Vendors with a signed BAA on file
Any vendor handling patient data without one is an exposure. This count should reach every vendor on the register.
Medical and specialty clinics · Compliance documentation
Keep HIPAA paperwork current without a scramble every audit season
Small practices know they need a security risk assessment, signed business associate agreements, workforce training records and current policies. In practice these live in a binder, an old shared drive folder and the office manager's memory. When a payer audit, an attestation deadline or a breach scare arrives, someone spends days finding the latest versions and chasing signatures.
How it often works today
- The security risk assessment was last done when the practice adopted its EHR, and nobody is sure where the final report is stored.
- Business associate agreements are scattered across email, vendor portals and paper files, with no list of which vendors have signed one.
- New hires complete HIPAA training at some point, but completion dates and annual refreshers are not tracked in one place.
- Policy updates are emailed around without a record of who read them, so proving acknowledgment during an audit means asking staff to remember.
We would organize the documentation into one tracked system, set reminders for renewals and annual reviews, and make evidence easy to produce. The practice's privacy and security officers, and your counsel where needed, still decide what the policies say. We help keep the records current; we do not certify compliance.
The improved workflow
Build a vendor and BAA register
List every system and vendor that touches patient information, from the EHR to the shredding company, and record whether a business associate agreement is signed, where it is stored and when it renews.
Centralize policies and evidence
Store current policies, the risk assessment, training certificates and incident logs in one controlled folder in Microsoft 365 or Google Workspace, with version history and limited access.
Track training and acknowledgments
Assign HIPAA training and policy acknowledgments to staff on hire and annually, with automatic reminders and a completion report the privacy officer can export.
Schedule recurring reviews
Put the annual risk assessment, access reviews and policy reviews on a calendar with owners, so they happen on a date rather than when someone remembers.
How we deliver this: AI automation for small business or fractional CTO leadership, scoped in writing and run over 90 days. See pricing or the sample scope.
What we would measure
Training completion within 30 days of hire
New staff are most likely to make privacy mistakes, so on-time training is a useful leading indicator.
Time to produce audit evidence
If someone asks for the risk assessment and training records, how long it takes to assemble them shows whether the system works.
Where people stay in control
- The practice's designated privacy and security officers own policy content and sign off on the risk assessment; we organize, they decide.
- Questions about whether a vendor is a business associate or how to respond to a possible breach go to qualified counsel or a HIPAA consultant.
- The evidence folder itself is access-controlled, since incident logs and risk assessments contain sensitive details.
Example
A cardiology group preparing for a payer audit
For example, an illustrative cardiology group with two locations receives a payer request for evidence of HIPAA training and a current risk assessment. The office manager finds training certificates for some staff and a risk assessment from several years ago. After the register is built, the group finds three vendors without a BAA, books a new risk assessment with an outside assessor, and sets annual reminders. The next request takes an afternoon instead of a week.
Tools typically involved
What the first 30 days look like
We would spend the first weeks building the vendor and BAA register with the office manager, collecting existing policies and training records into one place, and listing gaps by risk. Then we would agree with the privacy officer which three gaps to close first and how progress is tracked.
Common questions
Can you do our HIPAA risk assessment?
We are not a HIPAA assessor and would not present ourselves as one. We can organize what the assessment needs, gather system and vendor details, and help you choose a qualified assessor or use the free HHS Security Risk Assessment tool properly. Then we help track the remediation items so they actually get done.
Do we need dedicated compliance software?
Sometimes, but many small practices do fine with a well-organized SharePoint or Google Drive folder, a training platform and a calendar of reviews. Dedicated compliance tools make more sense for multi-location groups or practices with frequent audits. We would compare cost and effort before recommending a purchase.
How does this connect to AI tools?
Every AI tool the practice adopts is a new vendor that may handle patient information. It belongs on the BAA register, in the risk assessment and in staff training. Keeping documentation current is what makes it practical to say yes to useful AI tools without losing track of where patient data goes.
The business case
Does it pay for itself?
Illustrative defaults for a medical practice. Replace them with your numbers.
What this workflow costs today
a month in staff time, before any lost sales
Monthly fee + assumed tools +
Break-even: new clients a month (at first-year value)
Or: staff hours recovered and redeployed
Break-even additional revenue
Value of +1 point of win rate
First 90 days, service fee
Worth a closer lookTest the assumptions
Illustration only, not a forecast or guarantee. Recovered staff time becomes a cash saving only if spending actually declines or the time goes into paid work. Tool costs are an assumption; we replace every number here with yours before recommending a scope.
Compliance documentation in other industries
Construction and general contractorsEngineering firmsFinancial advisory firmsInsurance agenciesPhysical therapy clinics
Compliance documentation: full guide
Related guides
Cybersecurity basics to fix before adopting AIWriting standard operating procedures with AI, and keeping them trueDocument processing automation for service businessesAI governance for small businesses, without the bureaucracy
Terms used here
Next step
Bring one expensive workflow. Leave with a clear next step.
In 30 minutes we look at one recurring workflow, what it costs you today and whether there is a credible case to improve it. If there is not, we will say so.
Book a 30-minute workflow review
Not ready to talk? Take the 3-minute check
30 minutes with Phil or Martin. No technical brief, no pitch deck. Phil or Martin replies personally, usually within one business day.