Cybersecurity
HIPAA security risk analysis
The HIPAA Security Rule expects covered entities and business associates to conduct an accurate and thorough assessment of risks to electronic protected health information. We provide the technical analysis, so your compliance and legal teams can rely on it.
The problem this service solves
Regulators repeatedly cite the same failure: no risk analysis, or an outdated one that did not cover all systems holding ePHI. Many organizations do not know every system that contains it: email, shared drives, backups, a vendor portal, a developer’s test database.
We trace where ePHI lives and moves, assess the safeguards around those systems and document risks and mitigation plans. The analysis is a record your team maintains, not a one-time report.
What is in scope
-
ePHI inventory
Systems, applications, devices, vendors and data flows that create, receive, maintain or transmit ePHI.
-
Threat and vulnerability identification
Realistic threats to each system and known weaknesses.
-
Technical safeguards
Access control, audit controls, integrity, authentication and transmission security.
-
Administrative support
Review the technical side of workforce access, contingency planning and incident response.
-
Business associates
Technical review of vendors that handle ePHI and the evidence you hold for them.
-
Risk register and plan
Risk ratings with owners, dates and mitigations.
How the work runs
Inventory
Find ePHI.
-
1
Scoping and discovery
Interviews, architecture review and data flow mapping.
Analyze
Rate the risk.
-
2
Safeguard assessment
Evaluate technical safeguards in place.
-
3
Risk rating
Combine likelihood and impact with a documented method.
Plan
Act.
-
4
Remediation plan
Prioritize mitigations with owners.
-
5
Maintenance
Define when the analysis must be updated.
What you receive
- ePHI system inventory and data flow maps
- Risk register
- Technical safeguard assessment
- Remediation plan with owners
- Update triggers and schedule
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- A privacy or compliance lead
- List of systems and vendors that touch patient data
- Prior assessments, if any
What this service is not
- Legal advice or compliance certification
- Breach notification decisions
What changes afterwards
- An accurate view of where ePHI is and how it is protected
- A risk register that drives action
- Evidence that a risk analysis was performed and is maintained
Questions people ask
Is there a HIPAA certification?
There is no official HIPAA certification. Compliance is your organization’s responsibility, and the Office for Civil Rights enforces it.
Is the Security Rule changing?
HHS published a proposed rule in January 2025 that would add requirements. Reporting indicates it had not been finalized as of this page’s last review. We recommend confirming current status with counsel.
Related
-
Healthcare
Interoperability, HL7 and FHIR integration, patient data protection and systems that cannot go down.
-
Penetration testing
Authorized, manual testing of applications, networks, cloud and identities to show what an attacker could reach and what to fix first.
-
Third-party risk assessments
Evaluate vendors and partners by what they can reach in your environment, not only by questionnaire answers.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response