HIPAA Security Risk Assessment
The review of risk to ePHI required under 45 CFR § 164.308(a)(1)(ii)(A). Everything else in your program depends on it, so this is where most organizations should start.
HIPAA Security Risk Assessment details →HIPAA Compliance Services
Services covering the implementation of a full HIPAA compliance plan:
Security Risk Assessment starts it, results like Gap Analysis and subsequent Remediation Plans are automated. Mold policies your staff will train on, conduct final assessments, vendor management, and test your Incident Management.
Key TermsProtected Health Information (PHI) Individually identifiable health information held or transmitted by a covered entity or business associate, in any form. (45 CFR 160.103) Electronic PHI (ePHI) PHI that is created, received, maintained, or transmitted in electronic form. (45 CFR 160.103) Covered Entity A health plan, health care clearinghouse, or health care provider that transmits health information electronically. (45 CFR 160.103) Business Associate A person or company that performs functions or services for a covered entity that involve access to PHI, such as billing, IT, or cloud hosting. (45 CFR 160.103) Business Associate Agreement (BAA) The written contract HIPAA requires between a covered entity and a business associate. (45 CFR 164.502(e), 164.504(e)) Security Rule The HIPAA standards for protecting ePHI through administrative, physical, and technical safeguards. (45 CFR Part 164, Subpart C) Security Risk Assessment (SRA) The risk analysis the Security Rule requires you to conduct and document. (45 CFR 164.308(a)(1)(ii)(A))
Key HIPAA Terms Defined
Plain-language definitions of the terms used across these services, each tied to the regulation it comes from.
HIPAA Gap Analysis
A comparison of your safeguards against the requirements of the Security Rule (45 CFR Part 164, Subpart C) and the Privacy Rule (Subpart E). This way, you see the shortfalls of today and can progress without guessing.
HIPAA Gap Analysis details →HIPAA Remediation Plans
A written plan for closing each gap, aligned with the risk management requirement at 45 CFR § 164.308(a)(1)(ii)(B). It also gives an auditor evidence that you have a structured corrective action process.
HIPAA Remediation Plans details →HIPAA Policy Templates
Policies and procedures covering the documentation standard at 45 CFR § 164.316. You review and approve, your staff acknowledges. Nobody starts from a blank page.
HIPAA Policy Templates details →Staff HIPAA Training
Workforce training that addresses 45 CFR § 164.308(a)(5)(i), including HIPAA fundamentals and cybersecurity awareness, with completion records you can produce on request.
Staff HIPAA Training details →Physical Site Audit
An on-site walkthrough of your physical safeguards under 45 CFR § 164.310, covering facility access controls, workstation use, workstation security, and device handling.
Physical Site Audit details →IoT Device Inventory
A running count of every device that touches ePHI: workstations, laptops, phones, tablets, printers, and connected medical equipment. You cannot secure what you have never counted.
IoT Device Inventory details →IT Audit
A review of your IT configuration against the technical safeguards at 45 CFR § 164.312, covering encryption, access controls, and audit logging.
IT Audit details →Vendor Management
Track every vendor that touches your PHI and hold a signed BAA for each one, as required at 45 CFR § 164.308(b). Review them on a schedule instead of when something goes wrong.
Vendor Management details →Incident Reporting & Response
A clear, optionally anonymous way for staff to report a suspected unauthorized disclosure, plus defined response steps for your compliance officer under the Breach Notification Rule (45 CFR §§ 164.400–164.414). Test the whole workflow before you need it. It is built into the One Guy Consulting platform.
Incident Reporting & Response details →BAA Management
Drafting, signing, and tracking the Business Associate Agreements required under 45 CFR § 164.308(b) and § 164.314(a). Every agreement lives in one place with its signature status, so nothing expires quietly or goes missing.
BAA Management details →HIPAA Consulting
Direct guidance from a Certified HIPAA Professional for the questions software cannot answer. Implementation meetings, plain-English answers, and one person who already knows your setup, sized for small practices and business associates.
HIPAA Consulting details →How the services work together
HIPAA compliance is not a stack of separate projects. Each service on this page feeds the next one. The Security Risk Assessment documents where ePHI lives and what threatens it. The gap analysis compares that picture against the Security Rule and Privacy Rule requirements. The remediation plan turns each gap into an assigned task with a deadline. Policies get tailored to match how your practice actually operates, and staff training closes the loop by teaching the people who handle patient information every day. The eight-step HIPAA compliance process lays out that order.
Most of that flows automatically inside the One Guy Consulting platform. Complete the assessment once and the platform builds the gap analysis and remediation plan from your answers. It drafts policies around your environment instead of handing you a stack of generic templates. Vendor BAAs, incident reporting, and training records live in the same place, so the documentation an auditor asks for is already organized when the request arrives.
Where to start
Start with the Security Risk Assessment. HHS treats it as the foundation of a compliance program, and it is commonly the first document requested in an investigation. If you already have a recent assessment, a gap analysis will show how much of the remaining work is done and what is still open. Organizations that are brand new to HIPAA often begin with a 30-minute review call so the first step is chosen deliberately instead of guessed.
Every service is priced flat. No per-user fees, no per-module charges, and no hourly meter running while questions get answered. Small practices, billing companies, and other business associates use the same platform and the same process, scaled to the size of the organization.
This content is for educational and informational purposes only and should not be construed as legal advice.
Not sure which one you need?
Every service here runs on software Chuck built himself. The tedious parts (gap analysis, remediation planning, policy tailoring) happen automatically from your Security Risk Assessment answers. And pricing is flat: no user fees, no usage fees, no fees of any kind.
Book a 30-minute review. We will look at where you stand and tell you what to do first.