Protect patients, and prove it.
Hospitals, clinics, practices and the companies that serve them run on systems that cannot go down and data that cannot leak. We assess your risk and your HIPAA compliance in business terms, so leadership knows what to fix first and you have the risk analysis regulators expect.
- Required
- A documented HIPAA risk analysis
- Standards
- HIPAA, HICP, HITRUST, NIST CSF
- Experience
- Dozens of healthcare organizations
- You leave with
- A ranked plan, not a binder
What healthcare is up against
Why healthcare security is different.
Downtime is a patient safety issue, and a breach is a regulatory one.
- Ransomware and downtimeClinical systems that cannot be offline for days.
- The HIPAA risk analysisRequired by the Security Rule, and often out of date or never done.
- Medical and legacy devicesEquipment you cannot easily patch or replace.
- Third parties everywhereBilling, EHR, lab and cloud vendors with access to patient data.
- Lean IT teamsSmall teams carrying enterprise-size obligations.
Standards we assess against
The standards you answer to.
We assess against the rules that apply to you, map them to each other, and score every gap the same way.
HIPAA Security Rule
The required risk analysis and risk management for electronic patient data.
HIPAA Privacy and Breach Notification
How patient data is used and shared, and what happens when something goes wrong.
HHS 405(d) HICP
Health Industry Cybersecurity Practices, the recognized security practices HHS can take into account.
HITRUST CSF
The certifiable framework many health systems ask of their vendors. We get you ready for the assessor.
NIST CSF 2.0
The common language for cybersecurity programs, used across HHS guidance.
NIST SP 800-66
NIST's guide to implementing the HIPAA Security Rule.
How we work in healthcare
Compliance is the floor. Risk is the plan.
A HIPAA risk analysis should do more than satisfy an auditor. We build it on your risk methodology, so the same findings drive budget, board reporting and the fixes your team works on next.
Risk analysis
Done properly, and kept current.
Assets, threats and likelihood documented the way the Security Rule expects, then scored in business terms.
Mapped
One program, several frameworks.
HIPAA, HICP and NIST CSF mapped together, so one control can satisfy all of them.
Practical
Sized for your team.
Recommendations a lean IT team can actually carry out, in the order that reduces the most risk.
How we help
Services healthcare teams use most.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →Questions
What people ask us.
Is a HIPAA risk analysis required?
Yes. The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis and to manage the risks it finds. It should be reviewed regularly and whenever your environment changes.
What is the difference between a risk analysis and a gap assessment?
A gap assessment checks your program against a framework's requirements. A risk analysis looks at what could actually happen to patient data and systems, and how likely and harmful it would be. We do both, and score the results the same way.
Do you work with business associates as well as providers?
Yes. Vendors that handle patient data have the same Security Rule obligations, and often need to show their customers they meet them.
Can you help us prepare for HITRUST?
Yes. We assess your program against the HITRUST CSF and help close the gaps before you engage an authorized assessor.
How do we get started?
Tell us which standards you answer to and what you already have. We scope the work around that, starting with a short call.