Technical Safeguards
The controls that decide who can reach PHI and whether you would even know if something went wrong.
- Access controls and unique logins
- Encryption at rest and in transit
- Audit logging and automatic logoff
HIPAA Audit
Find Your HIPAA Gaps
Before a Lawsuit Does.
A structured review of how your practice handles protected health information: access controls, audit logs, vendor agreements, offboarding. You get a written risk analysis and a prioritized plan to close the gaps. From $3,000.
What We Review
Six Areas. One Honest Picture.
A binder of policies does not make a practice HIPAA compliant. The safeguards have to hold up. This audit finds the gaps. If you want them fixed, that is the HIPAA and PCI Compliance Setup. Many practices audit first, then decide.
Administrative Safeguards
The process side of the Security Rule, including whether the required written risk analysis exists.
- Risk management process
- Workforce training and sanctions
- Designated security responsibility
Physical Safeguards
How the devices and locations that touch PHI are controlled day to day.
- Workstation and device security
- Media disposal and reuse
- Facility access to systems holding PHI
Access and Offboarding
Where quiet exposure builds up: shared logins, over-broad access, and credentials that outlive the employee.
- Who can see PHI, and why
- Shared-account and admin review
- Former-staff credential check
Business Associate Agreements
Every vendor that handles your PHI (EHR, billing, cloud, email) needs a signed BAA and the right data practices.
- BAA inventory and gaps
- Vendor PHI-handling review
- Subcontractor exposure
Documentation and Audit-Readiness
Whether you could produce evidence if the HHS Office for Civil Rights asked.
- Written risk analysis on file
- Policy and training records
- Log and evidence retention
The Investment
From $3,000.
Priced as a fixed-fee engagement, scoped to the size and complexity of your practice and agreed before we start. Never metered by the hour. You walk away with the written HIPAA risk analysis the Security Rule requires, plus a plan you can act on.
- A risk analysis in writing. The documented analysis HIPAA expects, in language your team and leadership can use.
- Built on real-world experience. Hands-on HIPAA implementation experience with healthcare practices.
- You own the findings. The risk analysis and remediation plan are yours. Fix the gaps in-house, hand them off, or bring them back to us.
How It Runs
Scope, Review, Plan.
1
Scope and Access
A short intake on how your practice runs, read access to the systems that touch PHI, and a schedule. We confirm the fixed fee before any work begins.
2
The Review
We check the administrative, physical, and technical safeguards against how PHI moves through your systems day to day.
3
Risk Analysis and Plan
You receive a written HIPAA risk analysis and a prioritized remediation plan, walked through live. You can close the gaps yourself, hand the plan to your team, or have us implement the fixes.
Know Where You Actually Stand on HIPAA.
Tell us about your practice and we will scope the audit and confirm the fixed fee.