Healthcare practices
HIPAA Security Rule risk analysis.
The Security Rule requires a written risk analysis. It is the first document the Office for Civil Rights requests when it investigates a practice. Most practices store patient information in more places than they identify, and the first task is to locate them.
The process
Map, rate, plan.
- MapWhere patient information is created, stored, sent and kept: systems, devices, vendors, offices and telehealth.
- RateEach risk is rated for likelihood and impact, so the findings can be ranked.
- PlanA prioritized plan with an owner and a target date for every item.
Scope and fee
A fixed fee, set before work begins.
Each analysis is quoted in writing following a short scoping conversation. The fee is fixed and does not change as the work proceeds.
Four factors determine the scope:
- The number of locations
- The size of the workforce
- The number of systems and vendors that hold patient information
- Whether the practice offers telehealth
Please send a short description of the practice, and we will confirm the scope and fee.
What you receive
A document suitable for presentation to a regulator.
- A written risk analysis recording what was reviewed and how each risk was rated.
- A ranked remediation plan, with an owner and a target date for each item.
The analysis is not a one-time document. The Security Rule expects it to be reviewed and updated as systems and vendors change, and we can repeat it on a schedule you set.