Services / Packages
HIPAA Security Risk Analysis
The security risk analysis HIPAA requires, covering every system that holds health information, including AI tools.
From $5,0003–5 weeks
Public agencies receive quotes structured to fit their procurement rules.
You own everything we produce.
Who this is for
Organizations usually call us about this when:
Your HIPAA security risk analysis is outdated or was never completed.
You’ve added AI tools that handle patient information.
An audit, payer, or partner asked for your most recent risk analysis.
Overview
The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of risks to electronic protected health information. We inventory where that information lives, including AI tools and vendors, assess threats and safeguards, and deliver a documented analysis with a prioritized remediation plan.
What’s included
- Inventory of systems holding health information
- Review of AI tools and business associates
- Assessment of threats, vulnerabilities, and safeguards
- Risk ratings for each system
- Documented risk analysis report
- Prioritized remediation plan
Available under attorney-client privilege. We can perform this work at the direction of your counsel, so findings may be protected by privilege. Ask us about privileged engagements.
How it works
Inventory
We identify every system, vendor, and AI tool that holds health information.
Assess
We evaluate threats, current safeguards, and the resulting risk levels.
Plan
You receive the documented analysis and a prioritized remediation plan.
How it works for your organization
The same service, tailored to the obligations and realities of each sector.
Private Sector
Healthcare companies and business associates use the analysis to meet HIPAA and answer customer audits.
- Health technology and service companies
- Business associates handling health data
- AI tools processing health information
- Evidence for customer and partner audits
Public Sector
Public health agencies and hospitals use the analysis to meet HIPAA and protect patient information.
- Public health departments
- Public hospitals and clinics
- Health programs using AI tools
- Documentation for audits and oversight
Nonprofits
Community health and behavioral health nonprofits use the analysis to meet HIPAA within their budget.
- Community clinics and health centers
- Behavioral health providers
- AI note-taking and intake tools
- Practical remediation for small teams
Frequently asked questions
How much does HIPAA Security Risk Analysis cost?
HIPAA Security Risk Analysis starts at $5,000. The final price depends on scope, and we confirm it in writing before any work begins.
How long does it take?
Most engagements take 3–5 weeks, depending on scope and how quickly information is available.
What do we receive?
The engagement includes: inventory of systems holding health information; review of AI tools and business associates; assessment of threats, vulnerabilities, and safeguards; risk ratings for each system.
Can this be done under attorney-client privilege?
Yes. When your counsel engages us and directs the work for the purpose of giving legal advice, our findings may be protected by privilege. Ask your counsel to contact us and we’ll structure the engagement with them.
What if a deliverable doesn’t meet the agreed scope?
We revise it until it does, at no extra cost. And if we miss an agreed delivery date, we take 10% off that deliverable.
Who owns the deliverables?
You do. Everything we produce for you is yours to keep, use, and share.
Related Guides
- Privacy Program Guide for Credit UnionsThe privacy laws, notices, data map, and member rights a credit union privacy program needs to cover, including AI tools.
- Data Protection Assessment Template for Credit UnionsA filled-in example assessment of an AI member service chatbot, covering data flows, risks, and safeguards, ready to adapt for your own systems.
- AI Regulation Map for Credit UnionsThe federal and state laws that apply when credit unions use AI in lending, fraud detection, member service, and marketing, and what each requires.
- AI Laws by StateWhere each state’s AI and privacy rules stand, with key dates and a page for every state.
Related services
Privacy Impact Assessment
A focused assessment of the privacy risks in one system or project, including AI systems, with specific safeguards.
Fractional Security Officer (vCISO)
A part-time security leader who owns your security program, policies, and risk decisions, including AI systems.
AI Risk Review
An independent review of one AI tool, vendor, or use case before you adopt it or expand it.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.