The HIPAA Security Rule applies to anyone who stores or handles electronic protected health information: clinics, dental and therapy practices, billing services, and the IT companies, backup vendors and consultants that work for them. It does not prescribe products. It asks for administrative, physical and technical safeguards, and for a documented risk analysis that shows you chose them deliberately.
This checklist turns the safeguards into eighteen plain-language questions. Score where you stand, see the gaps, and where a gap is one of our managed security or backup layers, the monthly cost at our published rates.
It is a readiness exercise, not legal advice. Enforcement cases almost always begin with a missing or stale risk analysis, so start there; our vCISO service runs the analysis and writes the plan that follows from it.
Click “Send this with the form below”, add your details, and we reply with the order we would tackle the gaps in and what each one involves.
Encryption is an “addressable” specification: you either encrypt protected health information at rest and in transit, or document why an equivalent measure is reasonable. In practice, encrypting laptops, backups and email in transit is the simplest way to meet it, and a lost encrypted laptop is not a reportable breach.
Yes. Any vendor that creates, receives, stores or transmits protected health information on your behalf is a business associate, including your IT provider, backup vendor and email host. We sign one with every healthcare client.
At least once a year, and after any significant change such as a new practice management system, a move to the cloud or a merger. Auditors ask for the date.
