HIPAA Compliance Services

A healthcare customer asks for proof that you protect its patient data, or a regulator's notice about possible HIPAA penalties arrives. That is where CyberCrest starts. It offers HIPAA compliance services to covered entities and to business associates, such as the SaaS and health-tech vendors that store or process patient data for them. CyberCrest assesses your program, guides the remediation your team carries out, reviews the documents your team writes, and closes with a HIPAA attestation report.

HOW COMPLIANCE IS CHECKED

WHO IT APPLIES TO

RELATED SERVICES

FAQ

METHODOLOGY

Our HIPAA Compliance Methodology

The four steps run in a fixed order, because the risk analysis decides what gets fixed first. Each step answers a provision of the HIPAA Security Rule, the part of HIPAA that sets safeguards for electronic protected health information (ePHI).

HIPAA Readiness Assessment

Your team maps where your ePHI is created, received, maintained, or transmitted, and settles which role HIPAA gives you. CyberCrest guides both decisions. Covered entities are health plans, healthcare clearinghouses, and most healthcare providers; business associates are the vendors that create, receive, maintain, or transmit protected health information (PHI) on their behalf. CyberCrest then assesses the risks to that ePHI.

Remediation Support

Your team closes the gaps, taking corrective actions in an order it sets from the first step's findings. CyberCrest specifies what each safeguard has to achieve and reviews the work.

Security Rule Evaluation

The Security Rule requires a periodic technical and nontechnical evaluation of your security policies and procedures. CyberCrest first reviews your documentation and evidence for gaps, then performs the evaluation, measuring your safeguards against the rule.

Attestation Issuance

CyberCrest issues a HIPAA attestation report that states the result of the evaluation, for customers and partners who ask for proof. It is not a certification: the Department of Health and Human Services (HHS) does not endorse or recognize private ones. When environmental or operational changes affect the security of your ePHI, your team updates the documentation, and the evaluation and the report are renewed.

SERVICES

Our HIPAA Consulting Services

CyberCrest sells its HIPAA compliance consulting services as four separate offerings, bought alone or together. How far your program already meets the HIPAA requirements decides which of them you need.

HIPAA Risk Analysis and Gap Assessment

Your team decides which systems and locations hold ePHI, and CyberCrest guides that decision. Under the Security Rule, the risk analysis takes in all the ePHI you create, receive, maintain, or transmit. CyberCrest assesses the risks and vulnerabilities to its confidentiality, integrity, and availability, measures your safeguards against the Security Rule, and names the gaps it finds. Security risk assessments for other frameworks are part of CyberCrest's work as well.

Remediation of Identified Gaps

Your IT team implements the fixes, whether they are access controls, encryption, audit logging, or a missing procedure. CyberCrest specifies what each fix has to achieve, provides expert guidance while the work runs, and reviews the result against the Security Rule.

HIPAA Evaluation and Attestation

After remediation, CyberCrest performs the Security Rule's periodic technical and nontechnical evaluation of your documentation and evidence, then issues a HIPAA attestation report with the result. Your customers can review the report, which is not a certification. Later evaluations come with ongoing support.

Ongoing HIPAA Compliance Support

The recurring part of the work: as your environment changes, your team updates the risk analysis and documentation to maintain compliance, and CyberCrest reviews each update, performs every later evaluation, and renews the attestation report.

HOW WE HELP

How CyberCrest's HIPAA Compliance Consultants Work with Your Team

In a HIPAA cybersecurity consulting engagement with CyberCrest, the program stays yours from the first call to each later evaluation: your team decides, writes, and implements, and CyberCrest's consultants guide, specify, and review.

Kickoff and Environment Walkthrough

The engagement opens with a project kickoff call that aligns both sides on the objectives, the timeline, and the approach. An environment overview follows: a walkthrough of the IT systems and the systems holding ePHI that will be in scope. CyberCrest can begin immediately.

Hands-On with Your IT Team

When the assessment finds a safeguard missing, one of CyberCrest's consultants works alongside your engineers as they implement it. The consultant explains what the Security Rule expects of each safeguard and what evidence it should leave.

Your Documents, Reviewed Against the Rule

Your team writes the policies and procedures, the risk management plan, and a record of each addressable decision. You implement an addressable Security Rule specification if it is reasonable and appropriate in your environment; if not, you document why and implement an equivalent alternative where one would be. CyberCrest sets out what each document must cover and reviews the drafts.

Secure Channels for Your Evidence

Evidence for HIPAA describes your environment and can contain sensitive data. Your team captures and stores it, then shares it with CyberCrest over secured communication channels for review.

DELIVERABLES

What You Receive from a HIPAA Engagement

When you compare HIPAA compliance service providers, ask each one which documents it will hand over. CyberCrest writes four: a HIPAA risk analysis report, a gap assessment with a remediation roadmap, written review findings on your policies and plans, and a HIPAA attestation report. The policies, procedures, and plans themselves are written by your team.

HIPAA Risk Analysis Report

CyberCrest's written assessment of the potential risks and vulnerabilities to your ePHI, covering all the ePHI your team identified. It is written to the Security Rule's risk analysis requirement, and the rest of the engagement is planned from it.

