HIPAA compliance consulting covers Security Rule risk analysis, administrative, physical and technical safeguard gap assessment, Business Associate Agreement review, remediation planning and the documentation an auditor or enterprise security reviewer will ask for. Engagements run $9,000 to $25,000 for a gap assessment, $15,000 to $40,000 for a full Security Rule risk analysis, and $40,000 to $120,000 for a remediation programme. Taction is ISO 27001 certified and has built HIPAA-compliant healthcare software since 2013.
Most organizations do not fail HIPAA on intent. They fail on evidence: a risk analysis that was never completed, controls that exist but are undocumented, or Business Associate Agreements that were signed once and never reviewed against what the vendor actually does. Compliance is either designed in or paid for twice, and the second time it arrives under deadline pressure from a payer security review.
Our experts are ready to understand your business goals.
HIPAA consulting is frequently sold as a certification, which it cannot be, because no HIPAA certification exists. What a consulting engagement produces is an accurate picture of where your organization sits against the Security and Privacy Rules, evidence supporting the controls you do have, and a prioritized plan for the ones you do not. The value is in the specificity. A generic checklist tells you nothing an auditor will accept, and an assessment that does not name your actual systems is not an assessment of your organization.
The foundational requirement and the single most commonly cited deficiency in OCR enforcement. An accurate, thorough assessment of risks to electronic protected health information across all systems that touch it.
Mapping your actual controls against the administrative, physical and technical safeguards, identifying what is missing, what exists but is undocumented, and what is documented but not operating.
Checking that agreements exist with every vendor handling PHI, that they say what they need to say, and that they flow down to subprocessors rather than stopping at the first tier.
Turning findings into sequenced work with owners and dates, prioritized by risk rather than by ease. Findings without a remediation plan are a liability rather than a result.
Written policies that describe what your organization actually does, rather than a template describing what a generic organization might do. Auditors read for the difference.
The documentation package your enterprise customers, payers and partners will demand. Our HIPAA readiness audit produces exactly this.
The Security Rule organizes requirements into administrative, physical and technical safeguards, and each standard carries implementation specifications that are either required or addressable. Addressable does not mean optional, which is the most consequential misunderstanding in HIPAA compliance. It means you must implement it, or document why it is not reasonable and appropriate and implement an equivalent alternative. Organizations that treated addressable as optional and wrote nothing down have no defensible position when asked.
Risk analysis and management, workforce security, information access management, training, incident procedures, contingency planning and periodic evaluation. The largest category and the one most often thin on evidence.
Facility access controls, workstation use and security, and device and media controls. Frequently overlooked by cloud-native organizations who assume it no longer applies to them.
Access control, audit controls, integrity controls, person or entity authentication and transmission security. Where most engineering-led organizations are strongest and most documentation-light.
Required specifications must be implemented. Addressable specifications must be implemented or formally documented as not reasonable and appropriate, with an equivalent alternative in place.
Business associate contracts, policies and procedures, and six-year retention of documentation. Retention is a requirement organizations discover they have failed only when asked to produce something.
A control map naming your EHR, your cloud provider, your integration engine and your ticketing system is useful. One naming none of them is a template.
This is worth stating precisely, because a great deal of published commentary describes the update as though it is in force. It is not. HHS issued a Notice of Proposed Rulemaking in December 2024, published in the Federal Register on 6 January 2025, with the comment period closing on 7 March 2025. The proposal drew several thousand comments, and more than a hundred hospital systems and provider associations formally asked HHS to withdraw it. HHS has since moved the rule to its long-term regulatory agenda with a target of July 2027 for final action.
No updated Security Rule is in force. The existing Security Rule remains the standard you are assessed against today, and it remains actively enforced.
Removal of the addressable designation, mandatory encryption of ePHI at rest and in transit, multi-factor authentication, asset inventory and network mapping, annual penetration testing and stronger business associate oversight.
