HIPAA compliance assessments for the health-tech teams that touch PHI.

HIPAA is the Health Insurance Portability and Accountability Act, and for a technology company the part that bites is the set of rules governing protected health information. Three rules do most of the work. The Privacy Rule governs how you may use and disclose PHI in any form. The Security Rule governs how you protect electronic PHI, usually written ePHI. The Breach Notification Rule tells you exactly what to do, and how fast, when protected data is exposed.

The Security Rule organizes its requirements into three families of safeguards. Administrative safeguards cover the policies, training, workforce clearance, and risk management that steer your program. Physical safeguards cover facility access, device controls, and how you handle and dispose of hardware that stores ePHI. Technical safeguards cover access control, audit logging, integrity protection, and encryption of data in transit and at rest. You have to address every required specification and make a documented, defensible decision on each addressable one.

At the center of the Security Rule sits one non-negotiable task: the Security Risk Analysis. It is the accurate, thorough assessment of the risks to the confidentiality, integrity, and availability of the ePHI you hold. Regulators treat a missing or shallow risk analysis as the single most common HIPAA failure, and it is the first document an investigator asks for after an incident. Everything else in your program should trace back to it.

HIPAA divides the world into two roles. A covered entity is a health plan, a healthcare clearinghouse, or a healthcare provider that transmits health information electronically — hospitals, clinics, insurers. A business associate is any company that creates, receives, maintains, or transmits PHI on behalf of a covered entity. If you run a SaaS platform, an analytics tool, a scheduling system, or a hosting service that touches patient data for a healthcare customer, you are almost certainly a business associate.

That distinction matters because since the HITECH Act, business associates are directly liable under the Security Rule and much of the Privacy Rule. You cannot hide behind your customer’s compliance program. You must run your own Security Risk Analysis, implement your own safeguards, and answer to regulators for your own gaps. HITECH also strengthened the Breach Notification Rule and raised the penalties, which is why enterprise health customers now insist on evidence before they connect you to real PHI.

The trigger is usually commercial. A hospital system or a digital-health buyer sends a vendor security review, and a signed Business Associate Agreement plus proof of your safeguards becomes a condition of the contract. The honest advice: start before the questionnaire arrives. A Security Risk Analysis and the remediation it surfaces take time, and a deal stalled on missing HIPAA evidence is an expensive way to learn that.

You receive a documented Security Risk Analysis, a safeguards assessment covering the administrative, physical, and technical requirements, a ranked risk management plan, and a HIPAA compliance attestation from a licensed CPA firm. Read together, they answer the question every healthcare customer is really asking: can we hand you patient data without inheriting your risk. That package is what a privacy officer wants to see attached to your Business Associate Agreement.

Timing depends on where you start and how much PHI you touch. A focused assessment for a single product with reasonably mature controls often runs a few weeks from kickoff to report. If the Security Risk Analysis surfaces meaningful gaps, the remediation you choose to do sets the pace, not our fieldwork. Because HIPAA compliance is an ongoing duty rather than a one-time event, most clients repeat the assessment annually or after any significant change to how their systems handle ePHI.

Many firms will sell you a HIPAA gap review. Fewer bring a licensed CPA who reads both your control environment and the business behind it. That matters when your platform handles patient billing, claims, or funds, because an assessor who understands the numbers and the safeguards spots risks a checklist vendor walks past. We assess against the actual language of the Security and Privacy Rules, not a watered-down template, and we tell you plainly where you stand.

You also get senior attention that stays on your file as the engagement grows, fixed scope you can budget around, and a delivery model that keeps work moving across time zones. Because so many HIPAA safeguards overlap with other frameworks, we map your controls once so the same evidence supports a SOC 2 report or ISO 27001 certification later. You assess once and reuse the work, instead of paying to rebuild nearly identical evidence for every buyer who asks.