HIPAA Consulting

HIPAA compliance consulting for companies that sell to US healthcare

HIPAA is a US federal law, set out in 45 CFR Parts 160 and 164 and enforced by the HHS Office for Civil Rights, that applies to covered entities and to every business associate that creates, receives, maintains or transmits protected health information (PHI) for them. HHS recognizes no HIPAA certification, so a healthcare buyer judges a vendor on the risk analysis, the policies, the signed business associate agreement and the evidence behind them. Truvo Cyber's HIPAA consultants build that program and keep the program current. Our HIPAA compliance services cover:

  • PHI and ePHI scoping and business associate determination
  • Security Rule risk analysis and risk management plan
  • Security Program Manual, HIPAA policies and procedures
  • Business associate agreements with customers and vendors
  • Breach notification readiness and ongoing HIPAA upkeep
Book a HIPAA strategy call
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. CISSP, CCSP. Leads every HIPAA engagement.

Connect on LinkedIn

HIPAA compliance services: what's included

One named security lead for the whole engagement, backed by GRC analysts who write and maintain the evidence.

icon-8

PHI scoping and business associate determination

We map every system, vendor and workflow that creates, receives, maintains or transmits PHI, from the application database to backups, logs, support tools and analytics. The map decides which systems are in HIPAA scope and confirms whether the company is a business associate under 45 CFR 160.103.

icon-7

Security Rule risk analysis

The accurate and thorough assessment of risks to ePHI that 45 CFR 164.308(a)(1)(ii)(A) requires, scored once across HIPAA and any SOC 2 or ISO 27001 scope, with a risk management plan that names an owner and a date for each item.

icon-9

Security Program Manual and HIPAA policies

Policies and procedures for the administrative, physical and technical safeguards in 45 CFR 164.308, 164.310 and 164.312, a named security official, and a documentation rule that keeps records for six years under 164.316(b)(2)(i).

icon-6

Business associate agreements and vendor management

A BAA template for healthcare customers, signed BAAs from each subcontractor that can reach ePHI, and BAA terms checked against 45 CFR 164.314(a): Security Rule obligations, flow-down to subcontractors and incident reporting.

icon-5

Breach notification and incident response readiness

An incident response plan that carries the Breach Notification Rule limits and the shorter deadlines healthcare customers write into their BAAs, tested with a tabletop exercise before a real incident.

icon-4

Evidence for healthcare buyers and auditors

Answers to healthcare security questionnaires from one evidence set, the periodic evaluation 45 CFR 164.308(a)(8) requires, and coordination with the CPA firm when customers ask for a SOC 2 report with HIPAA criteria.

Services often paired with HIPAA consulting

Added under the same lead when healthcare customers ask for more.

icon-5

HIPAA and HITRUST Accelerator

A fixed-price, fixed-scope package for HIPAA readiness and HITRUST e1, i1 or r2 preparation, with assessor coordination.

icon-2

SOC 2 compliance

One program that produces the SOC 2 report healthcare buyers ask for, with HIPAA criteria tested in the same audit.

icon-6

Security questionnaire and trust center services

Healthcare security questionnaires and due diligence questionnaires answered and packaged with policies, reports and the sub-processor list.

icon-1

Virtual CISO (vCISO) services

A named security lead who owns the program across HIPAA, SOC 2 and ISO 27001 after the build.

How our HIPAA consulting works: Assess, Build, Operate

Security capabilities first. HIPAA compliance is the record those capabilities produce.

01

Assess

Capability assessment across the security capabilities, PHI and ePHI scoping, and the Security Rule risk analysis. Output: a scoped ePHI inventory, a risk register and a gap list against the Privacy, Security and Breach Notification Rules, each gap with an owner and a date.

02

Build

Security Program Manual, then the policies, controls and evidence each safeguard needs, with BAAs in place for customers and vendors. Output: a policy set mapped to HIPAA sections and to SOC 2 or ISO 27001 where they apply, and evidence collected in your GRC platform.

03

Operate

Keep the program current: access reviews, log review, workforce training, vendor BAAs, risk analysis updates after major changes, the periodic evaluation and answers to every new healthcare security review.

HIPAA Privacy, Security and Breach Notification Rules: what each one asks of a business associate

HIPAA's three rules are in 45 CFR Part 164. The Security Rule covers ePHI, the Privacy Rule covers how PHI is used and disclosed, and the Breach Notification Rule covers what happens after a breach.

HIPAA Security Rule (45 CFR Part 164, Subpart C)

  • Applies to: Electronic PHI that the company creates, receives, maintains or transmits.

  • Safeguards: Administrative (164.308), physical (164.310) and technical (164.312).

  • Core documents: A risk analysis, a risk management plan, a named security official and a periodic evaluation.

