Healthcare IT & compliance
Healthcare IT needs security and privacy built in. Our team helps practices and health-technology companies with the HIPAA Security Rule, risk analysis, audit logging and protection of personal data under privacy law.
Our team has worked on HIPAA-regulated systems and on the technology of an innovation building inside a major hospital complex. We help practices and health-technology companies with the Security Rule risk analysis, access controls, audit logging, encryption and the agreements with vendors that touch patient data.
The goal is a working program, not a binder. We document what is in place, fix the gaps by risk and keep the evidence ready for an auditor or a client. "HIPAA Security Rule Checklist for Medical Practices and Business Associates" is the working list, and "HIPAA and the Cloud" covers business associate agreements for the major cloud services.
What we do
- HIPAA Security Rule risk analysis support
- Audit logging and access reviews for patient data
- Encryption of devices, email and backups
- Business associate and cloud configuration review
- HL7 and FHIR interface development
- EHR integration with existing systems
- Incident response planning for patient data
- Staff security awareness material
We also integrate clinical systems using HL7 and FHIR, and connect them to the EHR platforms a practice already uses. This is technical support, not legal advice; counsel confirms what applies to you.
Healthcare work combines Managed IT, Cybersecurity and Tailored Software, and we have supported an innovation building inside a major hospital complex.
Leading platforms we work with
- Epic Systems
- Oracle Health
- MEDITECH
- athenahealth
- HL7 International
- NextGen Healthcare
Platforms and practices
- HIPAA Security Rule
- HL7
- FHIR
- EHR integration
- GDPR
- CCPA
- LGPD
- Risk analysis & audit logging
References
- Becker's: Epic up by 77 hospitals in 2025 (KLAS US acute care EHR market share, trade press)
- Fierce Healthcare: Epic grows EHR footprint among small health systems in 2025 (KLAS data, trade press)
- HIT Consultant: KLAS 2026 EHR market share report (14 May 2026): Epic gained 77 hospitals, Oracle Health lost 56, 84% of MEDITECH decision-makers chose Expanse
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Healthcare IT & compliance for clients
Where this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageDo you support HIPAA compliance?
We support the technical safeguards, risk analysis and audit logging. We do not give legal advice or certify compliance.
Can you handle GDPR, CCPA or LGPD?
We support the technical controls those laws expect. Counsel should confirm legal duties.
What is the difference between HL7 and FHIR?
HL7 v2 is the long-standing message format that most hospital systems still use for orders, results and admissions. FHIR is a newer standard based on web APIs and JSON, easier for modern applications to consume. Many integrations need both, with an interface engine translating between them.
What does a HIPAA risk analysis include?
An inventory of systems and data that hold electronic PHI, the threats and vulnerabilities for each, the likelihood and impact, the safeguards in place and a prioritized plan. The Security Rule requires it and requires keeping it current. We support the technical parts; counsel confirms what applies to you.
How should audit logs for patient data work?
Record who accessed which records, when and from where, store the logs where users cannot alter them, and review them on a schedule and on alerts such as access to a colleague's record. Retention is set by policy and law. Logs that nobody reviews do not satisfy the intent of the rule.
What is the minimum necessary standard?
HIPAA expects a covered entity or business associate to limit uses, disclosures and requests of protected health information to the minimum needed for the purpose. In systems this means role-based access, so a billing clerk does not open clinical notes, plus audit logs that show who viewed which record. Treatment disclosures are generally exempt, so your privacy officer should confirm how it applies to each workflow.