HIPAA Compliance Consulting for the Software Your Clinic Runs On
A technology review for the systems your clinic runs on: website, portal, intake and billing, checked against HIPAA safeguards.
Reviews built for
Administrative Safeguards
Policies and habits around systems: who has access, and why.
Technical Safeguards
Controls inside the software: unique logins, role-based access, audit logs.
Physical & Hosting
Where data lives: hosting controls, devices, backups, and test restores.
Vendor & BAA Review
Every vendor mapped, with missing Business Associate Agreements flagged plainly.
A Healthcare Software Team, Not a Law Firm
Med Clinic X is a healthcare software company, and this review covers the layer we build and maintain: your website, forms, portal, intake and billing software, and the hosting underneath them. We check each system against HIPAA safeguards, write the findings plainly, and fix what we can reach. What is policy, or another vendor's job, is flagged, not fudged.
- Healthcare software only, reviewed by the team that builds it.
- Every system mapped, including forms and email inboxes.
- Findings in plain writing, graded by how much they matter.
- Fixes on systems we build or can access, documented after.
Most findings live in the seams
Each system can look sound on its own. The gaps appear where systems join, and in tools added quickly and never reviewed since, which is where a careful review earns its keep.
Forms that email patient details
An enquiry form sending patient details to a shared inbox, with no audit trail behind it.
Shared logins, invisible actions
Shared staff logins mean audit trails cannot show who saw or changed a record when it mattered.
Logging switched off, never checked
Portal add-ons with audit logging available but never switched on, or never reviewed since launch.
Vendors without agreements
Vendors handling patient data with no Business Associate Agreement in place behind them at all.
If any of that sounds familiar, the problem is rarely one system. It is the joins between them, and the tools nobody reviewed.
A Review That Starts With Every System
We list every system that creates, receives, stores or sends patient information, including ones nobody thinks of as systems: web forms, email inboxes and spreadsheet exports. Each is checked against HIPAA administrative, physical and technical safeguards, and findings are graded by how much they matter.
- Website, forms and online intake, checked end to end
- Patient portal, access controls and audit logging
- Billing software, email and file handling
- Hosting environment, devices and backups
- AI receptionist and call workflows, where used
Built by someone else? Reviewing a system you built yourself is straightforward. Reviewing another provider's work takes longer, and we say so in writing before quoting, so scope, price and expectations match from the start, before any work begins.
What a Review Covers, System by System
A review covers your website and forms, patient portal, intake, AI receptionist and workflows, billing software, email and file handling, and the hosting underneath them. Scope is agreed after an inventory, so you are not paying to review systems you do not use.
- Forms that never ask for health information they should not hold
- Unique accounts instead of shared logins, with role-based access
- Audit logs that record who saw what, and when
- Encryption in transit and at rest, on systems we can configure
- Patient portals, secure access to appointments, forms, messages and results. Patient portal development
- AI-assisted front-desk tools, after-hours call handling and enquiry capture, reviewed as part of the call workflow. AI medical receptionist
- Healthcare software, the portals and tools behind the website, built under one roof and reviewed with the same discipline. Healthcare software development
A Review With Paper You Can Keep
A clear process, with written findings at every step. You hold the record, so your risk analysis and your partners can see what was checked and what was fixed.
01Systems Inventory
We list every system that creates, receives, stores or sends patient information, including web forms and email inboxes nobody counts.
02Safeguard Review
Each system is checked against HIPAA administrative, physical and technical safeguards, and findings are graded by importance and evidence noted.
03Fix Plan
Findings become a prioritised list: what we fix, what other vendors fix, and what is a policy decision for leadership.
04Implement & Configure
On systems we build or can access, we apply the fixes: access controls, audit logging, encryption and form handling.
05Re-check & Document
We re-check the fixed items and update the record, so you hold current evidence for insurer or partner questions.
The Agreements Behind the Software
Every tool that touches patient information needs the right agreement behind it. We map your software vendors, check which ones should have a Business Associate Agreement with you, and flag the gaps, because a missing BAA upstream is a common, quiet gap. Where our work involves handling PHI on your behalf, we sign a BAA too.
- Vendor map across website, portal, intake and billing
- BAA checks for every vendor handling PHI
- Gaps flagged, with the risk stated plainly
- Agreements confirmed before fixes are signed off
A missing agreement does not make a system unsafe on its own, but it leaves a gap no technical fix closes. We flag it early, so you can close it with the vendor.
