The Security Rule asks for a documented risk analysis, safeguards that match it, and evidence that they run. I build all three, sized to your organization.
HIPAA applies to more organizations than most expect, and the first serious request usually comes from a customer rather than a regulator.
If you create, receive, maintain, or transmit protected health information for a covered entity, you are a business associate. The Security Rule applies to you directly, and your customer will ask you to prove it.
A security risk analysis is required, and inadequate risk analysis is among the most commonly cited failures in HHS Office for Civil Rights enforcement actions.
A lost laptop, a phishing compromise, or a ransomware event raises questions about breach notification, and about whether the safeguards you had were the ones your risk analysis called for.
Built from the risk analysis outward, so every safeguard can be traced to a reason.
Systems, vendors, devices, and data flows that create, receive, store, or transmit electronic protected health information.
Threats, vulnerabilities, likelihood, and impact for each system, documented the way the Security Rule and HHS guidance expect.
What you will do about each significant risk, who owns it, and when. Addressable specifications aren’t optional: each one needs an implemented safeguard or a documented reason for an alternative.
Administrative, physical, and technical safeguards, with policies and procedures written for your actual operations.
BAAs with your vendors, workforce training, and a breach response process that meets notification timelines.
Fixed fees, agreed in writing before work starts.
$6,500 fixed
Know exactly where you stand against one framework, with a 90-day plan.
100% of the assessment fee is credited toward an implementation signed within 30 days.
Start with an assessmentFrom $2,000 / month
Someone accountable for running the program after it is built.
Implementation: once the assessment defines the scope, building the safeguards, policies, and evidence is quoted as a fixed fee, never hourly.
Straight answers to what clients usually ask first. Anything else, bring it to the call.
No. HHS does not certify or endorse HIPAA compliance, and private “certifications” are not recognized by HHS. What holds up is a documented risk analysis, safeguards that match it, and evidence that they operate.
If you handle protected health information on behalf of a covered entity, you are a business associate and the Security Rule applies to you directly, along with the terms of your business associate agreements.
Whenever your environment changes in a way that affects risk, such as new systems, vendors, or locations, and on a regular review cycle. Many organizations review it at least annually.
No. I handle the security program. Questions about privacy obligations, breach notification decisions, or contract terms should go to your healthcare counsel.
Thirty minutes, no pitch. Pick a time below, bring your deadline and whatever you’ve got so far, and we’ll scope it honestly.
Loading available times… If nothing appears, open the calendar in a new tab.
Prefer email? jason@ineedaciso.com