I will do hipaa security risk assessment

Yes. Under 45 CFR § 164.308(a)(1)(ii)(A), all covered entities and business associates are required to conduct a periodic risk analysis of how electronic PHI is handled and protected.

Yes. I map your environment to the Administrative, Physical, and Technical Safeguards in HIPAA — and provide actionable recommendations aligned with NIST and OCR guidance.

Clinics, solo practitioners, hospitals, telehealth startups, EHR vendors, medical billing companies, and healthcare SaaS platforms.

Absolutely. You’ll receive a risk register, gap analysis, treatment plans, and (if needed) supporting policies or audit materials.

I can map controls to NIST CSF, CIS Controls, ISO 27001, GDPR, or DORA depending on your business model and jurisdiction.

No — this is a risk assessment and compliance consultation, not a technical test. However, I can advise on those services and vendors if needed.

No. I don’t need access to live PHI. We will discuss your systems, policies, and controls — not patient records.

You get expert-level analysis, custom guidance, and priority areas for remediation. Many clients resolve their biggest gaps in a single session block.

Yes. I work with seed-stage health tech founders as well as enterprise vendors. I help simplify HIPAA for technical and non-technical teams.

Yes. All consultation hours can be used for team workshops, 1 to 1 sessions, board updates, or documentation reviews — your choice.