Independent HIPAA security risk analysis
We perform independent HIPAA security risk assessments for healthcare practices — validated against technical evidence from the systems actually protecting your ePHI, not just what the policy says or the questionnaire asked.
Representation versus reality
A questionnaire asks what people believe is happening. Evidence shows what is actually happening. Most SRAs stop at the first question — “Do you have this control?” — and record the answer. We ask the second one: can you demonstrate that the control is appropriately implemented and operating?
Your policy requires multi-factor authentication, and your checklist says it's enabled. We check privileged accounts, Conditional Access exclusions, stale accounts, and emergency access accounts. An active administrator account outside the MFA policy is the kind of gap a questionnaire never finds — and an attacker looks for first.
HR did the paperwork. We verify whether accounts were actually disabled — user accounts, shared mailboxes, service accounts, and vendor logins included. Offboarding that exists on paper but not in the directory is a finding, not a formality.
It's the answer every practice gives. We verify whether encryption is actually enforced and reporting healthy on each device — and whether the backups holding the same ePHI are encrypted too.
A backup you've never tested is a hope, not a control. We look for evidence that recovery actually works — because that's the question that matters the day you need it.
None of these show up in a self-attestation. All of them show up in an evidence-backed assessment. That's the difference between a checkbox report and a risk analysis you can defend.
The engagement
No generic template. The work follows your ePHI, your systems, and the safeguards operating in your environment.
We identify where your ePHI lives: systems, workflows, locations, and vendors. The assessment covers your actual environment.
We review policies, configuration exports, and system evidence relevant to the safeguards protecting ePHI.
We determine whether each safeguard operates as represented — checking accounts, settings, and activity rather than taking the policy's word for it.
We evaluate threats, vulnerabilities, and existing controls to determine likelihood and impact for each finding.
You get prioritized findings with actionable remediation steps, sequenced so your IT team or MSP knows what to fix first.
The record
A risk analysis should support decisions at every level — without losing the trail back to the evidence.
What leadership needs to know: where you stand, what matters most, and what happens next. No jargon.
The formal risk analysis document, structured around the Security Rule's requirement: 45 CFR §164.308(a)(1)(ii)(A).
Control-by-control validation results: what was tested, what the evidence showed, and where reality diverged from representation.
Every finding, risk-rated and prioritized, with clear remediation actions.
An inventory of every artifact reviewed, mapped to the safeguard it supports — making the analysis traceable and defensible.
A sequenced plan your IT team or MSP can execute, instead of a compliance binder nobody opens again.
We assess security controls. We don't make our money selling the products we're assessing — so there's no upsell hiding behind a finding and no reason to soften one.
An independent assessment means the results are the results: documented, evidence-backed, and free of any sales agenda. That's what makes the findings credible to anyone who reads them later — your board, your cyber-insurance carrier, or an auditor.
Recognized references
Our methodology is grounded in recognized sources and applied to your environment. The goal isn't a thicker binder. It's an accurate, thorough risk analysis where every conclusion traces back to evidence.
Physician groups, dental practices, behavioral-health organizations, outpatient clinics, home-health agencies, and specialty practices — roughly 10 to 250 people — that want more than a checkbox SRA. If your MSP currently performs your assessment in-house, an independent assessment validates their work instead of asking them to grade their own homework.
Mostly, yes, in everyday use. “Risk analysis” is the term the HIPAA Security Rule itself uses. “SRA” is the shorthand most practices use day to day. The deliverable is the same: a formal, evidence-backed analysis of risk to your ePHI.
No. The HHS SRA Tool is a self-guided questionnaire — useful as a starting point, but it records what you tell it. Our assessment independently validates your answers against technical evidence from your systems. If you've outgrown the tool, this is the next step.
Because staff change, systems change, and vendors change. The Security Rule expects the analysis to be current. An existing-SRA review can also tell you whether last year's assessment meaningfully reflected your technical environment before you commission a full one again.
Not in the regulatory sense — only OCR conducts HIPAA audits. What most people mean by a “HIPAA audit” is an independent third-party assessment of their HIPAA security posture. That's what this is: an independent assessment conducted with the rigor an auditor would expect to see.
There is no such thing as HIPAA certification — no government body issues one. An evidence-backed risk analysis gives you something real: documented proof that you performed a serious, thorough analysis and are addressing what it found.
No honest assessor can promise that. What it does is put you in a defensible position: an accurate, thorough risk analysis, grounded in evidence, with documented follow-through on findings.
Yes. We coordinate evidence collection with your IT team or MSP, and the remediation roadmap is built for them to execute. The difference is that the assessment itself is independent — your MSP doesn't grade its own homework.
Start with the environment you have
Request an assessment, or start with a review of your current SRA. Either way, you'll talk with an assessor — not a sales rep.