HIPAA Compliance
HIPAA compliance touches your IT more than you think.
The Security Rule's technical safeguards — access control, audit logging, data integrity, and encrypted transmission — are where most small healthcare practices have unknowing gaps. We find them and fix them.
The Security Rule's Technical Safeguards
What We Assess and Implement
Access Control
Unique logins for every user, role-based permissions so staff only see relevant patient data, automatic logoff on idle sessions, and MFA on anything that touches ePHI.
Audit Controls
A real, reviewed record of who accessed what ePHI and when — not just logging turned on and forgotten, which is the most common gap we find.
Integrity Controls
Backup configuration, version history, and controlled access so ePHI can't be improperly altered or destroyed — by an attacker, a bug, or an honest mistake.
Transmission Security
ePHI encrypted in transit (email is a common failure point) and at rest, on servers and in cloud storage.
Custom Pricing
Cost depends on your practice's size, systems, and current state. Request a free consultation and we'll scope what a gap assessment looks like for you.
What We Commonly Find
Common Gaps in Small Practices
- MFA isn't enforced account-wide, or is only turned on for some staff
- Former employees still have active access to systems containing patient data
- Patient information gets sent over regular, unencrypted email
- No Business Associate Agreement (BAA) on file with a cloud vendor that touches ePHI
- Audit logging exists but nobody is reviewing it
- Staff use personal devices to access patient data without any device-level safeguards
Free HIPAA Security Rule Checklist
The same technical safeguards covered above, as a one-page checklist you can walk through with your own team before booking a formal assessment.
FAQ
Frequently Asked Questions
What is a HIPAA Security Rule gap assessment?
A review of your technical safeguards — access control, audit logging, data integrity, and transmission security — against what the Security Rule actually requires, with a prioritized, practical plan to close whatever gaps we find.
Does this cover all of HIPAA compliance?
No, and we want to be upfront about that: full HIPAA compliance also involves policies, training, and administrative safeguards outside of IT. This is the technical half of the picture, done right — not a substitute for guidance from your compliance officer or legal counsel.
How much does this cost?
Pricing depends on your practice's size, systems, and current state, so we don't publish a flat rate. A free consultation is the low-pressure way to find out what a gap assessment would actually look like for your systems.
Do you only work with practices in the Belleville area?
Hands-on, in-person work is local to the Belleville, IL / Metro East St. Louis area. Gap assessments, remediation, and ongoing technical safeguards are largely remote work, so we support healthcare practices nationwide.
How does this relate to your Cybersecurity Awareness Training?
They cover different halves of the same problem. This is your systems and technical safeguards; Awareness Training covers your staff's day-to-day habits, and its "Protecting Sensitive Data" session can be tailored specifically to HIPAA.
Not sure where your practice stands?
A free consultation is a low-pressure way to find out what a gap assessment would actually look like for your systems.
Request a Gap Assessment