Know where your patient data lives, and prove you are protecting it
A privacy assessment built on the HIPAA Privacy Rule, state privacy laws, and OCR expectations.
A Security Risk Assessment tells you whether your controls protect electronic protected health information. It does not, on its own, tell you whether your organization is meeting its privacy obligations. That means confirming how patient data is collected, used, disclosed, and shared, who has access to it, and whether your notices, authorizations, and business associate agreements would hold up under scrutiny.
The HIPAA Privacy Rule (45 CFR Part 164, Subpart E, §164.500–164.535) governs that territory, and a growing patchwork of state privacy laws layers on top of it for many organizations (e.g., California Consumer Privacy Act, Texas Data Privacy and Security Act). For multi-state payers and providers, the obligations multiply. The exposure isn’t limited to HIPAA-covered entities, either: health tech vendors and platforms that assumed they sat outside HIPAA’s scope are increasingly inside newer state consumer health data laws that reach information the Privacy Rule never touched.
OCR enforcement increasingly reaches privacy practices alongside security controls, and the questions a regulator asks after a complaint or a breach are often privacy questions. Who accessed this record, and were they permitted to? Was this disclosure authorized? Could the patient have requested a restriction you failed to honor?
For the Chief Privacy Officer and Chief Compliance Officer, and for the health tech leader who assumed HIPAA was the whole answer, this shows up as exposure a Security Assessment alone will not surface. A Privacy Assessment closes that gap, evaluating the use and disclosure of protected health information against the rules that actually govern it.
For organizations with data subjects in the EU, whether through international patients, EU-based clinical trial participants, or a health tech platform with European users, GDPR adds its own layer of consent, data-subject-rights, and cross-border transfer requirements on top of whatever HIPAA and state law already require.
A privacy assessment evaluates how your organization handles protected health information against the HIPAA Privacy Rule, applicable state privacy laws, and OCR guidance.
We define the assessment boundary across systems, business units, data flows, and the categories of the in scope information your organization collects, uses, and discloses.
We evaluate privacy practices against the HIPAA Privacy Rule and applicable state law, including uses and disclosures, minimum necessary use, patient rights (access, amendment, accounting of disclosures, restrictions), consent and authorization practices, notices of privacy practices, and business associate obligations.
We identify gaps where policy, workflow, and practice diverge. These are the places privacy obligations are documented but not operationalized.
We deliver findings and recommendations with executive-ready visualizations, including identified privacy risks, gaps, and the results of the privacy risk analysis to help prioritize remediation and inform risk-based decision-making
We translate identified risks and gaps into a practical, prioritized roadmap with clear actions the team can execute.
The assessment maps to related assurance frameworks so the engagement supports multiple compliance programs at once, and it pairs naturally with a Security Risk Assessment for full HIPAA coverage. For organizations with EU exposure, GDPR can be added to the engagement scope at the outset, priced and defined before the assessment begins rather than discovered mid-engagement.
What changes once the assessment is done:
Most privacy assessments stop at the HIPAA Privacy Rule. That’s no longer where the exposure ends. A growing set of state consumer health data laws and reproductive health privacy rules now reach data the Privacy Rule never touched, and they apply to organizations, including many that never counted as HIPAA covered entities, that assumed HIPAA compliance was the finish line.
We can assess against both layers in the same engagement. HIPAA Privacy Rule obligations, mapped alongside the state regimes that actually apply to your footprint, so the gap between “HIPAA-compliant” and “actually compliant” surfaces on your timeline, not a regulator’s or a plaintiff’s.
The output maps to the HITRUST and SOC 2 evidence your other programs need, so this work compounds instead of sitting in its own binder.
A Security Risk Assessment evaluates whether your technical, physical, and administrative controls protect electronic protected health information, measured against the HIPAA Security Rule. A Privacy Assessment evaluates something different: whether your organization’s use, disclosure, and sharing of protected health information holds up against the HIPAA Privacy Rule, patient rights, and applicable state laws. A strong security posture doesn’t guarantee privacy compliance, and the reverse is true too. Most organizations need both for full HIPAA coverage. See our Security Risk Assessment page for the security side of this comparison.
Yes. Beyond HIPAA, a growing number of states have enacted their own consumer health data laws, and many apply to organizations that assumed HIPAA compliance was their only obligation, including health tech vendors and other entities that were never HIPAA-covered to begin with. We evaluate your footprint against whichever state requirements currently apply to where you operate and who you serve, so the assessment reflects the law as it stands, not a fixed list that goes stale the next time a state acts.
Yes. The assessment evaluates the privacy practices a regulator examines after a complaint or breach, and our team brings direct OCR and expert-witness experience.
The Privacy Rule doesn’t mandate a fixed frequency, but an annual cycle is the practical baseline most organizations should plan around. Outside that cycle, specific events should trigger a review: new state-law exposure as your footprint expands, mergers or acquisitions, new data-sharing partnerships or business associate relationships, and material changes to how patient data is collected or shared.
Yes. We are 100% healthcare-focused.
It can. GDPR is scoped in at the outset, as part of defining the engagement and price, for organizations with data subjects in the EU, whether through international patients, clinical trial participants, or platform users. If GDPR isn’t part of your footprint, it’s simply left out of scope. Either way, you’ll know before the engagement starts, not partway through it.
Schedule a 30-minute conversation to walk through your current privacy posture and identify where your exposure actually sits.
