HIPAA compliance

HIPAA compliance that holds up, for practices and the companies that serve them

The HIPAA Security Rule tells you what to protect but not how. We do the how: the risk analysis, the safeguards, and the records that show you did it.

Book a 30-minute IT review Call 838-TENACIT

HIPAA is mostly talked about as a privacy law, but for an IT provider the part that matters is the Security Rule. It requires anyone handling electronic patient data to analyze the risks to it and put reasonable safeguards in place.

The rule is deliberately flexible. A three-person therapy practice and a hospital system are not expected to do the same things. That flexibility is also why so many small practices are unsure whether they comply.

We answer that question with evidence. A documented risk analysis, safeguards that match it, and records that show they work.

The boundary, stated plainly. We implement, operate and evidence the technical safeguards. Contracts, business associate agreements and Privacy Rule interpretation belong to your counsel. We will tell you which side of that line any question falls on.

What's included

Security risk analysis: The risk analysis the Security Rule requires, covering every system that creates, stores or sends patient data.
Access control: Unique logins, role-based access, multi-factor authentication, and prompt removal when someone leaves.
Encryption: Laptops, phones, backups and email encrypted, so a lost device is an inconvenience rather than a reportable breach.
Audit logging: Records of who accessed what and when, kept and reviewable.
Backup and recovery: Patient data backed up, tested, and recoverable within a time you have agreed in advance.
Policies and training: Written safeguards fitted to your practice, and training your staff will actually sit through.
Secure messaging and telehealth: Messaging and virtual consultations set up so convenience does not create exposure.
Vendor tracking: A list of every vendor that touches patient data, and which ones need a business associate agreement.
Record digitization and destruction: Paper charts scanned, indexed and archived, and originals disposed of securely when you are ready.

A good fit if

You run a medical, dental, therapy or wellness practice with no IT staff.
You build or run software that handles patient data for US healthcare customers.
You are outside the US and handle US patient data, or want to.

Probably not the right fit if

You need legal advice on interpreting the Privacy Rule. That is your counsel's work; we handle the technical side and say clearly where the line sits.

How it works

Risk analysis

We map where patient data lives and moves, and assess the risks to it.
Remediation plan

What needs fixing, in priority order, with a not-to-exceed price.
Safeguards in place

Technical, administrative and physical safeguards implemented and documented.
Keep it current

The risk analysis revisited as your systems change, and evidence kept ready.

Questions we get asked

Is there a HIPAA certification?

No. There is no official HIPAA certification scheme, whatever some vendors advertise. You comply with the rules and keep the evidence that you do. We help with both.

What does HIPAA actually require of our IT?

A documented risk analysis, and reasonable safeguards based on it: access control, audit logs, integrity controls, transmission security, backups, and policies. The rule is flexible on how; it is strict on whether you can show you did it.

We are not a healthcare provider, but we handle patient data. Does HIPAA apply?

Very likely. Companies that handle protected health information on behalf of providers are business associates, and the Security Rule applies to them too.

We are outside the US. Can you help us meet HIPAA?

Yes. Companies outside the US increasingly need HIPAA-aligned controls to work with American healthcare customers. If you also operate under GDPR, much of the groundwork is already there.

Can HIPAA and SOC 2 be done together?

Yes, and it is efficient. The controls overlap heavily, so we build them once and evidence them for both.