HIPAA readiness built for digital health teams
Administrative, physical, and technical safeguards implemented by a senior practitioner, with the BAAs and policies you need in place before you ship.
What you get
Security Rule controls
All required and addressable safeguards implemented and mapped to your environment.
BAA review
Business Associate Agreements reviewed for every subprocessor that touches PHI.
PHI handling policy
Written guardrails for where PHI can flow, including any AI or automation tools in your stack.
Breach notification readiness
An incident response plan that maps to the 60-day notification rule.
Workforce training program
Annual training assignments, evidence, and reminders, set up and tracked for you.
Risk analysis
Annual risk analysis is a HIPAA requirement. We run it and keep it current.
Frequently asked
Are you a HIPAA covered entity?
No. If our work gives us access to PHI, we act as a business associate and sign a BAA accordingly.
Do you support the Privacy Rule too?
Yes, where it applies. Most digital health customers focus on the Security Rule first.
Do I still need a HIPAA auditor?
HIPAA does not have a certification, but most enterprise buyers want a third-party assessment. We get you ready for one.