HIPAA Assessment
A HIPAA Security Rule + Privacy Rule + Breach Notification Rule assessment, tuned to your role — Covered Entity, Business Associate, or Subcontractor.
- Outcome
- HIPAA readiness without the checkbox theater.
- Timeline
- 3 phases1 week · 3–4 weeks · 1–2 weeks
- Mapped to
- HIPAAHITECH · NIST · HITRUST CSF
- Includes
- Readout + retestFixed criticals and highs re-verified.
Know before you book.
A check of how you protect US patient health information against the HIPAA Security Rule, with a clear fix list.
- You create, store or process US patients' health information
- You're a Business Associate and a Covered Entity asked for proof
- You haven't done a documented HIPAA risk analysis this year
- You're adding new systems or vendors that touch patient data
- You need an internationally recognised certificateISO/IEC 27001 Readiness
- You want your patient-facing app attacked for realWeb Application Pen Testing
- Where patient data lives and flows
- Business Associate Agreements and key vendors
- Current policies, training and access-review records
Still not sure? Take the 2-minute check
What you walk away with.
- A Risk Analysis built to meet Security Rule expectations (§ 164.308(a)(1)(ii)(A))
- Gap analysis across Administrative, Physical, and Technical Safeguards
- Breach-preparedness playbook + notification templates
- An OCR-defensible documentation package
What we cover
Agreed in writing before testing starts.
- Security Rule — all Administrative, Physical, Technical safeguards
- Privacy Rule — Notice of Privacy Practices, minimum necessary, patient rights
- Breach Notification Rule — response readiness, documentation, templates
- Business Associate Agreements — audit + template review
- Enterprise Risk Analysis meeting § 164.308(a)(1)(ii)(A)
- HITECH + OCR guidance interpretation (2013 Omnibus + recent updates)
- State-level privacy laws (available as add-on: TX HB300, CA CMIA)
- GDPR / DPDP — see our Compliance Audits offering
How we run it.
- 01
Role scoping
Covered Entity, Business Associate, or Subcontractor? Different rules apply — we map your role to your regulatory obligations.
- 02
Safeguards review
Every implementation specification (required + addressable) across Administrative, Physical, and Technical safeguards.
- 03
Risk Analysis
Enterprise-wide, per § 164.308(a)(1)(ii)(A), to NIST SP 800-66 rev2 method. Built to be defensible on its face — this is where most orgs fail an OCR audit.
- 04
BAA + vendor review
Business Associate Agreement templates + downstream vendor mapping.
- 05
Report + playbook
Findings + remediation + breach-response playbook + OCR-audit-ready documentation package.
Technical detail.
The depth behind the engagement, for the engineer or CISO evaluating us.
- Administrative, physical and technical safeguards
- Required and addressable specifications
- Risk analysis per 45 CFR 164.308
- NIST SP 800-66 Rev. 2
- HHS risk-analysis expectations
- Breach-notification readiness
- Access control, audit logs and encryption
- Device, media and backup handling
- Vendor and BAA coverage
- Documented risk analysis
- Safeguard gap report
- Incident and breach playbook
What lands in your inbox.
- HIPAA Security Rule Gap Analysis
- Enterprise Risk Analysis (meeting § 164.308(a)(1)(ii)(A))
- Breach Response Playbook + Notification Templates
- BAA Review + Template Library
- OCR-Audit Documentation Package
Defensible under audit.
- HIPAA
- HITECH
- NIST
- HITRUST CSF
From call to report.
- 01Scoping + role review
1 week
- 02Safeguards + risk analysis
3–4 weeks
- 03Reporting + playbook
1–2 weeks
Asked before every engagement.
Are you a HIPAA-certified auditor?
There is no OCR-issued HIPAA-auditor certification; anyone claiming one is bending the truth. What matters is the evidence: every assessment is built to the documentation standard OCR looks for in an audit request.
Can this help a Business Associate demonstrate compliance?
Yes — the documentation package is designed to be shared upstream with Covered Entities as evidence of BA compliance.
Do you review our BAAs?
Yes, both incoming and outgoing. We flag terms that expose you and terms that expose your counterparties.
Ship HIPAA-defensible operations.
Scoping call, engagement letter within a week, complete assessment within 6–8 weeks of kickoff.