Protected health information (PHI)
Every intake note, treatment record, billing detail, and insurance form is PHI. If it lives on a laptop, in email, or in a cloud app without the right controls, it is a reportable breach waiting to happen.
Healthcare & Counseling
HIPAA compliance and risk assessments built for small practices
Therapy groups, counseling practices, and small clinics face the same HIPAA rules as large hospitals — with fewer staff and no security team. We turn those rules into a guided checklist, a clear risk score, and a remediation plan you can act on this week.
Why counseling and therapy practices are high-risk for HIPAA violations
Staff devices and remote work
Therapists and clinicians often access records from personal phones, home laptops, or unsecured Wi-Fi. Without encryption, access controls, and remote wipe, a lost device becomes a HIPAA incident.
AI transcription and note-taking tools
AI scribes, summarizers, and chatbots can speed up documentation, but many are not HIPAA Business Associates. Pasting session notes into the wrong tool is a fast path to an OCR complaint.
How the HIPAA-mapped assessment works
- 01
Tell us about your practice
Practice type, size, state, and the systems you use for scheduling, notes, billing, and telehealth. Two minutes.
- 02
Answer 27 HIPAA-mapped questions
Each question maps to both HIPAA safeguards and NIST CSF 2.0 functions — so one assessment covers compliance and security risk at the same time.
- 03
Get a risk score by function
See where your practice stands on Identify, Protect, Detect, Respond, Recover, and Govern — with HIPAA violations translated into business risk.
- 04
Receive your practice report
An executive summary, HIPAA gap list, quick wins, and a remediation plan with owners, effort, and deadlines you can show an auditor or attorney.
- 05
Remediate, then reassess
Work the roadmap, update your policies, and re-run the assessment to evidence improvement for HIPAA, insurers, and business partners.
What you get
HIPAA security risk assessment
A structured review of administrative, physical, and technical safeguards, mapped to the HIPAA Security Rule and NIST CSF 2.0.
HIPAA gap analysis
Control-by-control comparison of your current policies and workflows against what HIPAA and state privacy rules actually require.
Practice-ready remediation plan
Plain-English priorities sized for a small practice — no enterprise overhead, just the actions that reduce breach risk fastest.
Business Associate review
Identify which vendors touch PHI, check that BAAs are in place, and flag high-risk tools like AI transcription or offshore billing services.
Start with a free Mini Gap-Scan
10 healthcare-focused questions, about 5 minutes, no payment required. See where your practice stands before committing to a full assessment.