Compliance-ready IT

The controls regulators ask about, documented before they ask.

Dental and medical practices, CPA firms, tax preparers, mortgage brokers and auto dealers all hold data covered by the HIPAA Security Rule or the FTC Safeguards Rule. We run the technical controls and keep the evidence, so a review or an incident does not start with a scramble. We are not lawyers; your counsel decides how the rules apply to you.

Section 1

Threat Briefing

HHS OCR is enforcing the requirement to perform a risk analysis. In August 2025 BST & Co. CPAs, a business associate hit by ransomware, paid $175,000; HHS called it the tenth action under its Risk Analysis Initiative and the fifteenth ransomware enforcement action. (HHS)

Earlier actions under the same initiative include Health Fitness Corporation ($227,816) and Northeast Radiology ($350,000, a breach affecting 298,532 patients). (HHS; HHS)

Since May 13, 2024, FTC Safeguards Rule businesses must notify the FTC of a notification event involving 500 or more consumers no later than 30 days after discovery. (FTC; Federal Register)

HIPAA breaches require notice to affected individuals within 60 days of discovery, with notice to HHS and, when more than 500 residents of a state or jurisdiction are affected, to prominent media outlets. (HHS)

HHS proposed a HIPAA Security Rule update in January 2025 that would require MFA and the ability to restore critical systems within 72 hours. It is still a proposal, with a final rule now targeted for July 2027 on the federal regulatory agenda; the current rule remains in force. (Federal Register; Unified Agenda)

Section 2

Risk and Compliance Matrix

Exposure	Framework or rule it maps to	What it costs you
No current written risk analysis	HIPAA 45 CFR 164.308(a)(1)(ii)(A); FTC Safeguards 16 CFR 314.4(b)	The most common basis for recent OCR settlements
No designated person in charge of the security program	FTC Safeguards 16 CFR 314.4(a) qualified individual; HIPAA 164.308(a)(2)	No one accountable when an examiner or incident arrives
Vendors with access to client or patient data and no agreement	HIPAA business associate agreements, 164.308(b); FTC Safeguards 16 CFR 314.4(f) service providers	Liability for a breach that happened at someone else’s firm
No incident plan with notification deadlines	FTC Safeguards 16 CFR 314.4(h) and the 30-day FTC notice; HIPAA Breach Notification Rule 60-day notice	Missed deadlines on top of the breach itself

Section 3

Architecture and Remediation Directives

Complete a written risk analysis at onboarding and every year, built from a real inventory of devices, accounts, applications and data locations.
Name the responsible person in writing. Where that is your office manager or owner, we provide the technical reporting they need.
Turn on MFA for every account that touches covered data, encrypt laptops and phones, and log access to shared drives and practice or tax software.
Keep a vendor list with the agreement status for each vendor that stores or can reach client or patient data.
Write an incident response plan that names who calls whom, who preserves evidence and who files the HHS or FTC notice, with the deadlines on the first page.
Keep a dated evidence folder: risk analysis, policies, MFA and patch reports, backup tests and training records.

Section 4

Vendor-Neutral Verification Checklist

Three tests that work against any provider, including us. Run them before you sign anything.

Find the date on your most recent written risk analysis. If you cannot produce one from the last 12 months, that is the first gap to close.
List every outside company that stores or can access client or patient data, and check that you have a signed business associate agreement or contract with security terms for each.
Open your incident plan and look for the 30-day FTC or 60-day HIPAA notification deadline and a named owner. If either is missing, the plan is not finished.

FAQ

Frequently asked questions

Will working with you make us compliant?

Compliance belongs to your organization. We put the technical safeguards in place, document them and give you evidence for audits, and we are clear about which tasks remain yours, such as policies only management can approve.

Will you sign a business associate agreement?

Where our work involves access to protected health information, a business associate agreement is part of the engagement. We review its terms with you before onboarding.

Which rules do you work with?

Most often the HIPAA Security Rule and the FTC Safeguards Rule. For clients outside the United States we map the same controls to local privacy laws such as UK GDPR, the EU GDPR, PIPEDA, the Australian Privacy Act and POPIA, and we involve your legal adviser where interpretation is needed.

How often should a risk analysis be done?

HHS expects it to be accurate and current, and regulators look for regular updates and after major changes. We schedule a review at least once a year and when something significant changes.

Can you help with a client or insurer security questionnaire?

Yes. We answer with evidence from your environment and flag any gap honestly.

How we package it