HIPAA Compliance and Health Information Security

Flow chart of the HIPAA engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Role Confirmation. We confirm whether you are a covered entity or a business associate and map where health information lives. Activities: Determine covered entity or business associate status; Inventory systems holding protected health information; Map PHI flows across applications and vendors; Confirm which HIPAA rules apply to each flow. Hands over PHI Inventory and Applicability Memo. Phase 2, Security Risk Analysis. We run the risk analysis the Security Rule requires, covering administrative, physical, and technical safeguards. Activities: Assess threats and vulnerabilities to each PHI system; Evaluate administrative, physical, and technical safeguards; Score risks by likelihood and impact; Document the analysis per NIST SP 800-66 guidance. Hands over Security Risk Analysis Report. Phase 3, Safeguard Design. We design the policies and controls to close gaps, from access controls to encryption and workforce training. Activities: Draft HIPAA policies and procedures; Design access control and audit logging safeguards; Specify encryption for PHI at rest and in transit; Build the workforce training programme. Hands over HIPAA Policy Set and Remediation Plan. Phase 4, Privacy and Breach Processes. We set up processes for permitted uses, patient rights, and breach notification within the required timelines. Activities: Define permitted use and disclosure rules; Build the patient rights request workflow; Write the breach assessment and notification procedure; Test the breach process with a tabletop exercise. Hands over Privacy Procedures and Breach Notification Playbook. Phase 5, Business Associate Management. We help you put business associate agreements in place and manage vendor risk. Activities: Identify vendors that touch PHI; Execute business associate agreements with each; Assess vendor safeguards and certifications; Set a reassessment cadence for critical vendors. Hands over Executed Business Associate Agreements and Vendor Register. Phase 6, Readiness Review. We run a final review so you can demonstrate compliance to a customer, an auditor, or the regulator. Activities: Verify remediation of risk analysis findings; Test safeguards against the Security Rule; Compile the compliance evidence pack; Brief leadership on residual risk and next steps. Hands over HIPAA Readiness Report. Each phase begins from the artefact the phase before it produced.