Governance · Privacy and data governance · 02
HIPAA readiness
HIPAA readiness prepares a covered entity or business associate to meet the Privacy, Security and Breach Notification Rules: the risk analysis the Security Rule requires, the administrative, physical and technical safeguards, the policies and workforce training, the business associate agreements, and the evidence that would be examined in an investigation or audit. It is needed when a healthcare practice or its vendor has never completed a documented risk analysis, when a customer or payer asks for evidence of compliance, when an incident may trigger breach notification, or when the organization has grown into obligations it did not have before. Readiness produces a risk analysis and risk management plan, a gap assessment against each required and addressable safeguard, the policy and training set, and the evidence pack an investigator would request.
Scope
What the review covers.
- Security Rule risk analysis and risk management plan
- Administrative, physical and technical safeguards: required and addressable
- Privacy Rule policies, notices and individual rights handling
- Business associate inventory and agreements
- Breach notification procedure and documentation
- Workforce training and sanctions records
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Risk analysis | Documented to the standard regulators expect |
| Gap assessment | Safeguard by safeguard with evidence |
| Policy and training set | Written to the organization’s practice |
| Evidence pack | Organized for audit or investigation |
Prerequisites
What we need from you.
- Identification of where protected health information is created, stored and transmitted
- Access to systems, vendors and the people who manage them
- Existing policies, agreements and training records
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is a risk analysis the same as a gap assessment?
No. The risk analysis is a specific requirement of the Security Rule and the first thing an investigator asks for. The gap assessment covers the rest. We do both.
Do you handle breach notification?
We prepare the procedure and support execution with counsel. Determinations and notices are legal decisions made with counsel.
Does this cover our vendors?
It covers the agreements with them and the oversight of them. Their own compliance is theirs; the review shows whether you have the assurances you need.