Role and information inventory
Record the relevant services, systems, workforce and providers. Identify unresolved scope or responsibility questions.
Patient information. Clear responsibilities. Practical safeguards.
HIPAA consulting for US healthcare operations and suppliers.
Healthcare leaders need a clear view of information risks, implementation gaps and the people accountable for fixing them. CyberVantage360 helps US organisations scope HIPAA assessments, examine the relevant environment and turn findings into practical actions. Build evidence your privacy, security and operating teams can use.
Start with the operating decision
Describe the organisation and information environment accurately.
HHS identifies covered entities and business associates as the organisations subject to HIPAA. Confirm the role, activities and information involved before defining the assessment. Not every health-related application or supplier has the same duties.
Map ePHI across applications, devices, support processes and external providers. HHS risk-analysis guidance calls for attention to the relevant information environment and risks. A vulnerability scan or policy questionnaire alone does not establish the whole analysis.
United States context
Connect leadership priorities with operating decisions.
For a healthcare operation, the assessment should distinguish urgent risks, procedural weaknesses and missing evidence. Explain which owners can implement changes and which decisions require clinical, privacy, legal or technology input.
For a business associate, follow the customer and subcontractor relationships alongside the technical environment. An agreement is important, but its duties need to become working access, handling, escalation and disposal processes.
Agreed outputs
Produce findings the organisation can act on.
Agree the scope, method, evidence needs and completion criteria at the outset.
Risk and gap analysis findings
Explain threats, vulnerabilities, existing safeguards and evidence limitations. Distinguish risk analysis from a comparison with requirements.
Prioritised implementation roadmap
Assign actions, dependencies and verification criteria. Separate technical remediation, policy decisions and supplier work.
Operating review and workforce evidence
Develop practical learning, selected workflow checks and a controlled record of decisions. Define ongoing review when systems or services change.
Practical implementation
Test the process where information leaves its usual path.
Review a support export, an unavailable application or a staff access change. These events show whether safeguards and escalation work when routine conditions change. Document the facts and decisions rather than assuming that a written policy proves operation.
Agree assessment, implementation and specialist advice separately. Keep unresolved actions visible to management and verify the result of completed work. Continuing review remains necessary after the initial project.
Illustrative operating decisions
Two US healthcare operating decisions.
Hypothetical examples, not client case studies or claims of completed engagements.
A practice adds a patient communication service
A hypothetical US practice introduces a new communication tool. The review identifies what patient information enters the tool, who administers it and how the vendor relationship should be handled.
The implementation plan addresses access, staff instructions, supplier questions and records needed for ongoing review. A convenient product feature is not treated as proof that the configured workflow meets every obligation.
A business associate replaces a support platform
A hypothetical US healthcare software supplier migrates support tickets to a new provider. Historical attachments may contain ePHI, and access and retention settings differ between the two platforms.
The assessment follows the migration, verifies permissions and identifies return or disposal decisions. Management receives a record of completed checks and remaining risks rather than a generic platform-compliance statement.
A clear engagement basis
Know what the assessment establishes.
A scoped assessment supports informed decisions and improvement. HHS does not endorse private Security Rule certifications, and an external review does not remove continuing obligations or preclude a later regulatory finding.
Before you commission the work
Commission the right assessment.
Does every US healthcare-related business need the same programme?
No. Establish covered-entity or business-associate status and the activities in scope, then identify the applicable responsibilities.
Is a gap review the same as risk analysis?
No. A gap review compares practices with requirements; risk analysis examines risks and vulnerabilities to relevant ePHI. Agree both outputs where needed.
Can you provide government HIPAA certification?
No. HHS does not recognise private Security Rule certificates. The deliverable should state the assessment's findings, scope and limits.
What happens after findings are issued?
Assign actions and owners, agree verification evidence and track unresolved risk. Define ongoing review and reassessment responsibilities.
Can supplier statements replace our own checks?
Use relevant supplier evidence, but examine your retained configuration, access and operating responsibilities. Generic claims do not answer every local question.
What determines the work and timing?
The service scope, information environment, evidence quality, technical gaps, suppliers and internal capacity determine the plan. Begin with a high-level scoping discussion.
Reference basis
Sources and scope of this guidance
HHS: Covered Entities and Business Associates; HHS: Business Associates; HHS: Guidance on Risk Analysis; HHS: Security Rule certification FAQ.
Official references checked 13 October 2026. The implementation examples are practical recommendations; legal applicability and the agreed assurance scope need their own review.
Plan the engagement
Start with the decisions and risks that need attention.
Describe the organisation, healthcare relationship and assessment priorities. A high-level summary is sufficient; keep patient records, credentials and sensitive incident evidence out of the initial enquiry.