HIPAA Compliance
HIPAA compliance gets treated by a lot of organizations as a paperwork exercise — fill out a risk assessment template once a year, keep a binder of policies, move on. The Security and Privacy Rules were actually written to force something harder: an honest, ongoing understanding of where protected health information lives, who can touch it, and what happens when something goes wrong. The organizations that get hurt in a HIPAA investigation are almost always the ones whose documentation didn't match their reality.
Where this breaks down
The risk assessment is supposed to be the foundation of the whole program, and it's the thing I see done most superficially — a checklist pulled from a template instead of a real inventory of where ePHI actually flows: which systems store it, which vendors touch it, which employees have access they don't need, and which of those access paths have never been reviewed since the day they were granted. Without that foundation, the administrative, physical, and technical safeguards that are supposed to follow from it end up generic and disconnected from actual risk.
How I build this out
I start with a real risk assessment — tracing ePHI through your systems and your business associates, not just your own infrastructure. From there, I help close the gaps that come up most often: access controls that have drifted from least privilege, audit logging that exists but nobody actually reviews, encryption gaps on data at rest or in transit, and business associate agreements that were signed once and never revisited even as the relationship and the data flows changed.
I also push hard on breach response readiness, because HIPAA's notification requirements are specific and time-bound, and a plan that looks fine on paper often falls apart the first time someone has to actually use it under pressure. We build and test a response plan that accounts for the notification timelines to individuals, HHS, and in some cases the media, so you're not improvising those decisions during an actual incident.
Who this is for
Covered entities and business associates whose last risk assessment was a checkbox exercise, healthcare organizations bringing on new technology or vendors that touch ePHI, and anyone who's had a near-miss and wants their next risk assessment to reflect what's actually happening.
If it's time for an honest look at your HIPAA program, get in touch.