A final rule was previously expected in 2026. HHS has moved it to long-term actions with a July 2027 target, and these dates are not legally binding and have moved before.
More than a hundred provider organizations, including major health systems and national medical associations, have asked for withdrawal. HHS estimates first-year industry cost at roughly $9 billion.
The rule would take effect 60 days after publication with compliance required 180 days later, a total window of roughly 240 days, and business associate agreements updated within a year of the effective date.
Nothing in the proposal is unreasonable as security practice. Encryption, MFA, asset inventory and tested incident response are worth having regardless of whether the rule is finalized, delayed or withdrawn.
These are two distinct Security Rule requirements and organizations routinely do the first and skip the second. A risk analysis identifies threats and vulnerabilities to ePHI and assesses their likelihood and impact. Risk management is what you then do about them. OCR enforcement actions cite incomplete risk analysis more than any other deficiency, and the pattern is consistent: an assessment was performed at some point, it did not cover all systems holding ePHI, and nothing was tracked to closure afterward.
Every system, application, device and location that creates, receives, maintains or transmits ePHI. Assessments scoped to the EHR alone are the most common failure.
A questionnaire completed by one person from memory is not a risk analysis. Evidence, system inventory and technical verification are what make it defensible.
Risk analysis must be reviewed and updated as systems, threats and business practices change. A three-year-old assessment describing systems you have replaced is worse than none.
Risk management means documented decisions: remediate, mitigate, transfer or accept, with the rationale recorded. Accepted risk is legitimate; undocumented risk is not.
Risk introduced by business associates is within scope. Your assessment has to account for systems you do not operate but do depend on.
The engineer who knew why a control was configured that way leaves. Documentation is what makes the decision defensible two years later.
BAAs are the requirement most organizations believe they have handled and most often have not. Common findings are agreements missing entirely for vendors nobody classified as business associates, agreements that were signed once and never reviewed as the vendor’s role expanded, and flow-down that stops at the first tier while subprocessors hold PHI further down the chain. The 2024 vacating of the reproductive health privacy rule and the ongoing Security Rule proposal both make BAA review more urgent rather than less.
Any vendor creating, receiving, maintaining or transmitting PHI on your behalf, which routinely includes tools nobody thought of as clinical, such as analytics, support ticketing and document storage.
Permitted uses, safeguard obligations, breach notification timing, subcontractor flow-down, return or destruction on termination. Templates vary widely in how much of this they actually cover.
A business associate must bind its own subcontractors. Where that chain is untested, your PHI may sit with an organization under no contractual obligation to you.
Signing an agreement is not oversight. Periodic review of what vendors actually do with PHI, and whether their security posture still matches what was represented.
Major cloud providers will execute BAAs, usually with conditions about which services are in scope. Using an out-of-scope service for PHI is a common and avoidable exposure.
Healthcare software vendors are business associates themselves, which changes the obligations and the questions your customers will ask. Covered in the section below.
We price HIPAA work by scope rather than by hour, with the deliverable stated before work begins. The variables are organization size, the number of systems holding ePHI, how much documentation already exists and whether the engagement ends at findings or continues into remediation. Most organizations start with a gap assessment, because it produces an accurate picture and a costed plan, and because scoping remediation before you know what is broken is guesswork.
A bounded assessment producing a findings report, control map and prioritized remediation plan. The usual starting point and useful regardless of who executes the remediation.
The formal requirement, scoped across every system holding ePHI, with threat and vulnerability assessment, likelihood and impact ratings and documented risk decisions.
Vendor inventory, agreement review, flow-down verification and a remediation list. Frequently the fastest route to reducing genuine exposure.
Executing the plan, with engineering where controls need building rather than documenting. Priced after assessment because scoping it before is not honest.
Written policies describing what your organization actually does, mapped to the standards they satisfy, in a form an auditor will accept.
Periodic review, incident support, vendor assessment and evidence maintenance on a retainer, for organizations without a full-time compliance function.
