Question 1

What does HIPAA compliance actually require?

Accepted Answer

HIPAA requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect electronic protected health information (ePHI). This includes risk assessments, access controls, audit logs, encryption, workforce training, and breach notification procedures.

Question 2

Do we need a Business Associate Agreement with you?

Accepted Answer

Yes, and we provide one. As a HIPAA Business Associate, we're required to sign a BAA with any covered entity we work with. We have a standard BAA ready and are happy to review a BAA you provide as well.

Question 3

How often do we need to do a HIPAA risk assessment?

Accepted Answer

HIPAA requires risk assessments to be conducted regularly and whenever significant operational or environmental changes occur — such as new software, staff changes, or infrastructure upgrades. Most practices conduct them annually at minimum.

Question 4

What happens if we fail a HIPAA audit?

Accepted Answer

Failure to comply can result in fines ranging from $100 to $50,000 per violation, with annual caps up to $1.9M per category. More importantly, a breach can damage patient trust permanently. We help you maintain ongoing compliance so audits aren't a surprise.

Question 5

Do you work with small practices, not just large hospitals?

Accepted Answer

Absolutely. Most of our healthcare clients are small to mid-sized practices — solo physicians, group practices, dental offices, and mental health providers. HIPAA applies to them just as it does to large hospitals, and we tailor our approach to fit smaller environments.

Question 6

How long does HIPAA compliance implementation take?

Accepted Answer

Initial implementation typically takes 4–8 weeks depending on the size of your practice and your starting point. We begin with a gap assessment, then work through remediation in priority order. Ongoing compliance maintenance is built into our managed IT services.