Protect ePHI with controls that exist outside the binder.
A policy can describe a compliant process while the ePHI environment tells a different story. We evaluate the administrative, physical, and technical safeguards against the systems, people, vendors, locations, and workflows that actually create, receive, maintain, or transmit ePHI.
HIPAA security lives where ePHI is actually handled.
“We have the policy” is not the same as “the safeguard operates across the ePHI environment.”
Three safeguard families. One operating environment.
Risk, governance, workforce, response.
Security risk analysis, risk management, assigned responsibility, workforce security, access management, awareness, incident procedures, contingency planning, evaluation, business associate arrangements.
Facilities, workstations, devices.
Facility access, workstation use and security, device and media controls, physical handling of systems containing ePHI.
Access, audit, integrity, transmission.
Access control, audit controls, integrity, authentication, transmission security, and the technical environment supporting those safeguards.
The assessment should change what the organization does next.
- 01
Map the ePHI environment.
Understand systems, workflows, vendors, users, locations, and dependencies before evaluating safeguards.
- 02
Identify threats and vulnerabilities.
Focus on credible conditions that can affect confidentiality, integrity, or availability of ePHI.
- 03
Evaluate safeguard operation.
Test whether administrative, physical, and technical safeguards work in practice and can be evidenced.
- 04
Prioritize risk treatment.
Turn findings into owned remediation, acceptance, or further investigation with a practical sequence.
What buyers usually need clarified.
Is there a HIPAA certification?
No. HIPAA does not have an official certification program the way frameworks like ISO 27001 do, despite some vendors marketing one. This is a security assessment and risk analysis engagement that supports the risk analysis obligation HIPAA actually requires, not a certificate you can present to a customer.
Do you determine whether HIPAA legally applies to us?
Applicability depends on organizational role, data, relationships, and other facts. We assess security obligations in context and coordinate with counsel where formal legal interpretation is required.
Do you review business associates?
Yes, where they are relevant to the ePHI environment. Business associate agreements are reviewed alongside the actual data flows and shared responsibilities they are supposed to govern, since a signed BAA does not by itself confirm the vendor is handling ePHI the way the agreement describes.
How often should a HIPAA risk analysis be updated?
At minimum, whenever the environment, systems, vendors, or workforce materially change, and periodically even without major changes, since risk analysis is an ongoing obligation rather than a one-time event.
Do you help with breach response planning?
Risk analysis informs breach response readiness, and incident response planning can be scoped alongside or after the assessment if it is not already in place.
Make the ePHI environment match the security story.
Bring us the security risk analysis requirement, healthcare customer pressure, ePHI architecture, business associate model, or concern that the documentation has drifted from reality.
You do not need to diagnose the exact engagement before contacting us. Bring the pressure, milestone, or decision.
Talk Through the AssessmentExplore All Assessments