HIPAA Compliance Services

The three HIPAA rules and what each actually means for your practice.

1. Privacy Rule (45 CFR Part 164, Subpart E)

Governs use and disclosure of Protected Health Information (PHI) — who can see what, under what circumstances, with what patient consent. Requires Notice of Privacy Practices, access controls, minimum necessary standard, patient rights (access, amendment, accounting of disclosures). Most common audit finding areas: Notice of Privacy Practices not posted/signed, unauthorized disclosures, inadequate access logs.

2. Security Rule (45 CFR §§ 164.302-318)

Governs electronic PHI — the technical, administrative, and physical safeguards required for electronic health information. Three safeguard categories: administrative (policies, workforce training, risk assessment), physical (facility access, workstation security), technical (access control, audit controls, integrity, transmission security). The Security Rule is where most "HIPAA compliance" work focuses — and where most practices have genuine gaps.

3. Breach Notification Rule (45 CFR §§ 164.400-414)

Governs what happens after a breach — notification to affected individuals, media (for breaches affecting 500+ individuals), and HHS. Breach investigation, risk assessment for probability of compromise, notification timelines, documentation requirements. Every practice needs a breach response plan before an incident, not during.

Our HIPAA compliance service addresses all three rules with practice-specific implementation, not boilerplate templates.

HIPAA compliance is not cybersecurity. Both matter.

HIPAA compliance is a regulatory framework. It defines required safeguards — policies, procedures, technical controls, documentation. A practice can be fully HIPAA-compliant on paper and still be poorly defended against actual threats (ransomware, phishing, insider threats). HIPAA is a necessary floor, not a sufficient ceiling.

Cybersecurity is active threat defense. It defines capabilities — 24/7 monitoring, threat detection, incident response, endpoint protection, email security. A practice with strong cybersecurity can still be non-HIPAA-compliant if policies, training, BAAs, or audit documentation are missing.

Both layers are required. Our engagements typically combine HIPAA compliance (the documented program) with managed threat detection and incident response readiness (the active defense). For most mid-size practices, both layers together run less than maintaining strong either alone — because they share underlying infrastructure and staff.

Why HIPAA compliance is not optional theater.

HHS OCR enforcement is active and increasing. Multi-million-dollar settlements for HIPAA violations are routinely reported on the HHS breach portal. Some are headline-making (major health system breaches); many more are mid-size practices settling for $50K-$500K over issues like missing risk assessment, inadequate encryption, or missing Business Associate Agreements.

Most enforcement actions follow breaches. A breach triggers OCR investigation, and investigation typically identifies HIPAA program gaps that existed before the breach. Practices that would have been compliant at audit survive breaches with limited enforcement exposure; practices with compliance gaps compound their breach exposure with enforcement exposure.

The recent rise in ransomware has amplified both risk vectors. Ransomware is itself a reportable breach under HIPAA (per OCR guidance), and ransomware affecting an unprepared practice typically reveals compliance gaps that existed before the incident. Breach + compliance gap = enforcement exposure that often exceeds the direct ransomware cost.