Clear Responsibilities
Understand your role, information flows and obligations before investing in a compliance programme.
Hipaa compliance
Protect health information.
Support patient trust.
Make safeguards work.
Build a practical approach to protecting health information. Cyber360 helps covered entities and business associates assess HIPAA gaps, manage security risks and put privacy, security and breach-response procedures into everyday operation.
Healthcare privacy & security • Practical safeguards. Clear accountability.
Understand → Improve → Validate
From questions to decisions
Protect the information behind patient care.
Health information moves across clinical systems, billing platforms, suppliers and workforce workflows. We help you understand that environment, prioritise the risks and build safeguards that support both information protection and effective operations.
Risk-Led Safeguards
Focus effort on the risks to electronic protected health information and the controls that need attention.
Readiness You Can Demonstrate
Connect policies, workforce training and operational evidence with a sustainable improvement plan.
When it adds value
Focus effort where it can make a difference.
Establishing Your HIPAA Role
Determine whether covered-entity or business-associate requirements apply to your activities and relationships.
Changing the Care Environment
Review implications of new clinical systems, telehealth services, hosting arrangements or supplier access.
Preparing for Assurance
Organise policies, risk analysis, training records and control evidence for partner or regulatory enquiries.
Strengthening Incident Readiness
Clarify how staff identify, escalate, investigate and assess potential breaches of protected health information.
Service areas
A complete view of health-information protection.
These are examples for scoping, not an all-inclusive package. Technologies, delivery expertise, access requirements and outputs are confirmed before an engagement.
01
Applicability, Scope & Gap Assessment
What applies, and where are the gaps?
- Example scope
- Covered-entity and business-associate roles, PHI flows, systems, facilities and contractual relationships.
- What we examine
- Applicable Privacy, Security and Breach Notification Rule obligations and available evidence.
- Evidence to take away
- A scope statement, gap assessment and prioritised implementation roadmap.
02
Security Risk Analysis & Management
Where is electronic health information at risk?
- Example scope
- Agreed ePHI repositories, systems, users, interfaces, threats, vulnerabilities and existing controls.
- What we examine
- Likelihood and impact of risks to confidentiality, integrity and availability, with documented assumptions.
- Evidence to take away
- A documented risk analysis, risk register and treatment plan with owners and review dates.
03
Administrative, Physical & Technical Safeguards
Do safeguards fit the environment?
- Example scope
- Access, authentication, audit logging, integrity, transmission protection, facilities, workstations and media.
- What we examine
- Security responsibilities, contingency arrangements, configurations and evidence of control operation.
- Evidence to take away
- Safeguard recommendations, implementation guidance and agreed validation activities.
04
Privacy Practices & Individual Rights
Can teams handle health information appropriately?
- Example scope
- Permitted uses and disclosures, applicable minimum-necessary practices, notices, authorisations and rights workflows.
- What we examine
- Access, amendment, disclosure accounting and other applicable privacy procedures and responsibilities.
- Evidence to take away
- A tailored privacy documentation library and practical request-handling procedures.
05
Business Associates & Workforce
Are people and partners clear about their duties?
- Example scope
- Business associates, relevant subcontractors, agreements, supplier oversight and role-specific training.
- What we examine
- Classification, contractual safeguards, escalation expectations, training needs and awareness records.
- Evidence to take away
- A business-associate inventory, agreement review actions and workforce training materials.
06
Breach Readiness & Continuous Review
Can you respond and maintain progress?
- Example scope
- Incident escalation, investigation, breach assessment, notification processes and evidence maintenance.
- What we examine
- Risk assessment decisions, response responsibilities, contingency exercises and change-triggered reviews.
- Evidence to take away
- A breach-response protocol, decision templates and ongoing compliance review calendar.
How it works
From assessment to sustainable safeguards.
- 01
Define the Scope
Confirm your role, activities, PHI flows and the systems and relationships to review.
- 02
Assess the Evidence
Review policies, safeguards, workforce practices and existing compliance documentation.
- 03
Analyse the Risk
Identify ePHI threats and vulnerabilities and prioritise risks with accountable owners.
- 04
Build the Programme
Develop agreed policies, risk treatments, safeguard guidance and operational workflows.
