Industry · Healthcare

Healthcare: HIPAA posture without the war.

EHR, billing, scheduling, and patient comms in four systems that almost talk to each other. Your HIPAA posture lives on a shared drive nobody owns, the last BAA you signed is in an email thread from 2022, and the clinic across town just had a breach.

Hampton Roads carries one of the densest small-practice healthcare footprints on the East Coast. The big systems define the ecosystem, but the long tail is where the IT pain concentrates: independent primary care, dental, physical therapy, chiropractic, optometry, and the growing behavioral health bench across all seven cities. The practice we score runs 3 to 50 staff, books through a portal nobody at the front desk likes, and bills through a third tool that argues with the EHR every Tuesday.

HIPAA is not a feature you buy, it is a posture you keep, and it drifts every time a staff member leaves or a vendor pushes a silent update. Behavioral health carries a second overlay: 42 CFR Part 2: that most general HIPAA tooling ignores by default. Cyber insurers now want MFA, endpoint detection, and documented training before they renew.

Where it usually hurts

Key concerns in this sector.

• HIPAA risk assessment and gap remediation

  Written for an auditor, not a brochure. The documentation an HHS audit or cyber insurer actually asks for, against a 60-day breach clock that does not pause for turnover.

• EHR-to-billing interop and adoption

  Is your clinical team using the system you paid for, or working around it. We measure usage, design the adoption work, and write the kill-or-keep memo if the tool stays dead.

• Behavioral-health-specific compliance

  42 CFR Part 2 for substance use records, state telehealth rules, and the consent requirements stricter than HIPAA alone.

• Business Associate Agreements with every vendor that touches PHI

  The EHR, the billing service, the cloud backup, the email provider, the analytics tool nobody remembered to flag. Every vendor, every renewal.

• Patient comms across portal, SMS, and voice

  Without a PHI disclosure incident. We design the workflow and the controls together.

Services we apply here

How we engage in this sector.

• Compliance & Cybersecurity Every contract, every renewal, every license: scored 100-900 across Controls, Technology, Growth, and Adoption. See the service
• Software & Automation We rip out the integrations pretending to work, then wire up the workflow your team will actually use. See the service
• CIO Services The senior IT brain on a retainer, spanning every capability. We sit in the room when you make the call. See the service