Penetration testing, external legal review, certification body fees and any tooling licences are quoted separately from consulting effort and never absorbed silently into an engagement price.
A compliance engagement is only as good as what it leaves behind, and the test is whether a new hire or an external reviewer can pick up the documents two years later and understand your position. Every engagement produces artifacts intended to be used rather than filed. What follows is what a readiness audit typically delivers, and the same artifacts form the evidence package for enterprise security reviews, payer questionnaires and customer due diligence.
Each finding stated plainly, with the standard it relates to, the evidence, the risk and a recommended remediation. Written for your leadership rather than for a compliance auditor.
Every administrative, physical and technical safeguard mapped to the specific control in your environment that satisfies it, with gaps marked explicitly.
Every system creating, receiving, maintaining or transmitting ePHI, with the flows between them. Usually the artifact clients find most immediately useful.
Sequenced work with owners, effort estimates and risk-based priority, so that the first month of remediation addresses the largest exposure rather than the easiest item.
Every business associate, agreement status, flow-down verification and review date, in a form you can maintain rather than one that goes stale immediately.
Prepared answers and supporting evidence for the questions enterprise customers and payers ask, so each new review is a document exercise rather than a project.
Software vendors and digital health companies sit in a different position from providers. You are a business associate rather than a covered entity, your customers will audit you rather than the other way around, and your compliance posture is a sales asset or a sales obstacle depending on how it was built. Retrofitting access controls and audit logging into a live platform under deadline pressure from a payer security review costs several times what building it correctly would have, and we have watched organizations do exactly that.
Encryption, access control and audit logging specified during architecture rather than added during remediation. This is the single decision with the largest downstream cost impact.
Record-level access logging, immutable and retained, so an auditor can reconstruct who saw which record and when. Application event logs alone rarely suffice.
Role-based and attribute-based access reflecting real clinical and operational functions, with break-glass procedures and documented access review.
Your first hospital or payer customer will send a long questionnaire. Having the evidence pack ready turns a multi-week project into a document exercise.
Executing agreements with customers and flowing obligations down to your own subprocessors and cloud providers, which your customers will verify.
Our engagements run under a HIPAA-aligned development lifecycle with a BAA executed before the first commit. See our healthcare software development practice.
A HIPAA readiness audit typically runs $9,000 to $25,000. A full Security Rule risk analysis runs $15,000 to $40,000. Remediation programmes run $40,000 to $120,000 depending on findings. Ongoing compliance support starts at $3,800 per month.
No. HHS does not certify organizations as HIPAA compliant and no accredited certification exists. What you can have is a documented risk analysis, evidenced controls and a remediation record, which is what auditors and enterprise customers actually assess.
No. It remains a proposed rule. The NPRM was published in January 2025 and the comment period closed in March 2025. HHS has moved final action to its long-term agenda with a July 2027 target, and the existing Security Rule remains in force.
No. An addressable implementation specification must be implemented, or you must document why it is not reasonable and appropriate for your organization and implement an equivalent alternative measure. Doing neither and writing nothing down is a finding.
Whenever systems, threats or business practices change materially, and periodically regardless. An annual review is common practice. An assessment describing systems you no longer run provides no defensible position.
If you create, receive, maintain or transmit PHI on behalf of a covered entity, you are a business associate and the Security Rule applies to you directly, along with contractual obligations under your BAAs and flow-down to your own subprocessors.
Send us what systems hold PHI, whether a risk analysis exists and what prompted the question, whether that is a customer security review, a payer questionnaire or an incident. You will speak with someone who has built HIPAA-compliant systems rather than a salesperson. If your position is stronger than you think, we will tell you that. Start through our contact form.
Your email address will not be published. Required fields are marked *
Our expert reaches out shortly after receiving your request and analyzing your requirements.
If needed, we sign an NDA to protect your privacy.
We request additional information to better understand and analyze your project.
We schedule a call to discuss your project, goals. and priorities, and provide preliminary feedback.
If you're satisfied, we finalize the agreement and start your project.