Gap analysis against Trust Services Criteria before your auditor finds the gaps. Audit-ready evidence packages delivered fast, priced for real budgets.
Our assessors hold the certifications your auditors and assessors recognize — OSCP, CEH, and CREST. No junior analysts running checklists.
You get a fixed price before we start. No hourly billing, no scope creep surprises, no invoice that looks nothing like the quote.
Most assessments are delivered in five to ten business days from kickoff. Built for real audit deadlines, not enterprise consulting timelines.
Reports are structured so your auditor, QSA, C3PAO, or certification body can evaluate evidence directly. No translation layer required.
A HIPAA Security Rule risk analysis is a legal requirement, not a recommendation. Under 45 CFR 164.308(a)(1)(ii)(A), covered entities and business associates must conduct an accurate and thorough assessment of the risks to the confidentiality, integrity, and availability of ePHI. When an OCR investigator arrives after a breach, the risk analysis is the first document they request — and “we did not have one” is among the most commonly cited findings in OCR enforcement actions.
The Rule does not prescribe a methodology or a frequency, which is exactly what trips organizations up. You are expected to set a defensible cadence and justify it through your own risk analysis. Untested policies sitting in a binder do not demonstrate that your safeguards work. Evidence does.
The Security Rule organizes requirements into three safeguard categories, and a complete risk analysis has to cover all three rather than stopping at the technical layer:
Several of these are designated addressable rather than required. Addressable does not mean optional. It means you must implement the safeguard, or document why it is not reasonable and appropriate for your environment and implement an equivalent alternative. Treating addressable as optional without documentation is a finding waiting to happen.
The Security Rule as currently in force does not use the term “penetration testing” and does not set a testing schedule. What it does require is the risk analysis at 164.308(a)(1)(ii)(A) and periodic technical and non-technical evaluation at 164.308(a)(8). OCR guidance and industry practice treat penetration testing as the strongest practical method of satisfying that evaluation requirement, because it produces evidence that your technical safeguards actually resist attack rather than merely existing on paper.
That may change. On December 27, 2024, HHS issued a Notice of Proposed Rulemaking to modernize the Security Rule — the most significant proposed update since 2013 — which would make penetration testing at least every twelve months and vulnerability scanning at least every six months explicit requirements, alongside mandatory encryption and MFA. As of this writing the NPRM is still proposed, not final, and the current Security Rule remains in effect. The proposal contemplated a compliance window beginning after a final rule takes effect.
The practical read: do not treat proposed text as settled law, and do not wait for it either. Organizations that already run annual testing will absorb a final rule without disruption. Our guide to the proposed HIPAA Security Rule update tracks the current status and what to prepare for now.
The Security Rule sets no fixed interval, so the cadence is yours to define and defend. Most organizations land on annually, plus a reassessment after any material change to the ePHI environment — a new EHR deployment, a cloud migration, a merger, or a significant architectural change.
Documentation must be retained for six years and reviewed periodically. Our HIPAA compliance checklist covers what to keep, for how long, and in what form.
Pricing depends almost entirely on the size of your ePHI footprint — the number of systems, whether cloud infrastructure is in scope, and how many business associate relationships need review. A small practice and a multi-site hospital system are not comparable engagements.
We scope to your actual environment and quote transparently. Our HIPAA risk assessment cost guide explains what drives pricing and how to scope realistically.
Do not wait for a breach investigation to find out where your gaps are. Get your HIPAA Security Rule assessment quote and walk in prepared.
Tell us your framework, environment size, and audit deadline. Takes two minutes. No account required, no sales call triggered.
We review your submission and send a fixed-price quote with scope, timeline, and what you’ll receive — usually within one business day.
Once you approve, we kick off immediately. Gap report, remediation roadmap, and evidence package delivered in 5 to 10 business days.
No sales calls. Same-day response.
Yes. The risk analysis requirement under 45 CFR 164.308(a)(1)(ii)(A) is mandatory for covered entities and business associates. A structured assessment is how you produce that risk analysis in a format that satisfies OCR expectations and holds up under investigation.
The Security Rule does not specify an interval, so you set and justify your own cadence. Most organizations assess annually and reassess after any significant change to the ePHI environment — new EHR systems, cloud migrations, or mergers all warrant reassessment.
Not under the Security Rule as currently in force. The Rule does not name penetration testing or set a testing schedule. It does require a risk analysis and periodic evaluation of your safeguards under 164.308(a)(8), and penetration testing is widely treated as the strongest evidence for that evaluation. HHS has proposed a Security Rule update that would make penetration testing at least every twelve months an explicit requirement, but that proposal is not final and the current Rule remains in effect.
HHS issued a Notice of Proposed Rulemaking on December 27, 2024, published in the Federal Register in January 2025. It proposes removing the addressable/required distinction, mandating encryption of ePHI and multi-factor authentication, and requiring vulnerability scanning every six months and penetration testing every twelve months. It remains a proposed rule. Organizations should prepare, but should not treat the proposed text as current legal requirement until HHS publishes a final rule.
Yes. Business associates are directly liable under the Security Rule and must conduct their own risk analysis. A covered entity's assessment does not cover its vendors, and a BAA does not transfer the obligation.
Required specifications must be implemented as written. Addressable specifications must be implemented if reasonable and appropriate for your environment — and where they are not, you must document why and implement an equivalent alternative. Addressable never means optional.
.svg)