Healthcare providers and their business associates serving US patients must protect electronic protected health information (ePHI) under HIPAA.
We perform a risk analysis and assess your administrative, physical and technical safeguards, with a clear remediation plan.
Objectives
- Perform a HIPAA Security Rule risk analysis
- Assess administrative, physical and technical safeguards
- Review business associate arrangements
- Test systems handling ePHI
Methodology
01
Planning
- Define scope, applicable requirements and critical systems
- Agree audit plan, sampling approach and timelines
02
Fieldwork
- Review of policies, procedures and governance
- Testing of technical and operational controls
- Interviews with process owners and evidence verification
03
Technical testing
- Vulnerability assessment and penetration testing where in scope
- Configuration review of servers, databases and network devices
04
Reporting
- Observations rated by risk with recommendations
- Management responses and follow-up review
Deliverables
Audit plan and scope
Audit report with risk-rated observations
VAPT report where in scope
Remediation plan and follow-up review