Compliance,
without the
three-ring binder.
We work with healthcare organizations on HIPAA and HITECH compliance — auditing how PHI is actually handled, documenting the gaps, and implementing controls that meet current regulations and stay ready for the next round of changes.
Compliance is
operational, not
paperwork.
A HIPAA binder full of policies that nobody follows isn't compliance — it's evidence in your enforcement action. The point of HIPAA and HITECH is to actually protect patient health information. We help you build the technical and operational controls that make compliance a side effect of running a tight environment.
Most healthcare practices we work with are competent and well-intentioned but stretched thin. Their EMR vendor will tell them they're compliant. Their IT vendor will tell them they're compliant. And then an audit comes, and it turns out nobody had verified the basics — encryption at rest, access logging, backup integrity, vendor BAAs, workforce training, breach response procedures.
We work backwards from what an OCR audit actually looks at. Then we close those gaps with technical controls — not by adding more paperwork to a system that's already too busy.
Where most practices fall short
- — No documented, tested backup recovery procedure
- — No multi-factor authentication on remote access
- — Stale user accounts from former staff still active
- — Missing or outdated business associate agreements
- — No risk assessment in the past three years
- — Surveillance footage retention with no documented policy
- — Mobile devices accessing PHI without management
Five
things
we deliver.
A HIPAA engagement with us produces concrete artifacts you can show an auditor, your insurance carrier, or your board — not a dossier of generic templates downloaded from the internet.
Risk Assessment
A full Security Rule risk assessment covering administrative, physical, and technical safeguards. We document where PHI lives, who can touch it, how it moves, and where the realistic risks are. Output is a written assessment plus a prioritized remediation list.
Technical Remediation
The actual fix work — encryption rollout, MFA deployment, access control cleanup, audit logging configuration, and backup remediation. Done by the same engineers who run our cybersecurity practice, not handed off to a separate compliance team.
Policies & Procedures
Written policies that match what you actually do. Workforce training, sanctions, breach response, contingency planning, device management — written for a healthcare practice, not a Fortune 500.
Vendor & BAA Management
Inventory of every vendor that touches PHI, BAA status review, and gap remediation with the vendors themselves. Includes cloud services, EMRs, backup providers, and the surveillance and access control systems that capture patient activity.
Ongoing Compliance Posture
Annual reassessments, ongoing monitoring, and a documented audit trail that you can hand to a regulator on short notice. Compliance isn't a project — it's a posture.
Surveillance is
part of HIPAA, too.
The HIPAA Security Rule explicitly covers physical safeguards — facility access controls, workstation security, and device controls. That's why our HIPAA work and our Axis-based physical security practice end up on the same engagements regularly.
We design surveillance and access control systems that capture what HIPAA expects you to capture, retain footage for the period your policy actually requires, and produce audit trails that hold up under scrutiny.
Physical security in a HIPAA context
- — Camera coverage at PHI-handling workstations
- — Access control on records storage rooms
- — Documented and enforceable retention policies
- — Audit-friendly access & viewing logs
- — Visitor management integrated with surveillance
Audit coming up? Or just overdue?
A short call helps us scope a risk assessment quickly. Healthcare engagements move fast — we're used to working against audit deadlines without cutting corners.
Schedule a HIPAA review →