Skip to Content
Compliance

Compliance you can show, not just claim.

We handle the technical side of security and privacy rules: the safeguards HIPAA and the FTC Safeguards Rule expect, the controls your cyber insurer asks about, and the written policies and evidence that prove they are in place.

Book a free consultationCybersecurity
What is included

From "are we covered?" to a folder of proof

Gap review

We compare your setup with the rules and questionnaires that apply to you and list what is missing, in order of risk.

Safeguards put in place

Multi-factor sign-in, encryption, access limits, updates, backups and logging, set up and documented.

Written policies

Short, usable policies for acceptable use, passwords, remote work, data retention and incident response, written for your business rather than copied from a template.

Cyber insurance forms

Help answering your insurer's security questionnaire accurately, and closing the gaps it reveals before you sign.

Client security questionnaires

When a larger customer sends a vendor security form, we help you answer it and supply the evidence.

Staff awareness

Short sessions on phishing, passwords and handling personal information, with a record of who attended.

In writing

What you get

  • A plain-language summary of which rules apply to your business and why.
  • A gap list with each item ranked and costed.
  • A set of written policies your staff can actually read.
  • An evidence folder: settings, screenshots and records that show each safeguard is working.
  • A breach response checklist, including who must be told and when.

US rules we work with

HIPAA for health information, the FTC Safeguards Rule for businesses that handle consumer financial data, PCI DSS for card payments, and state privacy laws. We are not attorneys: we build and document the technical safeguards, and work with your legal counsel on the rest.

We hold ourselves to it too

How we handle client data is written down and public.

Compliance questions

More answers on our FAQ page.

It applies to health care providers, health plans and clearinghouses, and to businesses that handle health information on their behalf. If you are not sure which side you fall on, we help you work it out with your counsel.

No single certificate covers these rules, and we are not auditors. What we give you is the working safeguards, the written policies and the evidence, which is what a regulator, insurer or customer will ask to see.

The first pass is a project. After that, staff, software and rules change, so we recommend reviewing it once a year.

Related services

Cybersecurity Vulnerability scanning Backup and disaster recovery

Got a questionnaire on your desk?

Book a free consultation. Send us the form or the rule you are worried about, and we will tell you where you stand.

Book a free consultation+1 (855) 248-2637

Last updated