  • Records: Policies, procedures and records of required actions kept for six years (164.316).

HIPAA Privacy Rule (45 CFR Part 164, Subpart E)

  • Business associate duties: Use and disclose PHI only as the business associate agreement permits.

  • Minimum necessary: Limit each use, disclosure and request to the minimum PHI needed for the purpose.

  • Covered entity duties: Notices of privacy practices, patient rights and a designated privacy official.

  • Forms of PHI covered: PHI in every form: electronic, paper and spoken.

HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D)

  • Business associate: Notifies the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach (164.410(b)).

  • Covered entity: Notifies affected individuals, HHS and, for larger breaches, the media.

  • BAA deadlines: Healthcare customers often set a shorter reporting deadline in the BAA.

  • Plan: The incident response plan carries both the legal limit and the contract deadline.

HIPAA consultant, HHS OCR, auditors and your team

  • Truvo Cyber (HIPAA consultant): Scopes, builds and maintains the program and prepares the evidence buyers ask for.

  • HHS Office for Civil Rights: Enforces HIPAA through complaint investigations, compliance reviews and audits.

  • CPA firm or HITRUST assessor: Gives customers independent assurance through a SOC 2 report with HIPAA criteria or a HITRUST assessment.

  • Your security official: The named person 45 CFR 164.308(a)(2) requires, responsible for the security policies and procedures.

One security program for HIPAA, SOC 2 and ISO 27001: what carries over and what HIPAA adds

SOC 2, ISO 27001 and HIPAA test the same security capabilities. SOC 2 and ISO 27001 are frameworks a company chooses. HIPAA is law once PHI is in scope. One program, documented three ways, avoids three policy sets and three evidence calendars.

Controls shared by HIPAA, SOC 2 and ISO 27001

  • Risk: Risk assessment and risk treatment, scored once for all three.

  • Access: Unique user IDs, access authorization and periodic access reviews.

  • Operations: Logging and log review, incident response, backup and recovery testing.

  • Vendors: One vendor list for SOC 2 vendor risk management and HIPAA BAAs.

What HIPAA adds to a SOC 2 or ISO 27001 program

  • Risk analysis: Scoped to every system that stores or processes ePHI, including backups and logs.

  • Contracts: A BAA with each healthcare customer and each subcontractor that can reach ePHI.

  • People and records: One named security official and six-year retention of HIPAA records.

  • Breach: The 60-day business associate notification limit in the incident response plan.

How the audits combine for HIPAA, SOC 2 and ISO 27001

  • SOC 2 with HIPAA: One CPA firm can test HIPAA Security Rule requirements as additional criteria in the SOC 2 examination.

  • ISO 27001: Audit firms that are also accredited certification bodies can perform ISO 27001 fieldwork alongside SOC 2.

  • HIPAA itself: No certificate and no audit date: the company documents compliance continuously.

  • Evidence reuse: An audit firm we work with estimates about 70% of HIPAA evidence carries over from a SOC 2 program.

HIPAA documentation: what you hold after the Build phase

Written for healthcare buyers and auditors, and owned by your company.

Book a strategy call

  • PHI and ePHI inventory with data flows

  • Security Rule risk analysis and risk plan

  • Security Program Manual and HIPAA policies

  • BAA template and signed vendor BAAs

  • Incident response and breach notification plan

  • Evidence mapped to HIPAA, SOC 2 and ISO 27001

What changes in the first 90 days of HIPAA consulting

HIPAA turns from a contract clause into a program with an owner and a calendar.

The ePHI boundary is drawn

Every system, vendor and workflow that touches PHI is listed, and systems that need no PHI, such as logs and support tickets, are taken out of scope.

The BAA question has an answer

Your team can sign a healthcare customer's BAA knowing the program meets the terms, and the subcontractor BAAs behind the agreement are in place.

Security reviews close faster

Healthcare security questionnaires are answered from one evidence set, with the risk analysis and policies ready on the first request.

HIPAA has a named owner

A security official holds the program, with access reviews, training, evaluations and risk analysis updates on a calendar.

Who our HIPAA consulting service is for

If another type of firm suits you better, we tell you on the strategy call.

Good fit if any of these apply

  • A hospital, clinic, payer or health-tech customer has asked you to sign a business associate agreement

  • Your product stores or processes ePHI, including encrypted ePHI, for a covered entity or another business associate

  • A healthcare buyer's security review asks for your HIPAA risk analysis and policies

  • Your company holds SOC 2 or ISO 27001 and wants the same controls to cover HIPAA

  • HIPAA compliance currently depends on one engineer or the CTO, with no named security official

  • Your company is outside the US and handles PHI for US healthcare customers

Better fit elsewhere

  • You want a fixed-price, fixed-scope package with HITRUST preparation: the HIPAA and HITRUST Accelerator fits that request

  • You need an independent audit report: a CPA firm issues a SOC 2 report with HIPAA criteria, and a HITRUST assessor performs HITRUST assessments

Frequently asked questions about HIPAA compliance consulting

A HIPAA compliance consultant builds and maintains the program a company needs to meet the HIPAA Privacy, Security and Breach Notification Rules. The work covers PHI scoping, the Security Rule risk analysis, policies and procedures, business associate agreements, breach notification readiness and the evidence healthcare buyers ask for. Truvo Cyber also keeps the program current after the build, because HIPAA applies for as long as the company handles PHI.

