HIPAA Security Rule readiness with a risk analysis you can actually maintain.
Practices run imaging systems, practice-management software, cloud email and a network full of devices nobody remembers installing. AssurIQ discovers that environment, evaluates the administrative, physical and technical safeguards against evidence, and keeps the risk analysis current instead of annual.
- Aug 04Evidence GapNo evidence on fileControl created from HIPAA pack mapping
- Aug 06PartialCollector · endpoint census3 of 41 workstations still on unsupported OS
- Aug 19PartialManual upload · lifecycle planReplacement schedule attached, exception requested
- Aug 27PassCollector · endpoint censusAll endpoints on supported OS · confidence 94
The pressures are specific. So is the platform.
Administrative, physical and technical safeguards; a documented, current risk analysis; access and audit controls; contingency planning; business-associate oversight.
Imaging workstations, sensors, kiosks and vendor-managed equipment on the same network as the front desk.
Practice-management, imaging, billing and IT vendors all touch ePHI. Business-associate oversight has to be evidenced.
Proposed updates to the Security Rule would tighten several expectations. AssurIQ tracks them separately from current-rule requirements so you can plan without conflating the two.
Capabilities that map to your obligations.
Risk analysis support
Access & authentication controls
Audit controls & monitoring
Device & media inventory
Business-associate & vendor risk
Evidence Vault
Remediation & validation
Continuous assurance
Backups that were tested — with the history to show it.
A tested-restore control starts as an Evidence Gap, moves to Partial as evidence arrives, and reaches Pass with a confidence score. The history stays. That is what a defensible contingency plan looks like.
- Evidence Gap is visibly distinct from failure
- Manual and connector evidence combined with confidence
- Append-only timeline for the assessor
- Aug 04Evidence GapNo evidence on fileControl created from HIPAA pack mapping
- Aug 06PartialCollector · endpoint census3 of 41 workstations still on unsupported OS
- Aug 19PartialManual upload · lifecycle planReplacement schedule attached, exception requested
- Aug 27PassCollector · endpoint censusAll endpoints on supported OS · confidence 94
The service account with global admin and no MFA.
AssurIQ reads the identity provider, ranks the account as a high-risk finding, maps it to the access-control and authentication requirement areas, and validates enforcement by reading the provider again.
- Privileged identities inventoried across M365 and AD
- Legacy protocols and stale credentials surfaced
- Control state changes only when MFA is enforced
- svc-backup@brightpathGlobal AdminNo MFA
- j.reyes@brightpathGlobal AdminMFA enforced
- legacy-scanDomain Admin (AD)Password 412d old
- kiosk-frontdeskUserLegacy auth allowed
Three scores the practice owner can understand.
Security Risk, Assurance and Operational Health kept separate so a quiet-but-unproven practice and a documented-but-exposed one are not painted the same color.
- What changed since last quarter
- Open evidence gaps and expiring exceptions
- Vendor reviews due
Brightpath Dental (fictional)
A multi-location dental practice managed by the fictional Northline MSP, with imaging workstations, cloud email and a business-associate roster.
- Privileged Microsoft 365 account missing MFA
- Unsupported Windows endpoint at the front desk
- Tested-restore control history: Evidence Gap → Partial → Pass
- Overdue business-associate assessment
Common questions
Does AssurIQ certify HIPAA compliance?+
How are proposed Security Rule changes handled?+
Does AssurIQ ingest patient data?+
AssurIQ supports HIPAA Security Rule readiness with evidence, risk analysis support and continuous verification. It does not certify compliance, and it does not make breach-notification or risk-of-compromise determinations. Proposed rule changes are tracked separately from current requirements. Mappings use original AssurIQ summaries.
Manage the endpoint. Understand the infrastructure. Prove the controls.
Explore the connected platform, or talk with the AssurIQ team about a controlled Windows RMM pilot. No production data is required to explore the fictional sandbox.