Fortenza (@Fortenza)

Many healthcare providers got into the business to help people, whether it's medical, dental, mental health, etc. They didn't really sign up for all the compliance, security, and privacy regulations that go with that. HIPAA, in particular, is a pretty daunting set of regulations that few people fully understand beyond the privacy basics. One of the biggest and most important unknowns is how to conduct the required risk analysis. Many healthcare providers have to outsource this task to 3rd party professionals, but how do you know which ones truly understand the regulations when they all claim to be "experts?" As someone who was contracted by the US Dept of HHS' Office for Civil Rights (OCR) as their subject matter expert to help enforce the HIPAA regulations, advise their legal teams, train their lawyers, and make determinations on whether risk analyses and other evidence satisfied the regulations, I got to see, first hand, how those investigations are conducted and why some entities seem to get a free pass while others are hit with civil money penalties and sanctions. Sadly, I saw countless entities spend tens of thousands and even six figure amount on risk analyses that I had to deem insufficient. From my experience with hundreds of enforcement cases, if you can only choose one HIPAA regulation to do well, it would be the risk analysis requirement. As one of the only firms with a reputation for conducting HIPAA risk analyses that satisfy the regulations (in fact, this is how I was able to land that contract with the federal government) and one that has never had one of its risk analyses declared insufficient, you have the assurance that you will not be throwing money down the drain. Also, if your company is ever involved in a data breach investigation, there is no better firm to have on your side to provide critical advice for surviving the investigation without having to pay civil money penalties and/or be subject to multi-year monitoring under a CAP (corrective action plan). If you would like to have a complimentary consultation about how we can help ensure your entity's HIPAA compliance, you can schedule one on our web site at http://www.fortenza.com or contact us here on Gab.