Home / HIPAA Services
HIPAA security risk analysis and documentation, done remotely.
Kamalution Company prepares HIPAA security risk analyses, risk management plans and aligned policy documentation for covered entities and business associates. Every engagement is scoped individually, performed remotely from the evidence you provide, and agreed in writing before work begins.
Start the scope assessment Takes 2 to 3 minutes. No patient information.
Services
Security Risk Analysis
A remote, evidence-supported analysis of the risks to electronic protected health information within a defined scope. A Risk Management Plan may be added.
- Prepared from the documents and evidence you provide
- Evidence index and list of any information still needed
- Fixed-fee proposal provided after review
Risk and Documentation Alignment
A Security Risk Analysis and Risk Management Plan, together with review and revision of an agreed catalog of policies and procedures so your documents match how your organization actually operates.
- Risk analysis, risk management plan and document review prepared together
- Consistency checks across the agreed document set
- Scoped individually after review of your environment
OCR Response Documentation
For organizations that have received an actual request from the HHS Office for Civil Rights. Factual organization and preparation of your response documentation package.
- Scope and fee set after reviewing the request
- New documents are identified as new; missing historical records are not recreated
- Legal positions and approval of the submission stay with you and your counsel
Who it fits
- Multi-site practices and health systems
- Business associates and service providers to healthcare organizations
- Organizations with several connected systems and many vendors
- Organizations with significant documentation gaps
- Organizations that have received a request from the HHS Office for Civil Rights, working alongside their legal counsel
Not included
- Onsite visits or walkthroughs
- Technical testing of your systems
- Legal advice or representation
- Emergency incident response
- Implementation of recommended changes, training or ongoing support
- Receiving patient records
Individually scoped
Every engagement is scoped from your environment: locations, systems, vendors, existing documentation and the evidence available. Timing is confirmed after scope review and depends on receipt of sufficient information. Terms and fees are agreed in a written proposal and signed agreement before any work starts.
Background reading: HHS guidance on the HIPAA Security Rule risk analysis and the HHS Security Rule overview.
HIPAA risk analysis questions
What is a HIPAA security risk analysis?
A HIPAA security risk analysis is an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (ePHI) held by a covered entity or business associate. It is required by the HIPAA Security Rule at 45 CFR 164.308(a)(1)(ii)(A). HHS publishes its own guidance on the topic.
Does a small or mid-sized organization need a risk analysis?
Yes. The Security Rule's risk analysis requirement applies to covered entities and business associates regardless of size. What differs is the scope and complexity of the analysis, which depends on your locations, systems, vendors and existing documentation.
What is the difference between a risk analysis and a risk management plan?
The risk analysis identifies where ePHI is at risk. The risk management plan records the decisions and priorities for reducing those risks to a reasonable and appropriate level. We can prepare the analysis alone or together with the plan.
Do you need access to patient information?
No. We work from non-patient evidence such as policies, system and vendor lists, and descriptions of how your organization operates. We do not receive protected health information. Please do not send patient information through this website or in any engagement.
Do you provide legal advice or guarantee compliance?
No. We are not a law firm, and our work is documentation and analysis, not legal advice or a compliance certification. No document can guarantee a regulatory outcome. For legal questions, including any regulator correspondence, work with a qualified healthcare attorney.
How does an engagement start?
You complete a short scope assessment. We review it, contact you with any questions, and send a written proposal and agreement. Scope, fees and terms are agreed in writing before any work begins.
Is the work done remotely?
Yes. Engagements are performed remotely from the documents and evidence you provide. We do not perform onsite visits, technical testing of your systems, or implementation of recommended changes.
Find out what a scope review would involve.
A short assessment tells us enough to respond with next steps. We aim to respond within 24 hours.