- 05
Prepare People & Response
Deliver role-based awareness and walk through privacy and breach-response responsibilities.
- 06
Review & Improve
Maintain evidence, track remediation and reassess following material operational or technology changes.
What you receive
Clear enough to decide.
Detailed enough to act.
The reporting package is agreed around your audience and the decisions it needs to support.
For Leadership & Compliance Owners
- Applicability and scope statement with a HIPAA gap assessment.
- Documented security risk analysis and risk treatment roadmap.
- Privacy and security governance responsibilities and policy actions.
- Compliance review calendar and workforce training materials.
For Operational & Technical Teams
- PHI/ePHI flow and asset documentation for the agreed environment.
- Safeguard implementation guidance and validation priorities.
- Privacy-rights procedures and business-associate review toolkit.
- Incident escalation, breach assessment and notification templates.
Meaningful progress
Track the improvement.
Keep the evidence.
Agree what completion means for each action: an approved design decision, a reviewed configuration, a resolved finding or a demonstrated process. Record owners, dependencies, exceptions and the evidence available.
Review the programme when systems, facilities, threats or business-associate relationships change. Keep risk decisions and supporting documentation current.
Preparing the engagement
Start with the right context.
01
Role & Relationships
- Describe healthcare activities and covered-entity or business-associate relationships.
- Share existing agreements and partner assurance requirements.
02
Information & Systems
- List PHI and ePHI repositories, clinical systems, suppliers and data flows.
- Provide relevant architecture, asset inventories and access information.
03
Policies & Evidence
- Share risk analyses, policies, training records and prior findings.
- Identify privacy, security, clinical, IT and operational owners.
04
Delivery & Approvals
- Agree review boundaries, implementation tasks and change windows.
- Confirm legal review, decision authority and acceptance criteria.
Reference guidance: HHS: HIPAA guidance for professionals. Relevant practices are selected for the agreed scope; applicable requirements and evidence boundaries are agreed during scoping.
Clear boundaries
Know what the work establishes.
The engagement supports agreed HIPAA requirements, activities and evidence. Your organisation retains responsibility for compliance decisions and control operation. Specialist legal opinions, regulator representation and production implementation require explicit agreement.
GDPR Compliance
Explore privacy governance, individual rights and personal-data risk management.
Explore the service →ISO 27001
Connect health-information safeguards with a wider security management system.
Explore the service →Defensive Security
Review architecture, control design and operational readiness.
Explore the service →Practical questions
Before we get started.
Who must comply with HIPAA?
The HIPAA Rules apply to covered entities and business associates as defined by US law. Covered entities include health plans, healthcare clearinghouses and healthcare providers conducting specified electronic transactions. Handling health information alone does not automatically make an organisation subject to HIPAA.
What is the difference between PHI and ePHI?
Protected health information is individually identifiable health information within HIPAA scope. The Privacy Rule covers PHI in different forms; the Security Rule focuses on electronic PHI and its administrative, physical and technical safeguards.
Does Cyber360 issue a HIPAA certificate?
No. This service provides consulting, risk assessment and implementation support. It does not provide HHS approval or a government-recognised HIPAA compliance certificate, and an assessment does not guarantee compliance.
Is a vulnerability scan a security risk analysis?
No. A scan can inform the analysis, but a meaningful risk analysis considers the ePHI environment, threats, vulnerabilities, existing controls, likelihood and impact. Scope and evidence limitations must be documented.
How are breach notifications handled?
We help establish processes to assess incidents and determine applicable notifications, recipients and deadlines under the Breach Notification Rule. Business-associate agreements and other applicable laws may add obligations. Decisions and supporting evidence need to be recorded.
Does this cover every healthcare privacy law?
No. HIPAA is a US framework and does not replace other applicable privacy, healthcare or security laws. Additional regimes and specialist legal advice are scoped separately.
Take a closer look
The service overview,
ready to share.
Download the Cyber360 HIPAA Compliance brochure for the service scope, engagement approach, deliverables and preparation guidance.
PDF · 4 pages · 520 KB
Your next step
Where does your health-information protection need attention?
Tell us the decision you need to make. We’ll help define a useful scope.