Technical safeguards: access control, encryption, audit logging, backup and recovery
- Administrative safeguards: policies, workforce training, sanctions, contingency planning
- Business associate agreement inventory and review
- Breach response plan and tabletop exercise
- Annual reassessment and evidence refresh
The same four steps, every framework.
Scoped gap assessment
Inventory, data-flow mapping and a scored findings list with a cost to close.
Remediation plan
Every gap gets an owner, a fix and a date on the plan of action.
Implementation and evidence
Our engineers close the gaps; evidence is captured control by control.
Mock audit, then the real one
We run it the way the assessor will, then sit beside you for the real thing.
Frequently asked questions
Is a HIPAA risk analysis required?
Yes. The Security Rule requires a documented, enterprise-wide risk analysis, and it is the first thing OCR requests in an investigation. It must be updated when your environment changes.
We are a vendor, not a healthcare provider. Does HIPAA apply?
If you create, receive, maintain or transmit protected health information on behalf of a covered entity, you are a business associate and directly liable under the Security Rule.
Does HIPAA require encryption?
Encryption is an addressable specification, which means you must implement it or document why an equivalent measure is reasonable. In practice, unencrypted PHI on a lost laptop is a reportable breach; encrypted PHI is not.
How often is HIPAA training required?
Training is required for new workforce members and whenever policies change; annual refresher training is the accepted standard and what auditors expect to see documented.
Do you serve practices outside Orange County?
Yes. HIPAA programs are delivered nationwide; on-site visits are scheduled where physical safeguards need to be reviewed.
Find out where you stand on HIPAA.
A scoped gap assessment gives you a compliance score, a findings list and a cost to close — before you commit to anything.