healthcare compliance
HIPAA & BAA support
Healthcare compliance built for SaaS companies — not for hospital legal departments. ISPH provides compliance program management, not legal advice. Legal counsel fees are client-arranged and client-paid.
- 3 to 16 weeks engagement
- Administrative · Physical · Technical Safeguards
- Legal counsel for OCR inquiries is separate
HIPAA built for how your SaaS actually operates
Most HIPAA resources are written for hospital compliance departments, not for SaaS companies processing ePHI as a business service. We translate HIPAA requirements into practical safeguards, risk analysis documentation, policies, training, and vendor management that fit how your product actually works.
Important: OCR inquiries and breach notification letters should involve legal counsel (client-arranged). ISPH provides compliance program management — not legal representation.
Health system procurement note
The HIPAA + SOC 2 combination is increasingly required by enterprise health system procurement. We deliver both under one engagement at the multi-framework rate — control overlap reduces the combined cost versus two separate engagements.
Pricing tiers
- HIPAA Security Rule gap assessment
- Initial risk assessment (required under 45 CFR 164.308)
- Core HIPAA policies (Security, Privacy, Breach Notification)
- Business Associate Agreement template (standard)
- Workforce training module baseline
- GRC platform HIPAA control setup
- Everything in Launch, plus:
- Complete HIPAA Security Rule program (all required and addressable safeguards)
- Full HIPAA Privacy Rule policies and procedures
- BAA template library (standard + custom addenda for high-risk engagements)
- Downstream BAA chain management
- SOC 2 + HIPAA control harmonization (reduce duplicated work)
- Staff HIPAA training program (role-based)
- Breach risk assessment process and notification templates
- Everything in Growth, plus:
- Annual HIPAA risk analysis refresh
- OCR audit simulation and inquiry response preparation (legal counsel separate)
- Multi-entity HIPAA governance (parent/subsidiary structure)
- Cyber insurance HIPAA alignment documentation
- Executive and board HIPAA risk reporting
- HIPAA + GDPR dual compliance program (for companies with EU customers)
HIPAA + SOC 2 combination
- Health system procurement increasingly requires both HIPAA and SOC 2
- Control overlap reduces combined cost vs. two separate engagements
- We scope the multi-framework bundle at the kickoff call
- Enterprise health system deals often require both within the same procurement cycle
Health system procurement requires HIPAA plus SOC 2 combined.
We deliver both under one engagement. Control overlap reduces the combined cost versus two separate engagements.