A clinic network gets ready for a HIPAA review

The challenge

What was going wrong

1. 1

   Find where data lives

   We listed every system that holds patient information and traced how data moves between clinics, vendors and staff devices.

2. 2

   Assess the gaps

   We audited access, encryption, backups and vendor agreements against HIPAA requirements, then ranked every gap by risk to patients.

3. 3

   Fix and document

   We helped the IT team encrypt devices, tighten access, and write plain policies and procedures that staff could actually follow.

4. 4

   Prepare and train

   We ran short, role-based training for clinic staff and walked leadership through a practice review so nothing in the real one would be a surprise.

• Data and risk register

  A living map of systems, owners and risks, ranked by importance.

• Encryption and access controls

  Devices and databases are encrypted, and access follows job roles.

• Policy and procedure set

  Clear, short documents cover access, incidents, vendors and backups.

• Staff awareness training

  Short sessions teach staff how to spot phishing and handle records safely.

• Clear evidence for reviewers

  The network can show auditors what it protects, how, and who is responsible.

• Fewer open risks

  The highest risk gaps in access and device security were closed first.

• Staff know what to do

  Clinic teams understand their part in protecting patient data without slowing care.

• Azure Microsoft cloud hosting and services.
• Okta Single sign-on and multi-factor login for staff and customers.
• OpenSSL Creates and checks the certificates and keys behind encryption.
• Splunk Searches and analyses logs to find issues and threats.
• PowerShell Automates Windows and Azure administration tasks.