Healthcare Security & HIPAA
Altiri helps healthcare organizations and business associates assess security risks, put improvements into practice, and maintain an ongoing security program. Engagements can include HIPAA Security Rule risk analysis, broader cybersecurity risk assessment aligned with the NIST Cybersecurity Framework, policy development, remediation leadership, workforce training, and continuing management oversight.
Discuss your needsHealthcare experience
Patrick Parker’s background includes serving as vCISO / Director of Information Security at Mount Sinai Medical Center. He has also led formal HIPAA security risk assessments for several major hospitals and healthcare organizations.
Scope & deliverables
An engagement can begin with a focused baseline and continue into implementation and program support.
Conduct an accurate and thorough analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information across the organization.
Assess broader cybersecurity risks and current practices using the NIST Cybersecurity Framework. Connect identified gaps with business priorities and a practical improvement plan.
Connect policy requirements with the way staff, IT, and providers carry out their responsibilities.
Coordinate follow-up and provide management with visibility into open risks and decisions.
Support training arrangements and reinforce the practices staff need to apply.
Recognized security practices
Many healthcare organizations already operate substantial security controls but lack a clear record connecting those practices to a recognized framework. Altiri assesses existing practices against the NIST CSF, organizes available evidence of how long they have operated, and identifies gaps requiring remediation.
This process helps demonstrate the organization’s efforts to implement reasonable and appropriate safeguards for electronic protected health information. For newly implemented practices, it also establishes a documented starting point for demonstrating sustained operation.
Framework mapping alone does not establish that practices were implemented or effective. Any consideration by OCR depends on the organization’s actual practices, supporting evidence, and applicable circumstances.
Under federal law, HHS must consider adequately demonstrated recognized security practices in place for the prior 12 months in certain HIPAA Security Rule enforcement and audit activities. This may mitigate fines or remedies and reduce the length or extent of an audit. An assessment or framework alignment alone does not establish that history, guarantee a favorable outcome, or provide immunity from HIPAA obligations.
HHS guidance on recognized security practices ↗Training as part of the program
Altiri’s HIPAA training application can support delivery. The engagement should also establish who assigns training, follows up on completion, and answers questions about local procedures.
Identify the groups needing training, the timing, and relevant organizational procedures.
Assign the course and use completion information to identify follow-up work.
Connect the learning to reporting concerns, handling information, and using approved tools.
Before we begin
Yes. A defined HIPAA risk analysis or broader NIST CSF assessment can be scoped as a project, with an option to continue into remediation and ongoing program leadership.
Yes. The scope can include risk follow-through, policy maintenance, workforce education, and recurring management reviews.
Yes. We can include governance questions around approved tools, sensitive information, vendor review, and human oversight. Specialized clinical or technical evaluation is separately scoped.
The HHS Security Rule resource explains the rule and links to supporting guidance.
Tell us what needs attention, who is involved, and where you need support. We’ll explore an appropriate scope and working relationship.
Altiri