Gap Assessment and Remediation Roadmap

The gaps between your safeguards and the Security Rule, each with the provision it falls under, in a recommended order for closing them. The roadmap is CyberCrest's recommendation; the decisions and the fixes stay with your team.

Review Findings on Your Documents

CyberCrest's written findings on the policies, procedures, and plans your team wrote: what each document must cover under the rule, and where a draft falls short. Your team revises the drafts against them.

HIPAA Attestation Report

CyberCrest's written result of the Security Rule evaluation, showing how your safeguards and documentation measure against the rule. You can share it with customers and partners who ask for proof of your HIPAA program. It is not a certification.

Achieve HIPAA Compliance with CyberCrest

One call with CyberCrest's HIPAA compliance experts helps you work out whether you are a covered entity or a business associate, and which HIPAA rules apply to you. The scope stays yours to set, and nothing is committed at that stage.

TALK TO AN EXPERT

WHY US

Why Choose CyberCrest?

CyberCrest works in one defined role on HIPAA engagements and holds credentials in the frameworks around HIPAA. When you choose a HIPAA compliance partner, ask what the firm will do and what stays with your team.

A Defined Role on Every Engagement

The kickoff call sets out the approach: CyberCrest assesses, guides, reviews, and issues the attestation report, while your team keeps the decisions, the writing, and the implementation.

Credentials Across Frameworks

CyberCrest is an Authorized External Assessor Organization for HITRUST, a PCI DSS Qualified Security Assessor Company, and a CMMC Registered Practitioner Organization. Its consultants hold individual credentials including the HITRUST Certified Common Security Framework Practitioner (CCSFP) and Certified HITRUST Quality Professional (CHQP); PCI Qualified Security Assessor (QSA); and ISO 27001, 27017, 27018, and 42001 Certified Lead Auditor.

A Track Record Across Industries

CyberCrest's record covers over 100 client engagements across multiple industries, for clients in the United States, Canada, Europe, and APAC. The firm is based in Encinitas, California.

Tech-Enabled, Secure by Design

CyberCrest is tech-enabled: it uses secure tools and processes for the client information it handles. That matters on a HIPAA engagement, where the evidence your team shares for review can describe the systems that hold ePHI.

TESTIMONIALS

Hear from Our Clients

I have worked with CyberCrest on multiple compliance engagements over the past several years including HITRUST, NIS 2 and ISO 27001. Without exception, CyberCrest has consistently exceeded expectations for my clients through a combination of highly experienced consultants, and a practical approach to achieving compliance. They are willing to roll up their sleeves and help organizations fully understand and address their compliance challenges, not just function as external auditors.

Paul Lucidi

—

Founder and President, CyberAge Consulting LLC

“I have used the CyberCrest team for a variety of critical information security compliance engagements over the years including successfully attaining ISO 27001 and HITRUST certifications. All of our engagements have exceeded expectations!”

Craig Guinasso

—

Senior Director, Technology & CyberSecurity, Alector

"We have worked with CyberCrest on multiple penetration testing and cybersecurity risk and maturity assessments. The CyberCrest team has consistently produced high quality deliverables at fair prices. We give their client prospects our strongest recommendation."

David Wise

—

Managing Partner, Aberdeen Advisors

ABOUT HIPAA

About HIPAA

HIPAA governs protected health information (PHI), meaning individually identifiable health information in any form or medium. The law is the Health Insurance Portability and Accountability Act of 1996, and HHS issued the HIPAA regulations under it. HHS enforces three HIPAA rules that bind covered entities and their business associates:

The HIPAA Privacy Rule (45 CFR Part 164, Subpart E) sets which uses and disclosures of PHI are permitted or required.
The Security Rule (Subpart C) requires administrative safeguards, such as the risk analysis and employee training, alongside physical safeguards and technical safeguards for ePHI. It lets each organization choose reasonable and appropriate security measures, weighed by its size, capabilities, technical infrastructure, costs, and the probability and criticality of its risks.
The Breach Notification Rule (Subpart D) requires a covered entity to notify the affected individuals after a breach of unsecured PHI, without unreasonable delay and in no case later than 60 calendar days after discovery.

HOW COMPLIANCE IS CHECKED

Is There a HIPAA Certification? How Compliance Is Actually Checked

No Security Rule standard requires you to certify compliance, and HHS does not recognize a Security Rule "certification" from any HIPAA compliance firm. What gets checked is your own record.

The Risk Analysis Comes First

The HHS Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security, and Breach Notification Rules and runs a Risk Analysis Initiative. Its Director calls an accurate and thorough risk analysis that informs a risk management plan "a foundational step to mitigate or prevent cyberattacks and breaches." In the four ransomware data breaches OCR settled in April 2026, each entity had failed to conduct such an analysis. BST & Co. CPAs, an accounting firm and business associate, paid $175,000 to OCR in 2025 to settle an investigation that found the same failure.

