HIPAA risk assessment
HIPAA requires a risk analysis, and your insurer asks for it.
- Network & Wi-Fi.
- Laptops & EDR.
- Backups, which this is about.
- Email & DMARC.
- Logins & MFA, which this is about.
- Files & access, which this is about.
- Staff & training, which this is about.
- A cyber insurer and clients ask about these layers.
What's included
For medical practices.
- A security risk analysis under the HIPAA Security Rule
- Business associate agreements collected and checked
- Access to your EHR reviewed
- A remediation plan with dates
- Records ready for your insurer and auditor
Timeline and price
One fixed price and written dates, agreed before you sign.
What you keep
- Admin access You hold every password and key. We enter with written consent.
- Your staff Your IT person stays in charge. We work beside them.
- Your forms You sign your own insurance and compliance forms.
How it starts
From the first call to the 90-day review.
- Book a call, 30 minutes
- Written scope, Dates and a price
- You sign, You keep admin access
- Work starts, On the written date
- 90-day review, What changed, in writing
Questions
- 01 What does it cost?
One fixed price, written before you sign. Ask for a price.
- 02 How long does it take?
The start and end dates are written into the agreement.
- 03 Do we keep our current IT?
Yes. Your staff and your admin access stay yours.