HIPAA Security Rule gap assessment

Who it’s for

Covered entities, business associates, and health-tech or SaaS vendors that handle electronic protected health information. Consulting firms can subcontract the same work. We do it remotely anywhere in the U.S., and onsite in the Baltimore–DMV Metro corridor.

We start with the risk analysis the Security Rule requires. From there we map administrative, physical, and technical safeguards to the systems that hold ePHI, and review the policies and procedures those safeguards depend on.

If business associate agreements are part of your picture, we check that they match how data actually flows. You come away with a remediation roadmap and documentation organized so you can show your work if the Office for Civil Rights asks.

Nicholas has worked under HIPAA since early in his career: supporting HIPAA and HITECH compliance across 9 clinical sites in healthcare IT and MSP roles, and medical-device quality and risk work under ISO 14971 and IEC 62304. Later he translated HIPAA requirements into cloud controls for a large retailer and wrote HIPAA conformance guidance for a privileged-access software vendor.