HIPAA security
HIPAA risk assessments written for an OCR investigator.
Security Rule risk assessments, ePHI flow mapping, remediation, and ongoing management for covered entities and business associates. Eight years protecting healthcare organizations across the Pacific Northwest and beyond.
What changes under the proposed rule
HHS published the proposed Security Rule update on January 6, 2025.
- Addressable
- Eliminated; controls become mandatory
- Encryption
- Required at rest and in transit
- MFA
- Mandatory for ePHI access
- Risk analysis
- Annual, tied to asset inventory
- Testing
- Annual pen test, biannual scans
- Restoration
- 72 hours for critical systems
How we help
What we do for covered entities and business associates.
More than half of 2025 OCR enforcement actions cited the same deficiency: failure to conduct an adequate security risk assessment. The proposed rule would make the requirements more specific.
We assess
Full HIPAA security risk assessment, technology asset inventory and ePHI flow mapping, prioritized gap analysis, and audit-ready documentation for OCR.
We remediate
Encryption deployment (our core specialty), MFA rollout and access control configuration, incident response planning, and backup and disaster recovery testing.
We manage
Annual compliance reviews, continuous vulnerability management, penetration testing, policy maintenance, and workforce training.
Why Sidechain
Assessments written to survive an investigation.
A template assessment reads as a template to an investigator. Ours tie each risk to a specific asset in the inventory, a specific ePHI flow, and a specific remediation decision, because that is what OCR asks for when it opens a file.
We have spent eight years assessing regional EHR deployments, multi-site clinics, rural health networks, and managed care organizations, mostly in the Pacific Northwest. The people doing the assessment are Sidechain employees in Portland, Oregon.
- Satisfies the risk analysis requirement at 45 CFR § 164.308
- Documentation structured for OCR review
- Encryption and key management, which most assessors do not do themselves
- Assessment completed in as little as two weeks
Covered entities and business associates
Who this is for.
If you handle ePHI, the Security Rule requires a current risk assessment. We work with covered entities and business associates of every size.
Providers
Hospitals and health systems, multi-site clinics, rural health networks, behavioral health, and specialty practices.
Payers and plans
Health plans, managed care organizations, third-party administrators, and pharmacy benefit managers.
Business associates
Billing and revenue cycle companies, EHR and health IT vendors, consultancies, and any vendor that touches patient data.
Thank you for your superb expertise and service. Your work enables our business to continue to be secure and compliant.
Sidechain’s pen test uncovered three critical vulnerabilities our previous vendor missed entirely. The remediation plan was clear, prioritized, and our team had everything fixed within two weeks.
FAQ
Common questions.
Is the new Security Rule finalized yet?
The proposed rule was published January 6, 2025. Whatever the timing, risk analysis failure is already the most frequently cited violation under the current rule.
We already did a risk assessment. Are we covered?
The proposed standard is significantly more prescriptive: assessments must tie to a technology asset inventory, cover every ePHI system, and document specific remediation actions. If yours is over 12 months old or uses a generic template, it likely will not meet the bar.
How much does an assessment cost?
Pricing depends on organization size, number of systems, and scope, and is quoted after a short scoping call. For context, OCR penalties for risk analysis failures have run to several hundred thousand dollars and above.
How long does it take?
Many assessments are completed in as little as two weeks from kickoff. One scoping call, one quote, and a defined schedule before work begins.
Will you sign a BAA?
Yes. Sidechain enters into Business Associate Agreements with covered entities and business associates whose ePHI we may encounter during an engagement.
Scope a HIPAA risk assessment.
One call to scope it and a quote from that call. Many assessments finish in as little as two weeks.
(503) 389-3174 · info@sidechainsecurity.com · Portland, Oregon