HIPAA
Readiness
HIPAA has no certificate. What it has is a Security Rule that requires a genuine risk analysis and safeguards proportionate to what that analysis found - and an enforcement body that asks to see both after something goes wrong. We run readiness so your safeguards and documentation would hold up if OCR asked.
Who this is for
Readiness earns its cost when something is waiting on the other side of it. These are the situations where it pays for itself.
Covered entities - providers, health plans, clearinghouses - handling electronic protected health information
Business associates whose customers have asked how ePHI is protected
Digital health companies whose enterprise health system buyers require evidence before signing
Anyone who has a HIPAA policy set but has never done a defensible risk analysis
What the engagement does
Your Lorikeet team runs the assessment, collects and vets the evidence, and keeps control status current. You are not handed a spreadsheet and wished well.
- Identify where ePHI actually lives, moves, and is accessed - usually more places than the policy says
- Run the risk analysis the Security Rule requires, and record the risk management decisions that follow it
- Assess the administrative, physical and technical safeguards, addressable and required alike
- Document why each addressable specification was implemented, or why an equivalent measure was used instead
- Review the business associate agreements in place and the ones missing
- Build the documentation set that demonstrates the programme operates
What you walk away with
A risk analysis that would survive scrutiny, safeguards traceable to the risks they address, addressable specifications with documented decisions rather than silence, and a business associate picture that is complete. The documentation is the deliverable, because with HIPAA the documentation is what enforcement asks for.
How it runs
Four phases. You always know which one you are in and what is outstanding.
Scoping call
We establish what is in scope, which assessment path applies, and what you already have. It costs nothing, and it ends with a straight answer about whether readiness is the right spend right now.
Assessment
We walk the control set and record where you actually stand, control by control. The gap list lands early so your team can start on the long items while the rest of the assessment continues.
Remediate and evidence
We work the gap list down with your team and collect what each control needs, filed against the control it belongs to with an owner and an expiry date rather than dumped in a folder.
Hand off to your assessor
You go in with a package that maps requirement to control to evidence, and we stay available through the assessment itself.
What the assessment covers
The control areas we walk for HIPAA. Each breaks down into individual controls carrying status, owner and evidence in Talon.
HIPAA has no certifying body and no certificate - anybody selling you one is selling something else. Enforcement is by the HHS Office for Civil Rights, usually triggered by a complaint or a breach. We prepare you for that scrutiny, and for the third-party assessments customers increasingly ask for.
It runs in Talon, not in a spreadsheet
Every control, its status, its owner and its evidence sit in the portal your team already uses, so the readiness picture you see is the one your Lorikeet team is maintaining rather than a copy that went stale a fortnight ago.
- Control-by-control status, kept current by the people doing the work
- Evidence filed against the control it satisfies, with expiry dates tracked
- The auditor request list, so nothing is chased over email
- A readiness view that shows what an assessor would see
Tools like Vanta monitor controls continuously once they exist and work. Readiness is the part before that: deciding the boundary, designing the controls, and closing the gaps a monitoring tool would otherwise report as permanently red. We work alongside them, and we are a Vanta MSP partner.
Our partnersAsked on almost every HIPAA call
No. There is no official HIPAA certification. You can be assessed against the Security Rule by a third party, and many companies do that to satisfy customers, but no certificate carries regulatory weight.
It does not mean optional. It means you implement the specification, or implement an equivalent alternative, or document why neither is reasonable and appropriate. Ignoring it is not one of the three options, and that is where organisations get caught.
It is an ongoing obligation, not an annual box. It needs revisiting when your environment changes materially - new systems handling ePHI, new vendors, a breach, a significant architecture change.
Commonly, yes. SOC 2 gives you a report to hand a buyer; HIPAA is the regulatory obligation. The control overlap is high, so running them together is considerably cheaper than sequentially.
Rarely run alone
Controls overlap heavily between frameworks, and evidence collected once counts everywhere it applies. A second framework costs a fraction of the first.
HIPAA readiness, on your timeline
A scoping call costs nothing and ends with a straight answer: what the work involves, what it costs, and whether you need it yet.
