Silver
Gap Assessment
A single-location practice that needs a clear compliance check.
- Scope
- 1 location, up to 10 staff
- Timeline
- About 2 weeks
HIPAA readiness
Is your practice ready for a HIPAA audit?
The HIPAA Security Rule requires every practice to complete an accurate and thorough risk analysis. We find the gaps before an auditor, insurer or attacker does, and give you a clear plan to close them.
How it works
- 1
Answer a short questionnaire
About 3 minutes. Tell us about your practice, systems and current safeguards. No patient information.
- 2
Free 15-minute call
We review your answers with you and recommend the right package.
- 3
Assessment
We visit or meet remotely, interview staff, review systems and document every gap.
- 4
Fix, train and hand over
You receive policies, training, an incident response plan and a readiness report you can show an auditor.
HIPAA readiness packages
Choose by the size of your practice. Every package is scoped to your locations and staff.
Gold
Readiness Program
Practices that want gaps found and fixed.
- Scope
- Up to 3 locations, up to 30 staff
- Timeline
- About 4 weeks
Platinum
Audit-Ready
Multi-location practices and home care agencies.
- Scope
- 5 or more locations, 50 or more staff
- Timeline
- About 6 weeks, with on-site visits
| What's included | Silver | Gold | Platinum |
|---|---|---|---|
| Risk assessment and gap analysis | 1 location | All locations | All locations, plus leadership interviews |
| HIPAA policies | Review of existing policies | Review plus up to 10 updated policies | Full policy set mapped to NIST SP 800-66 |
| Staff interviews | 1 location | Up to 3 locations | Every location |
| Technical security review (firewall, backup, access) | – | High-level | Comprehensive |
| Compliance plan | – | Plan with a quarterly roadmap | |
| HIPAA staff training | Add-on | Training plus phishing simulation | |
| Incident response plan | Template | Plan for your practice | Plan for each site plus tabletop exercise |
| Mock audit | – | – | |
| Final deliverable | Summary report | Detailed report for each site | Audit-ready handbook and executive briefing |
Larger organizations
Hospital groups, multi-entity practices and enterprise scope are planned and quoted as a custom program.
Ongoing compliance
Extra locations, additional phishing campaigns, an annual reassessment and continuous compliance monitoring through our platform partner.
Recent Platinum engagement: a 5-location home care agency with 50 staff, completed in 6 weeks.
Pricing depends on the number of locations and staff. Request a quote and we will send a fixed proposal.
HIPAA has no official certification. Our assessments document your readiness and the steps to reach it.
Frequently asked questions
Is there such a thing as HIPAA certification?
No. HIPAA has no official certification. Regulators and insurers look for a documented risk analysis, current policies, trained staff and evidence that safeguards are in place. That is what these packages produce.
Will you see our patient records?
No. We review how patient information is protected, not the records themselves. Work is covered by a signed Business Associate Agreement.
How much of our time does it take?
A point of contact, your existing policies, and short interviews with a few staff members at each location.
We already did a risk analysis. Do we need this?
The Security Rule expects the risk analysis to be kept current. If yours is more than a year old, or your systems, locations or staff have changed, it likely needs an update.
Find out where your practice stands
Answer a short questionnaire. No patient information. We will call you to walk through your results.