Our Approach and Methodology
SecureState’s approach to a HIPAA Gap Assessment – Pre Audit maps out
critical information processes and determines if regulatory controls
have an impact on the business. The goals are to:
- Evaluate the effectiveness of your HIPAA compliance program
- Validate HIPAA controls
- Remediation cost-justification
- Keep you up-to-date on any new HIPAA requirements, threats, and
liabilities
The stages of our HIPAA Gap Assessment, with limited descriptions,
are as follows:
Pre-Onsite Visit:
- Introduce engagement participants and define roles
- Review engagement activities
- Review any applicable documentation
Process Mapping:
- Document the in-scope HIPAA business process and supporting
technologies
- Perform data flow analysis and map HIPAA processes to technical
infrastructure
Requirements Analysis:
- Document the existing controls used to protect ePHI/PHI
- Identify gaps against the NIST 80-53 framework for HIPAA
Security Rule
- Identify gaps against the GAPP framework for HIPAA Privacy Rule
Reporting:
- On-site interview and information gathering to assess HIPAA
compliance status
- Outline strategic recommendations to mitigate identified control
gaps
- Upload remediation activities to “MyState Portal”