HIPAA Compliance

We start with the security risk analysis, because it's both the legal foundation and the only reliable way to set priorities. It establishes where patient data lives, which is rarely only where people think. Our guide on how to perform a healthcare security risk assessment explains the steps.

Next, the safeguards go in where they won't slow anyone down. Controls that add steps to a patient encounter get worked around, and a control people work around protects nobody.

Then we keep the record. HIPAA has no certificate, so your evidence is documentation of the analysis and of the decisions behind your safeguards. That record is what an investigator asks for, so it's the thing worth maintaining.

We do this work for medical practices and other healthcare organizations as part of our compliance services. If a customer or insurer is asking broader security questions, a security risk assessment covers those as well.