HIPAA Compliance Services

The experts at Compass IT Compliance have vast experience working with some of the country's top healthcare facilities, helping identify gaps in protection and the steps needed to comply with HIPAA regulations. Our professionals have the necessary resources and knowledge to review your organization's existing security program from top to bottom and establish the required parameters to achieve compliance.

Get Started
HIPAA Compliance
Scroll
Trusted by 1,000+ customers nationwide

What is HIPAA? What is HITECH?

Congress passed the Health Insurance Portability and Accountability Act (HIPAA) in 1996 to reduce health care fraud and abuse, mandate industry-wide standards for healthcare information on electronic billing and require protection and confidential handling of protected health information. HIPAA was strengthened in 2009 by the Health Information Technology for Economic and Clinical Health (HITECH) Act. HITECH addresses the privacy and security concerns associated with the electronic transmission of health information, partly through several provisions that strengthen the civil and criminal enforcement of the HIPAA rules.

A HIPAA violation occurs when a patient's protected health information (PHI) falls into the wrong hands — willfully or inadvertently — without the patient's consent. HIPAA compliance is critical for companies operating in the healthcare sector because of the sensitive nature of the information involved and the potential punishments resulting from the violations. These violations may carry massive fines and cause irreparable damage to brand reputation and patient trust.

HIPAA Security Risk Assessments and Other IT Compliance Services We Offer

Compass IT Compliance has built a remarkable track record over the past decade, forging strong collaborations with healthcare providers and their partners to ensure full compliance with the stringent regulations of the HIPAA Security Rule and Privacy Rule as well as the HITECH Act. Our specialized reports have proven invaluable in identifying and addressing control gaps, significantly reducing the risk of HIPAA violations and data breaches. These meticulously crafted reports serve as a solid foundation for organizations that deal with protected health information, offering essential insights to establish and maintain robust compliance levels. Some of the services we provide include:

“We initially chose Compass to help us with our PCI and HIPAA compliances. As we grew, Compass expanded its services to become a true partner in ensuring that our service provides the security that our clients expect”
 
Chief Information Security Officer
Usablenet

HIPAA Risk Assessments

Assess your current level of compliance with HIPAA and HITECH, identify the flow of protected health information (PHI), identify gaps in controls, and identify key work areas that your organization must address to achieve and/or maintain compliance with the regulation.
HIPAA Risk Assessments

HIPAA Compliance Audits

Verify compliance with HIPAA's Privacy Rule and Security Rules and identify gaps in current controls meant to safeguard protected health information (PHI). The audit is a deeper dive and will require the auditors to see more evidence than would be required in a risk assessment.
HIPAA Compliance Audits

MACRA / MIPS Risk Assessments

Ensure compliance with the Medicare Access and CHIP Reauthorization Act (MACRA) and Merit Based Incentive Payments System (MIPS) requirements to qualify for the Medicaid and Medicare electronic health record (EHR) financial incentive program.
MACRA / MIPS Risk Assessments

HIPAA Training Programs

Leverage our HIPAA security awareness training platform to educate your staff on the importance of HIPAA protections and cybersecurity principles, including the definition of protected health information (PHI), the dangers of ransomware, and how to spot a phishing email.
HIPAA Training Programs

HIPAA Compliance Frequently Asked Questions

Who needs to be HIPAA compliant?

Any organization or individual that handles protected health information (PHI) must comply with the Health Insurance Portability and Accountability Act (HIPAA). This includes covered entities like healthcare providers, health plans, and healthcare clearinghouses, as well as business associates—third-party vendors or contractors that process, store, or transmit PHI on behalf of covered entities. Compliance ensures the confidentiality, integrity, and availability of PHI and applies to both physical and digital records.

What is considered a HIPAA violation?

A HIPAA violation occurs when there is a failure to protect PHI as required by HIPAA’s Privacy, Security, or Breach Notification Rules. This includes unauthorized access, use, or disclosure of PHI, lack of proper safeguards (like encryption or access controls), failure to conduct risk assessments, or neglecting to provide timely breach notifications. Violations can result from intentional misconduct, such as snooping into patient records, or unintentional errors, like emailing PHI to the wrong recipient. Penalties for violations range from fines to criminal charges, depending on the severity and intent.

Do HIPAA rules apply to de-identified health information?

No, HIPAA rules do not apply to de-identified health information. If all personal identifiers that could link the data to an individual are removed in accordance with HIPAA’s de-identification standards, the information is no longer considered protected health information (PHI) and is not subject to HIPAA regulations. This allows such data to be used for research, analysis, or other purposes without the need for compliance, as long as the de-identification process meets HIPAA's strict guidelines.

Related Resources

Educational content and resources related to our HIPAA compliance services:

HIPAA Blog Posts
Blog

HIPAA Blog Posts

Ransomware Webinar
Video

Ransomware Webinar

Company Overview
Datasheet

Company Overview

Browse Open Positions
Careers

Browse Open Positions

Ready to Get a Quote?

Learn More About Our HIPAA Services Today

Let Compass IT Compliance assist your organization in assessing potential risks through our HIPAA services so you can secure your protected health information (PHI) data environment, comply with regulatory compliance requirements and save time, money and resources. We understand the importance of protecting electronic protected health information (ePHI) and the challenges of implementing HIPAA-compliant security measures into your daily business practices. Contact us online today to discuss your unique situation.