The risk analysis the rule requires.
Done, documented, defensible.

Who it is for.

Organisations that hold protected health information or take real customers on an application that was built fast.

Health-tech companies that sign BAAs

Patient apps, telehealth, practice software, AI scribes and care-coordination tools. The Business Associate Agreement you signed makes the Security Rule yours, risk analysis included.

Multi-location practice groups

Medical, dental, dermatology, therapy and behavioral health groups with a patient portal, online scheduling or telehealth across several sites, and a HIPAA notice as the only security document on file.

Founders of AI-built products

Applications built on Lovable, Base44, Bolt, Replit or with coding agents that now hold customer data and take payments, before the first enterprise security questionnaire or the first incident.

Companies facing a first audit

An enterprise customer or a partner has asked for SOC 2, or a payer or health system has asked for HIPAA evidence, and the deadline is in the contract.

What we deliver.

Three fixed-price engagements. Each one ends in documents that answer the question that prompted it.

HIPAA Security Risk Analysis

Inventory of systems and the electronic protected health information they hold; identification of threats and vulnerabilities; assessment of current safeguards; likelihood and impact per risk; a risk register; and a risk management plan that satisfies 164.308(a)(1)(ii)(B). Documented to the standard in 164.316, which is what an investigator or an auditor will hold you to.

AI-application security review

Architecture and data-flow review; authentication, authorisation and tenant isolation; secrets and keys in client bundles; database access rules and row-level security; dependency and cloud-configuration review; payment and webhook handling; and the AI-specific surface: prompt injection, tool permissions, and what data reaches model providers. Findings carry severity, evidence and the fix. Fixed findings are retested within thirty days.

Audit readiness

A gap assessment against the SOC 2 Trust Services Criteria or the HIPAA Security Rule, the policies and procedures that are missing, the controls implemented by our engineers in your systems, and the evidence organised the way the auditor will ask for it. Independent auditors perform the audit; we prepare you to pass it.

AI-agent security and governance

For teams deploying agents with real permissions: the scope each agent is allowed, the approvals that gate consequential actions, the record each action produces, and the tests that prove the limits hold. Delivered as part of a review or a readiness engagement.

Remediation

Where the register says fix it, our engineers fix it in your environment: access control, logging, encryption, backups, configuration, code. Quoted with the report at a fixed price, delivered through your own change process.

Price.

Fixed prices, set in the written quote. The scope is sized by systems, sites and workforce, not by the hour.

Audits and certifications are performed by independent auditors and certification bodies, contracted by you. We prepare the organisation, the systems and the evidence.

What you receive in writing.

Written for the person who will be asked for it: an investigator, an auditor, a customer's security team or your own board.

• The Security Risk Analysis report, dated and signed, with the methodology, the ePHI inventory and the threat and control assessment.
• The risk register with likelihood, impact, owner and target date on every row.
• The risk management plan required by 164.308(a)(1)(ii)(B), with the retention note required by 164.316.
• For application reviews: the findings report with severity, evidence and fix, and the retest letter.
• For audit readiness: the gap report, the policy and procedure set, the control implementation record and the evidence index.
• A one-page security summary you can attach to a questionnaire or a contract.