Compliance · HIPAA · PCI · GDPR
Compliance isn't a binder on a shelf. We assess your risks, write the policies, train your team and put the technical safeguards in place, then keep the documentation current so you're ready for an audit.
What we deliver
HIPAA in plain English
The HIPAA Security Rule holds a five-person practice to the same core standards as a hospital system, scaled to its size and resources. It calls for administrative, physical and technical safeguards to protect electronic patient information (ePHI). On the IT side, that means:
Risk analysis
A documented assessment of where patient data lives and what could expose it, kept up to date. It's required, and it's the gap regulators cite most often.
Unique logins
No shared accounts. Every staff member has their own login and a strong password, ideally with multi-factor sign-in.
Role-based access
People see only what their job needs. The front desk doesn't need full access to clinical notes.
Encryption
Patient data encrypted in transit (secure email and messaging) and at rest (laptops, tablets, workstations and phones).
Automatic logoff
Screens lock on their own when a computer is left unattended.
Security software
Firewalls, antivirus and security patches kept active and current on every device that touches patient data.
Backups and recovery
Encrypted backups stored offsite or in the cloud, so records can be restored after a hardware failure or ransomware attack.
Vendor agreements
Signed business associate agreements (BAAs) with vendors that handle patient data, including your IT provider.
A proposed update to the Security Rule would make encryption and multi-factor sign-in mandatory rather than "addressable." It hasn't been finalized and isn't expected before 2027. We set both up now, so you're covered either way.
For most practices, we guide you through the requirements and implement best practices directly in your systems. If you need written policies and formal compliance documentation, we provide them through our HIPAA compliance partner, quoted separately.
Who it's for
Questions
Is a HIPAA risk assessment really required?
Yes. HIPAA's Security Rule requires covered entities and business associates to perform a risk analysis and act on what it finds. It's also the first thing auditors ask for.
Will you sign a Business Associate Agreement?
Yes. When we handle systems that store or transmit patient information, we sign a BAA as part of our agreement.
How long does it take to get compliant?
It depends on where you're starting. Most small offices can have an assessment, core policies and key safeguards in place within a few weeks, then maintain them with annual reviews.
A free, no-pressure review of your biggest compliance gaps.
