Overview
Indian IT firms handling US
patient data must comply.
HIPAA (Health Insurance Portability and Accountability Act) applies to Covered Entities and their Business Associates. Any Indian IT company that processes, stores, or transmits Protected Health Information on behalf of a US healthcare client is a Business Associate and subject to full HIPAA obligations. BAAs do not transfer liability - they confirm it.
Our assessment covers all three HIPAA safeguard categories: Administrative (policies, workforce training, contingency planning), Physical (facility access, workstation security, device controls), and Technical (access control, audit controls, encryption, transmission security).
Why This Matters
HHS Office for Civil Rights settlements with Business Associates have exceeded $1 million per incident. Indian IT companies that sign BAAs with US healthcare clients without implementing actual HIPAA controls face both HHS enforcement and contract liability. Our assessment identifies the gap between what your BAA promises and what you actually have.
What We Audit
📋
Administrative Safeguards
Security Officer designation, risk analysis, workforce training, access management, and contingency plan reviewed.
🏢
Physical Safeguards
Facility access controls, workstation use policies, device and media controls assessed.
💻
Technical Safeguards
Access control, audit logs, integrity controls, and transmission encryption reviewed.
📄
BAA Review
Business Associate Agreements reviewed for completeness and alignment with actual practices.
🔔
Breach Notification
Breach identification, documentation, and notification procedures reviewed.
🔍
Risk Analysis
Formal risk analysis documentation reviewed against HHS guidance requirements.
What You Receive
HIPAA Gap Assessment - All 75+ implementation specifications assessed with compliance status and risk rating.
Risk Analysis Report - Formal risk analysis document prepared per HHS guidance requirements.
Policies and Procedures Gap - Missing or inadequate policies identified with template documentation provided.
BAA Review Report - Existing BAAs reviewed for completeness and recommendations for any gaps.
Remediation Priority List - Implementation specifications ranked by OCR enforcement priority and business risk.
30-Day Support - BAA negotiation, OCR query, and implementation advisory at no additional charge.