HIPAA Security Rule services for medical offices
HIPAA security for medical offices that don't have an IT department.
We evaluate your current setup, perform the risk analysis, design the network, build it, and leave you with the documentation an investigator will ask for first.
- BAA signed before any access
- Open, documented tools
- Plain-language reports
Your evidence binder
What an engagement leaves on your shelf
- Security Official designation, signed§164.308(a)(2)
- Enterprise-wide risk analysis and register§164.308(a)(1)
- Asset inventory and data-flow mapRisk analysis
- Business associate agreement tracker§164.308(b)
- Policy set and workforce forms§164.316
- Log review and backup test records§164.308(a)(1)(ii)(D)
- Citation crosswalk to every standardEvaluation
Policy set
One policy per Security Rule standard, written to match your office
- P-01 Security Management Process§164.308(a)(1)
- P-03 Workforce Security§164.308(a)(3)
- P-06 Security Incident Procedures§164.308(a)(6)
- P-07 Contingency Plan§164.308(a)(7)
- P-09 Business Associate Contracts§164.308(b)(1)
- P-13 Access Control§164.312(a)
- Eighteen policies in all, signed and dated§164.316(a)
Forms and logs
The records that prove the work happened
- Risk Analysis Worksheet and RegisterAnnual
- Vendor and BAA TrackerContinuous
- Termination ChecklistPer departure
- Log Review RecordWeekly
- Backup Verification and Restore Test LogEvery test
- Breach Risk Assessment (four-factor)Per incident
- Twenty-two forms in all, kept six years§164.316(b)(2)
Three things vendor marketing rarely tells you
No product makes you compliant
There is no such thing as HIPAA-certified hardware or software. HHS does not certify products. A vendor can sign a business associate agreement, but the configuration and the documentation are yours.
Technology is about a third of the work
The rest is the risk analysis, written policies, training, vendor management and records. A great firewall with no risk analysis puts you in a worse position than modest equipment with a complete, honest one.
Investigators ask for documents first
The Office for Civil Rights asks for paperwork before it asks for packet captures. We build every record at the same time as the system it describes, not two years later in a hurry.
What we do
Each service stands on its own, and each one ends with something you can file.
A review of what you already have: network, workstations, accounts, vendors, and the advice you inherited. We check whether a previous IT provider still has access, and we record what was done well, not only what is missing.
You receive a dated assessment of the current environment and a prioritized list of gaps.
The enterprise-wide risk analysis the Security Rule requires, done the way OCR and NIST SP 800-66 describe it. Its absence is the most frequently cited failing in small-provider enforcement.
You receive an asset inventory, data-flow map, risk register and a treatment plan.
An architecture sized to your office, where every element traces to a finding in the risk analysis. Firewalls, separate guest Wi-Fi, secure remote access, central logging, encrypted storage and off-site backup.
You receive a network design, bill of materials, budget and cutover plan.
We build and test it, cut over with a rollback plan so the EHR stays reachable, and configure workstations, multi-factor sign-in and email protection. Then we commission the system against a written test checklist.
You receive a working, monitored network, configuration records, and an emergency rebuild runbook.
Weekly alert review, patching, restore tests, the annual risk analysis update and tabletop exercise. Kept on a calendar your office manager can follow.
You receive signed review records every month and a current evidence binder every year.
How an engagement runs
The order matters. Hardware is never purchased before the risk analysis says what it is for.
Evaluate
Inventory what exists, review prior administrator access, photograph the current network.
Analyze risk
Threats, vulnerabilities, likelihood and impact for every place your patient data lives.
Design
An architecture and budget traced to each finding, plus business associate agreements in place.
Implement
Build, test, cut over outside clinic hours, run a full clinical day before retiring the old gear.
Operate
Monitoring, reviews, drills and yearly re-evaluation, all recorded as they happen.
Built for practices like yours
Our work is designed around small and medium offices: one or a few providers, around ten to forty staff, and patient records held in a cloud EHR.
When your records live in the cloud, the local network's job changes. It protects the workstations and credentials that open your entire record set, keeps patient data from quietly piling up on local machines, and produces audit evidence for your side of the boundary.
- Family, pediatric, dental, therapy and specialty practices
- Offices replacing an inherited setup or a departing IT provider
- Practices preparing for an audit, or answering a patient complaint
- Owners who want a clear budget and a plan they can understand
- Teams that will run things themselves and need a specification to hold a vendor to
A practice with a current risk analysis and documented decisions lands in a very different place than one with nothing.
Start with an assessment
A short conversation about your office, your EHR and your vendors tells us where you stand and what the first steps should be. There is no obligation to continue with us.