The Evaluation Standard

The Security Rule requires a periodic technical and nontechnical evaluation that establishes the extent to which your security policies and procedures meet its requirements (45 CFR 164.308(a)(8)). HHS says the evaluation can be performed internally or by an external organization. Asked whether an organization must certify its HIPAA Security Rule compliance, HHS answers no, and it does not endorse or otherwise recognize private "certifications."

Twelve Months of Recognized Security Practices

Section 13412 of the Health Information Technology for Economic and Clinical Health (HITECH) Act, added in January 2021, requires HHS to consider whether a covered entity or business associate has adequately demonstrated that it had recognized security practices in place for at least the previous 12 months. It applies to three HHS decisions: fines, ending a HIPAA audit early and favorably, and settlement remedies. The practices themselves stay voluntary.

Six Years of Documentation

The Security Rule requires you to keep its documentation for 6 years from the date it was created or the date it was last in effect, whichever is later. That covers the policies and procedures and every action, activity, or assessment the rule requires to be documented, and the documentation must be available to the people responsible for implementing it.

WHO IT APPLIES TO

Who Needs HIPAA Compliance Services

HIPAA follows the data: it binds covered entities and the vendors they share PHI with (45 CFR 160.103). Before you choose a HIPAA compliance company or answer a customer's security questionnaire, work out which role HIPAA gives you.

Covered Entities

Health plans, healthcare clearinghouses, and healthcare providers that transmit any health information in electronic form in connection with a transaction covered by the HIPAA rules, such as a claim sent to a health plan. The guide to covered entities under HIPAA walks through each category.

Business Associates

A business associate creates, receives, maintains, or transmits PHI on a covered entity's behalf, or provides services such as legal, accounting, or consulting that involve PHI. HHS's cloud computing guidance says a cloud provider that stores ePHI is one, even when it holds only encrypted data and no decryption key. Under the Breach Notification Rule (45 CFR 164.410), if a breach occurs involving unsecured PHI, you must notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovery.

Subcontractors

A business associate's own vendors are business associates too when they create, receive, maintain, or transmit PHI on its behalf. HIPAA requires the business associate to have a written agreement with each such subcontractor (45 CFR 164.502(e) and 164.308(b)), meeting the same requirements as the agreement a covered entity has with it.

Frequently asked questions

How much does it cost to become HIPAA compliant?

There is no fixed price, because the cost depends on your side of the work. It turns on how many systems handle ePHI, how many safeguards and documents are already in place, whether you need ongoing support after the first evaluation, and whether CyberCrest performs the evaluation and issues an attestation report. A scoping call is how you get to a number. CyberCrest's guide to HIPAA compliance cost breaks down the budget lines.

Who manages HIPAA compliance?

Your own organization does. Every covered entity and business associate must identify a security official responsible for its Security Rule policies and procedures, and a covered entity must also designate a privacy official (45 CFR 164.308(a)(2) and 164.530(a)(1)). An outside HIPAA consultant guides, specifies, and reviews; the program and the decisions stay with your team.

What is the main purpose of a HIPAA risk assessment?

It identifies the risks and vulnerabilities to the confidentiality, integrity, and availability of your ePHI, so that data security measures go where the exposure is. The Security Rule requires it to be accurate and thorough. OCR's recommendation is to "periodically conduct, and update as needed, a risk analysis and develop and implement a risk management plan." A new system that holds sensitive health information is one reason to update it.

What are the penalties for HIPAA violations?

HHS sets civil money penalties in four tiers by culpability, from violations the organization could not have known of with reasonable diligence to willful neglect not corrected within 30 days, with a calendar-year cap for identical violations (45 CFR 160.404). The amounts are adjusted for inflation each year in 45 CFR part 102. Noncompliance can also end in a settlement with a corrective action plan monitored by OCR. CyberCrest's guide to HIPAA fines and penalties covers the figures.

What is the difference between HIPAA and HITRUST?

HIPAA is federal law: its Privacy, Security, and Breach Notification Rules bind covered entities and business associates, and OCR enforces them. HITRUST is a security framework with its own certification: an organization goes through a validated assessment, which is submitted to HITRUST for certification. The HITRUST vs HIPAA comparison covers the two in depth.

How do you prepare for a HIPAA compliance audit?

Start from what the Security Rule requires: a documented, current risk analysis, the security measures that reduce the risks it found, written policies and procedures, and regular review of information system activity records. A gap assessment against the Security Rule shows what is missing. CyberCrest checks beforehand that your documentation and evidence are ready; the answers to OCR, or to an assessor your customer sends, stay with your team.

What is the new HIPAA rule in 2026?

No final rule has replaced the current Security Rule. HHS proposed changes on December 27, 2024 (published in the Federal Register on January 6, 2025) and says the current rule remains in effect during the rulemaking. One HIPAA rule is new in 2026: on May 26, an HHS final rule that adopts standards for claims attachments transactions and electronic signatures took effect, with compliance required by May 26, 2028.

Compliance and Data Privacy

Technical Services

Company

Contact

HIPAA Compliance Services

Our HIPAA Compliance Methodology