HIPAA IT compliance consulting
A customer, a partner, or a regulator asks whether your healthcare systems meet HIPAA. We scope the systems that touch health information, find the gaps, and close them: access, audit logs, encryption, backups, and vendor handling. We prepare the evidence. We do not claim to be the government, and we do not issue a certification HIPAA does not have.
For example: Access reviews, Audit logs, Encryption, Backups
Typical engagement
How it starts
A written scope
The outcome
Evidence a reviewer can follow
What's included
6 capabilities
- Scoping of systems that create, receive, or store health information
- Gap assessment of access, logging, encryption, and backup
- Remediation in the application and the surrounding IT environment
- Policies and procedures written for how your staff actually works
- Evidence a reviewer or customer can follow
- Coordination with your existing vendors where their systems are in the path
Every project ships with Gap report, Evidence index, A clear handover.
What a small healthcare company is usually missing
The gaps we see are ordinary: shared logins, no record of who looked at a record, backups that have never been restored, and a vendor who can reach production with no agreement describing that access. The project closes those gaps in the systems you have.
We write the scope around the systems that actually touch health information, not around a generic control list. If something is outside what we should take on, we say so on the first call.
What you walk away with
You get a written scope of the systems that touch health information, a gap report, the remediation we completed, and an evidence index a reviewer can follow. Policies describe how your staff actually works. The accounts, the logs, and the documentation stay in your name.
We do not copy health information into our environment. Access is scoped, logged, and removed when the work is done. HIPAA is not a certificate we can hand you. The useful outcome is that a partner or reviewer can see who can sign in, what is logged, how data is protected, and whether a backup has been restored.
If a clinical or billing vendor sits in the path, we coordinate with them. We do not replace that product by default. A custom tool is only in scope when the product you pay for cannot do the step your staff is doing by hand.
Questions
Common questions
- Do you certify us as HIPAA compliant?
- No. HIPAA is not a certification we can hand you. We prepare the systems and the evidence so a customer, partner, or reviewer can see how access, logging, encryption, and backups are handled.
- Is this only for hospitals?
- No. It is for smaller healthcare and health-adjacent companies, typically 20 to 500 employees, whose systems create, receive, or store health information and who have been asked to show how that information is protected.
- Will you replace our EHR?
- Usually not. Most of the work is around the systems you already run: who can sign in, what is logged, how backups are tested, and how vendors are handled. A replacement is a separate decision, and we will say if that is the real problem.
- Where does patient data go during the project?
- It stays in your environment. We do not copy it to ours. Access is scoped, logged, and removed at handover. We sign an NDA before discovery on request.
- What do we get at handover?
- A gap report, the remediation that was done, an evidence index, and policies written for how your staff works. You keep the accounts and the documentation.
Other services
Looking for something else? Each of these can stand alone, or combine with the work on this page.
- SOC 2 readinessWe prepare your application for a SOC 2 examination and stay on as the liaison. A licensed CPA firm issues the report.
- PCI DSS readinessWe narrow where card data lives, close the gaps, and prepare the evidence. A qualified assessor issues any formal report.
- ISO 27001 readinessWe prepare the security management system and the evidence. An accredited certification body issues the certificate, not us.
- Compliance readinessSOC 2, HIPAA, PCI DSS, and other frameworks. We prepare your application and coordinate the examination.
A healthcare customer asking about HIPAA?
Tell us which systems touch health information, and we will outline what the project covers.