Isn't a HIPAA risk analysis enough? Why do I need all three rules assessed?
The Security Risk Analysis is required, and on its own satisfies one specific requirement under the Security Rule (§ 164.308(a)(1)(ii)(A)). It does not, however, satisfy the Privacy Rule or the Breach Notification Rule, both of which apply to every covered entity. When OCR investigates a complaint or a breach, they look at all three. A practice with a strong SRA but no Privacy Rule documentation or Breach Notification procedures is still substantially out of compliance. We assess all three because all three are the law.
Do we actually have to do this, or is it optional?
The Security Rule explicitly requires a written risk analysis, reviewed and updated periodically. The Privacy Rule and Breach Notification Rule both require documented policies, procedures, and workforce training. None of it is optional for a covered entity or business associate. The Office for Civil Rights treats missing or stale compliance documentation as a serious deficiency in nearly every investigation we've seen.
Will this satisfy our insurance carrier or business associate agreement?
In nearly every case, yes. The deliverable is structured to satisfy what carriers and BA partners actually look for: a current, written, comprehensive HIPAA assessment covering all required rules, with documented findings and a remediation plan. If your specific carrier or BA has unique requirements (a particular template, a NIST 800-66 mapping, an OCR-style audit format), tell us in discovery and we can scope to those requirements.
What if OCR is already investigating us?
Tell us right away. An active OCR investigation changes timing, scope, and the kind of documentation the report needs to produce. We've worked engagements alongside OCR responses and can move quickly when the timeline requires it. A current, defensible compliance assessment is one of the most important things you can put in front of an investigator. We won't promise the assessment will resolve the investigation, but a thorough, well-documented assessment combined with a credible remediation plan materially helps your case.
How often does this need to be redone?
The Security Rule doesn't specify an exact cadence, but says the risk analysis must be reviewed and updated "as needed" and that updates should reflect material changes in your environment. The defensible standard most practices land on is annually, with an interim update whenever something significant changes (new EHR, new office location, major staffing change, an incident, or a new business associate relationship). Many of our clients return annually for an updated assessment.
Do you handle the remediation work after the report?
Just the assessment, by design. We don't sell security tools, we don't take vendor commissions, and we don't double as a managed service provider. Our independence is the whole product. If you want ongoing support implementing the roadmap, our Advisory retainer picks up where the assessment ends. For specific remediation work (new EHR security settings, MFA rollouts, encryption projects, policy drafting), we'll recommend vendors and partners who can help.
Will we get a HIPAA certificate or accreditation?
No, and you should be suspicious of anyone offering one. HIPAA is not a certifying framework. There is no "HIPAA certificate" issued by HHS or OCR. What you receive from us is a documented compliance assessment that demonstrates compliance with all three HIPAA rules and provides defensible evidence of due diligence. If you need a formal third-party certification, you may be thinking of HITRUST or SOC 2, which are separate frameworks with separate certifying bodies.
How much does a HIPAA compliance assessment cost?
Pricing depends on the size of your practice, the number of locations, the volume of business associate relationships, and whether you need a fresh assessment or an annual update to an existing one. We provide a written scope and fixed price after a free thirty-minute discovery call. No hidden fees, no commissions, no scope creep without your approval. Schedule an assessment to get a specific quote for your situation.