HHS states that no Security Rule standard requires certification, and HHS does not endorse or recognize private HIPAA certifications. A company shows HIPAA compliance with a risk analysis, policies, a periodic evaluation under 45 CFR 164.308(a)(8) and signed BAAs. Customers who want independent assurance ask for a SOC 2 report with HIPAA criteria or a HITRUST assessment.

HIPAA applies to a vendor that creates, receives, maintains or transmits PHI on behalf of a covered entity or another business associate. 45 CFR 160.103 defines that vendor as a business associate, and the definition includes subcontractors of business associates. HHS cloud computing guidance adds that a provider storing only encrypted ePHI without the key is still a business associate.

HIPAA consulting is an ongoing service: Truvo Cyber builds the program and then keeps the program current, with a scope set by your customers and systems. The HIPAA and HITRUST Accelerator is a fixed-price package with fixed deliverables, including HITRUST e1, i1 or r2 scoping and assessor coordination. Many companies start with the Accelerator and move to ongoing consulting after the build.

One audit firm can cover SOC 2 and HIPAA in the same engagement, either as a SOC 2 report with HIPAA as additional criteria or as a SOC 2 report with a separate HIPAA attestation built on the same evidence. Firms that are also accredited ISO 27001 certification bodies can add ISO 27001 to the same fieldwork. HIPAA itself has no certificate, so the company still owns the risk analysis and BAAs.

Companies handle the overlap by building one security program and mapping each control to every framework the control satisfies. A quarterly access review, for example, counts for HIPAA 164.308(a)(4), SOC 2 CC6.2 and ISO 27001 access control with one dated record. HIPAA then adds an ePHI-scoped risk analysis, BAAs, a named security official, the 60-day breach limit and six-year record retention.

The Security Rule requires an accurate and thorough risk analysis and ongoing risk management, and 45 CFR 164.308(a)(8) requires a periodic evaluation, including after environmental or operational changes that affect ePHI. Truvo Cyber updates the risk analysis on a set calendar and after major changes, such as a new cloud provider, a new product that handles PHI or a merger.

Under 45 CFR 164.410(b), a business associate notifies the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. Many healthcare customers write a shorter deadline into the BAA, so the incident response plan carries both.

HHS published a proposed update to the HIPAA Security Rule in the Federal Register in January 2025 (RIN 0945-AA22). As of October 2026 the Federal Register shows no final rule, so the current text of 45 CFR Part 164 Subpart C applies. Truvo Cyber tracks the rulemaking and maps any final requirements into existing programs.

HIPAA applies based on the data and the relationship, wherever a company is based. A Canadian or other non-US company that handles PHI for a US covered entity or business associate is a business associate and needs a HIPAA program and a BAA. Truvo Cyber's consultants are in Canada and the United States and work with healthcare vendors in both countries by video and screen share.

Bring your BAA and your latest healthcare security review

Book a 30-minute strategy call. Share the BAA or security questionnaire a healthcare customer sent you, and we walk through your PHI scope, where your program stands and what we would take on first.

From the blog: SOC 2, HIPAA and multi-framework compliance

Accountant reviewing audit documents at a desk, illustrating SOC 2 audit firms in Canada

SOC 2 Audit Firms in Canada (2026): How to Choose a SOC 2 Auditor

A SOC 2 report must be issued by a licensed CPA firm, and Canadian companies can choose either a Canadian firm reporting under CSAE 3000 or a US firm ...

Learn More
Close-up of server racks in a data center highlighting modern technology infrastructure, illustrating SOC 2 vs HIPAA: What Overlaps and What HIPAA Adds

SOC 2 vs HIPAA: What Overlaps and What HIPAA Adds

SOC 2 and HIPAA test most of the same security controls, so a company that handles health data for healthcare customers can run one security program ...

Learn More
Modern control room with people monitoring large digital displays and computer systems, illustrating Agentic AI Security Architecture: How to Let AI Agents Do Real Work Safely

Railway Security Incident (October 2026): What to Do, and What SOC 2, ISO 27001, GDPR and HIPAA Require

On October 21, 2026, Railway disclosed that an unauthorized third party may have accessed the encrypted environment variables of its customers and, ...

Learn More