What a Compliance Review Has to Get Right
A compliance review is not a badge. It is a written record of what was checked, what was fixed, and what still needs your decision, built system by system, with evidence for each finding. Your compliance officer or attorney can rely on it, and your risk analysis can draw on it, because the findings are specific, not general.
This review sits inside wider work, not apart from it. Our healthcare software development service covers the portals and tools behind it, our patient portal development builds access and audit trails in from the start, and our healthcare websites service covers the forms your site depends on every day.
The standard we review to
- A system map covering every tool that handles PHI
- Unique accounts and role-based access, checked
- Audit logs switched on, and actually reviewed
- Encryption in transit and at rest, where configurable
- Vendor and BAA gaps flagged in writing
- Backups stored safely, and test-restored, not assumed
Paper You Can Keep and Reuse
We re-check the fixed items and update the record, so you hold current evidence for your own risk analysis and for insurer or partner questions. Findings you cannot show anyone are only half useful when someone asks for them.
- Fixed items re-checked, with before and after notes
- Findings document updated, ready to file
- Open gaps listed honestly, with owners named
- Evidence your risk analysis can draw on
A review is only useful if it survives the next question, from an insurer or a partner. Ours is written to be filed, shared and revisited.
Security & Privacy
Not legal advice, honestly scoped
Med Clinic X is a software company, not a law firm, an auditor or a certification body. There is no official HIPAA certification, and no consultant can hand you compliance in a box, because compliance belongs to your whole organisation.
Here is what that means in practice:
- Legal interpretation and formal sign-off stay with your counsel. We advise on the compliance posture of the systems we build and the ones you already run, and we produce written findings your own compliance officer or attorney can rely on, with evidence attached for each finding.
- Compliance covers your whole organisation: policies, staff behaviour, physical premises and every vendor, not just software. What we can do is make the technology layer sound, with the right safeguards in place and known gaps closed or honestly flagged, and documented in writing for your own records.
- Tracking tools need care on healthcare websites. The US Department of Health and Human Services has published guidance on how HIPAA applies to online tracking technologies. We review analytics and advertising tags against that guidance with you, rather than installing them by default, before launch.
For more detail, read how we approach HIPAA across our work.
Reviews for the way your organization works
We review the technology layer for practices of every shape and size.
Primary Care Clinics
Dental Practices
Dermatology Clinics
Pediatric Clinics
Mental Health Clinics
Urgent Care Centers
Cardiology Practices
OB/GYN Practices
Chiropractic Clinics
Multi-Specialty Groups
We also review for independent doctors and physicians, telehealth and virtual care providers, hospitals and specialty centers, and healthcare startups that need a first review before their platform grows into something larger. Dental practices can go further with our patient portal development, where access and audit trails are built in from the start.
Technology review or full risk analysis? An honest comparison
| Question | Full formal risk analysis | Technology review with Med Clinic X |
|---|---|---|
| Scope | Whole organisation | Technology layer only |
| Who leads it | Your compliance lead or assessor | Our software team |
| Legal interpretation | With your counsel | Not included, flagged for counsel |
| Written evidence | Organisation-wide record | Systems findings and fixes |
| Quote shape | Set by the assessor | Quoted in writing after inventory |
| Best for | A formal assessment, end to end | Clinics starting with their software |
If you need the full formal assessment led end to end, we will say so plainly.
What affects the price of a compliance review?
We quote in writing after the inventory step, because the honest drivers of cost are only knowable once every system is listed.
Two ways to work with us: a fixed-scope review with defined systems and a defined price, or a phased review that inventories first, then fixes in an order agreed with you and your leadership.
Get a Written Quote for Your ReviewWhat moves a quote
- Number of systems in scope
- Whether Med Clinic X built them, or another provider did
- How much remediation we carry out, versus document
- Number of vendors needing BAA checks
- Hosting and backup complexity in scope
See it before you commit: healthcare demos
We would rather show you working software than describe it. Our demo area includes portal and website experiences you can click through today. Try them as a patient, and see how access and booking feel.
Explore Healthcare Demos
HIPAA Consulting, Answered Straight
Quick answers to common questions about our HIPAA compliance consulting service and its scope.
Still have a question? Send us your practice details and we will reply in writing.
READY TO TRANSFORM YOUR PRACTICE?
Join Hundreds of Healthcare Providers Who Trust MedClinic X
Book a demo today and see how our platform can help you deliver exceptional patient care.