HIPAA compliance services
HIPAA Compliance Consultants and Security Risk Assessments
BlueRadius provides HIPAA compliance consulting for healthcare organizations and business associates: the security risk assessment the HIPAA Security Rule requires, remediation of what it finds, policies, business associate agreements and breach readiness.
A hospital customer wants your risk analysis before they sign a BAA. Your practice has not looked at its HIPAA documentation in years. Or a breach somewhere else made you wonder what an OCR investigator would find. BlueRadius runs the security risk assessment the Security Rule requires, fixes what it turns up, and keeps the program current, for healthcare organizations and the companies that serve them.
When organizations call us
- A healthcare customer asked for your risk analysis or a signed business associate agreement, and you are not sure what you would hand over.
- The last risk assessment is old, or was a checklist that never looked at your actual systems.
- You moved to the cloud or added new software, and ePHI now lives in places nobody has mapped.
- A breach, a lost laptop or a phishing incident raised the question of whether you would have to report it.
- Your cyber insurer is asking HIPAA questions at renewal.
What a HIPAA engagement includes
ePHI mapping
We find where protected health information is created, stored and sent: EHR and practice management systems, email, file shares, cloud apps, backups, devices and the vendors that touch it. You cannot protect what you have not found.
Security risk assessment
We assess threats and vulnerabilities to that ePHI across administrative, physical and technical safeguards, rate likelihood and impact, and document the result in the form the Security Rule expects, with a risk management plan attached.
Remediation
Access controls and MFA, encryption, audit logging, backups and recovery, device management and email security. Where the fix needs engineering or IT time, we write the requirement so your team or MSP can build it once.
Policies, BAAs and training
Security Rule policies and procedures your staff can actually follow, a review of your business associate agreements in both directions, and workforce training that covers the threats you really face.
Breach readiness
An incident response plan that includes the Breach Notification Rule decision: who decides whether an incident is a reportable breach, how it is documented, and who notifies patients, HHS and, where needed, the media. Our incident response team can step in if something happens.
Keeping it current
HIPAA is ongoing. Our vCISO service reviews the risk analysis as your environment changes, tracks remediation, and keeps the evidence organized. Findings can be tracked in Radius360 so progress is visible to leadership.
HIPAA alongside your other frameworks
Health tech companies usually need SOC 2 or ISO 27001 as well, and practices that take card payments need PCI DSS. We map the overlapping controls once and reuse the evidence. For an independent view of your whole program, see our cybersecurity audit. If you are still getting your bearings, start with our HIPAA compliance checklist or the wider healthcare cybersecurity page.
Who we work with
- Medical, dental and specialty practices
- Clinics, behavioral health and home health providers
- Health tech and SaaS companies acting as business associates
- Medical billing, coding and revenue cycle firms
- MSPs and IT providers serving healthcare clients
Frequently asked questions
What does a HIPAA compliance consultant do?
A HIPAA consultant makes sure your safeguards for electronic protected health information (ePHI) hold up. That means running the security risk analysis the Security Rule requires, closing the gaps it finds, writing the policies and procedures, sorting out business associate agreements, training your people, and keeping the evidence you would need if HHS's Office for Civil Rights ever asked.
What is a HIPAA security risk assessment?
The Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of the ePHI they hold. In practice that means finding every place ePHI lives or moves, identifying threats and vulnerabilities, judging likelihood and impact, and documenting a plan to reduce the risks. It is not a one-time exercise; it should be reviewed regularly and whenever your environment changes.
Is there such a thing as HIPAA certification?
No. HHS does not certify organizations as HIPAA compliant, and no third party can issue an official HIPAA certification. What you can have is a documented risk analysis, working safeguards, current policies and evidence that you follow them. Some companies add a SOC 2 report or HITRUST certification when customers want independent assurance.
We are a software company, not a hospital. Does HIPAA apply to us?
If you create, receive, maintain or transmit protected health information on behalf of a covered entity, you are a business associate, and the Security Rule applies to you directly. Your healthcare customers will usually ask you to sign a business associate agreement and to show your risk analysis before they do.
How does HIPAA fit with SOC 2?
Well. Much of the control work overlaps, so we map it once and reuse the evidence. Health tech companies often do both: HIPAA because the law requires it, SOC 2 because enterprise customers ask for an independent report.
What does HIPAA compliance cost?
It depends on how many systems hold ePHI, how many locations and people you have, and where you are starting from. We scope it on a short call and give you a written, fixed-fee quote for the risk assessment before any work starts.
Start with a security risk assessment
The risk assessment is the foundation of everything else HIPAA asks for. It is a fixed-fee engagement, quoted after a short scoping call. If you would rather talk it through first, book a 30-minute call.