How an audit works — without disrupting patients
Four phases, a mix of onsite and remote work, and no planned downtime for your clinic. Here's what to expect from start to finish.
Phase 1 — Scoping & kickoff
A short call with the practice manager to list locations, systems (EHR, practice management, imaging, phones, Wi-Fi), vendors and existing policies. We agree on dates and sign an NDA, plus a Business Associate Agreement where the engagement calls for one.
Phase 2 — Technical review
Non-disruptive scans of the network and endpoints, review of firewall, backup, encryption, access and logging settings, and a walkthrough of the office. Scans are scheduled around clinic hours so patient appointments and systems keep running — no planned downtime.
Phase 3 — Workflow & vendor interviews
Brief conversations with front desk, clinical and billing staff about how data moves day to day, plus a check of Business Associate Agreements with your cloud and IT vendors. We look at controls and processes, not at patient records.
Phase 4 — Findings & roadmap
We walk the practice owner through what we found, ranked by risk, and agree on a realistic order of fixes.
What your clinic gets at the end
- A written risk assessment report mapped to the HIPAA Security Rule safeguards
- A prioritized remediation roadmap (what to fix first, and why)
- A plain-language executive summary for owners and physicians
- Notes on Texas HB 300 items such as staff training records
- Documentation you can keep on file as evidence of your risk analysis
There is no such thing as an official "HIPAA certification," and no audit can guarantee an outcome with regulators. An audit shows where you stand and what to improve.