Healthcare Security

Who it’s for

Covered entities and business associates under HIPAA: healthcare providers, health plans, clearinghouses, and any organization that creates, receives, maintains, or transmits electronic protected health information (ePHI). Ideal for practices and community-based organizations that need a documented risk analysis to satisfy the HIPAA Security Rule and demonstrate due diligence to auditors and partners.

Pain points we address

• Uncertainty about whether current safeguards adequately protect ePHI
• Pressure from payers, partners, or OCR to produce a formal risk assessment
• Limited in-house expertise to perform and document a HIPAA-compliant risk analysis
• Need to prioritize remediation efforts without a clear roadmap

Scope

Assessment of administrative, physical, and technical safeguards relevant to ePHI, aligned with the HIPAA Security Rule. We review policies and procedures, asset and data flows, access controls, audit logging, encryption, workforce security, and contingency planning. Engagement can be scoped to full environment or specific systems/workflows (e.g., EMR, billing, telehealth) depending on your needs.

Exclusions

We do not perform penetration testing, vulnerability scanning of external infrastructure, or legal advice. We do not act as your HIPAA Privacy Officer or provide ongoing compliance monitoring unless engaged under a separate advisory or vCISO arrangement. Scope will be confirmed in the statement of work.

Deliverables

• Written Security Risk Assessment report documenting findings, risk levels, and mapping to HIPAA Security Rule requirements
• Prioritized remediation roadmap with actionable recommendations and suggested timelines
• Executive summary suitable for leadership and board reporting
• Optional: supporting asset/data inventory and gap summary for policy and procedure updates