C'S|3 Consultancy Book a 30-minute call
Compliance & Risk

HIPAA Compliance

A security risk assessment on its own does not make you HIPAA compliant — a misunderstanding that accounts for a great many failed audits. We assess against all three Rules, then manage the compliance rather than handing you a report.

Book a 30-minute call The three Rules
Who this is for

If you touch PHI, this applies to you

Any organization that handles Protected Health Information is required by law to satisfy every HIPAA requirement. That includes benefits providers, healthcare companies, and any organization that stores or processes health-related data about the people it serves.

Business associates are in scope too, not just covered entities — the Security Rule reaches anyone who might share ePHI.

HIPAA is regulated by the Department of Health and Human Services and enforced by its Office for Civil Rights.

The gap is wider than most boards think

According to HHS, 70% of the healthcare market is not HIPAA compliant. CMS reports that 79% of Meaningful Use audits end in failure.

The most common cause is the assumption that a security risk assessment alone discharges the obligation. It doesn’t — it covers one Rule of three.

What we assess against

Three Rules, assessed separately

Each carries its own standards and its own failure modes. We work through all three rather than treating HIPAA as a single checkbox.

The Privacy Rule

National standards for patients’ rights to their PHI — rights of access, a provider’s grounds for denying access, and the required contents of Use and Disclosure forms and Notices of Privacy Practices. The Privacy Rule applies to covered entities, not business associates.

The Security Rule

National standards for the secure maintenance, transmission, and handling of ePHI, covering the physical, administrative, and technical safeguards that must be in place. It applies to covered entities and business associates, because of the potential sharing of ePHI between them.

The Breach Notification Rule

What covered entities and business associates must do when PHI or ePHI is exposed. The Rule distinguishes Minor from Meaningful Breaches by scope and size. Every breach must be reported to HHS OCR regardless of size — the reporting obligations differ, the obligation to report does not.

Assessment

Where you stand against all three Rules today, with a prioritized gap list separating what creates legal exposure from what merely needs tidying.

  • Privacy, Security, and Breach Notification Rule coverage
  • Physical, administrative, and technical safeguards
  • Business associate agreements and data flows
  • A remediation roadmap with owners and dates

Ongoing management

HIPAA is not a certification you obtain and file. Compliance is a state you have to stay in, and it drifts the moment a system, a vendor, or a policy changes.

  • Scheduled reassessment as your systems change
  • Policy and procedure maintenance
  • Documentation kept ready for an OCR request
  • Support if you do have to notify

Already doing SOC 2? Most of the control work counts twice

Start here

Find out where you stand

Tell us what you handle and who’s asking. In 30 minutes we’ll give you an honest read on your exposure and what closing it actually involves.

  • A straight answer on scope and timeline, not a sales pitch
  • No charge, and no obligation to engage us
  • You talk to a senior consultant, not an account rep