HIPAA compliance means having a documented security risk assessment, written privacy and security policies, trained staff, business associate agreements with your vendors, and a plan for breaches. Doctor Rebrand builds that program for your practice and keeps it current every year, so it is ready when a patient complaint, a payer audit or the Office for Civil Rights asks for it.
What's Included
Security Risk Assessment
- The risk analysis HIPAA requires, covering every system that holds patient information.
- A written plan to fix what it finds, ranked by risk.
- Repeated every year, and whenever your systems change.
Policies and Procedures
- Privacy and security policies written for your practice, not a generic binder.
- A Notice of Privacy Practices for your website and front desk.
- Procedures for patient rights: record requests, amendments and accountings of disclosures.
- Privacy officer and security officer duties defined.
Staff Training
- HIPAA training for everyone on your team, with completion records.
- Annual refreshers, and training for every new hire.
- Practical security habits: phishing, passwords and devices.
Business Associate Agreements
- A list of every vendor that handles patient information.
- A signed BAA on file for each one.
- New tools reviewed before you start using them.
Breach Response
- An incident response plan your team can follow.
- A risk assessment for every possible breach, documented.
- Notifications to patients and HHS prepared if a breach is confirmed.
Website and Telehealth Compliance
- Analytics and ad pixels reviewed, so patient information never reaches an ad platform.
- Website accessibility to WCAG 2.2 AA, privacy policy, cookie consent and TCPA-compliant forms.
- Telehealth and controlled substance prescribing rules tracked for every state you practice in.
How It Works
- 1
Assessment
We run your security risk assessment and review your current policies and vendors.
- 2
Program
We write your policies, collect BAAs and set up staff training.
- 3
Fixes
We work through the risk plan with you, highest risks first.
- 4
Every Year
We repeat the assessment, refresh training and update policies as rules change.