Risk analysis and risk management
Done every year and whenever something changes, with a fix plan we track until it's done.
About the assessmentThe program
What a HIPAA security program covers
Policies and procedures
Written for how your practice actually works, reviewed every year, and dated so you can prove it.
Training
Security awareness training for every staff member, plus phishing tests so you know it stuck.
Technical safeguards
Access controls, multi-factor sign-in, encryption, audit logs and automatic logoff, set up and checked.
Business associates
A list of every vendor that touches patient data, and the business associate agreement you need with each.
Incident response
A plan for the first hours of a breach, and help working through the notices if it happens.
Working with you
We back up your security official, not replace them
HIPAA requires every covered entity to name a security official (45 CFR 164.308(a)(2)). That's usually your practice manager or owner. We do the technical work and the paperwork behind them, and meet with them every quarter to go over what changed.
If you already have an IT provider, we run the compliance program alongside them. If you don't, our managed IT plan covers the technical safeguards too.
If OCR calls
Ready when someone asks for proof
When the HHS Office for Civil Rights looks into a complaint or a breach, it asks for documents: your risk analysis, risk management plan, policies, training records and business associate agreements. Insurers and larger partners ask for many of the same things.
We keep all of it current and in one place, so you can answer without scrambling. HIPAA requires you to keep this documentation for six years (45 CFR 164.316(b)(2)).
FAQ
Questions we get asked
Don't see yours? Email hello@portlandsecureit.com and you'll get a straight answer.
Do we need a HIPAA compliance consultant?
Not always. A small practice can run its own program with good templates and time. Most bring someone in when nobody has time to keep it current, or after an insurer or OCR asks questions they can't answer.
Will you sign a business associate agreement?
Yes. We sign a BAA before we access any system that holds patient data.
How is this priced?
As a monthly program on its own, or added to a managed IT plan. We quote it after a short call.
Can you cover SOC 2 or PCI DSS too?
Yes. A lot of the work overlaps, so we map the same controls to SOC 2, PCI DSS or NIST when you need them.
Keep reading