Compliance / HIPAA
Protect patient data and meet the HIPAA Security Rule.
Healthcare organizations are a leading target for ransomware, and an attack can take clinical systems offline as well as expose patient records. The HIPAA Security Rule requires covered entities and their business associates to protect electronic protected health information (ePHI) and to understand the risks to it.
We help hospitals, clinics, health tech companies and their vendors run a proper risk analysis, fix what it finds and document the program in a way that holds up if the Office for Civil Rights comes asking.
At a glance
- Regulator
- HHS Office for Civil Rights (OCR)
- Applies to
- Covered entities and business associates that handle ePHI
- Core requirement
- An accurate and thorough risk analysis, followed by risk management
- Safeguards
- Administrative, physical and technical
- Texas
- The Texas Medical Records Privacy Act adds state requirements
HIPAA
Risk analysis is where most programs fall short
When OCR investigates a breach, one of the first documents it asks for is the risk analysis. A missing, outdated or superficial risk analysis is one of the most common problems cited in OCR enforcement actions.
Texas adds its own layer. The Texas Medical Records Privacy Act, often called HB 300, applies to a wider group of organizations than HIPAA and has its own training and disclosure rules. We help you account for both.
How we help
Security Rule risk analysis
The document regulators ask for first.
- Inventory of systems that create, receive, store or transmit ePHI
- Threat and vulnerability identification
- Likelihood and impact ratings
- Documentation aligned with HHS guidance
- Risk management plan
Safeguard implementation
Put the administrative, physical and technical controls in place.
- Access controls and MFA
- Audit logging and review
- Encryption at rest and in transit
- Backup, disaster recovery and emergency mode operations
- Device and media controls
- Workforce security training
Business associates
Security for vendors and the vendors you rely on.
- Business associate inventory
- Vendor security reviews
- Support with business associate agreement reviews
- Security programs for health tech companies selling to providers
Ransomware readiness
Keep patient care going if systems go down.
- Backup isolation and recovery testing
- Clinical downtime procedures
- Tabletop exercises with clinical and IT leadership
- Incident response and breach notification planning
Legal questions go to counsel
We handle the security side of HIPAA compliance. Questions about breach notification obligations, business associate agreements and the Privacy Rule belong with your legal counsel, and we work closely with counsel during incidents.
Services that support this work
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
- Managed Detection & ResponseSecurity monitoring, detection engineering and threat hunting focused on real threats rather than alert volume.
- Incident Response & Digital ForensicsContain active incidents, find out what happened and recover with evidence you can stand behind.
- Identity & Data SecurityProtect identities, privileged access and the sensitive data they can reach.
FAQ
Frequently asked questions
How often should we update our HIPAA risk analysis?
The Security Rule does not set a fixed schedule, but it expects the risk analysis to stay current. In practice that means reviewing it at least once a year and whenever something significant changes, such as a new EHR, a move to the cloud or an acquisition.
Is there an official HIPAA certification?
No. HHS does not certify organizations as HIPAA compliant. Some vendors sell certificates, but they carry no regulatory weight. What matters is a documented risk analysis, a working security program and evidence that you follow it.
Does HIPAA apply to our health tech startup?
If you create, receive, maintain or transmit protected health information on behalf of a covered entity, you are likely a business associate and the Security Rule applies to you directly. Your customers will usually ask you to sign a business associate agreement.
Find out where you stand on HIPAA.
A readiness review shows what an assessor would find today and what it will take to close the gaps.