ePHI inventory and data map
Every system that creates, stores, or sends patient data, with the people and vendors who can reach it.
The Problem
HIPAA Applies to You, but Nobody Has Mapped Where Patient Data Lives
It shows up when a payer audit, a hospital customer, or OCR asks for your risk analysis, and the only answer is an old binder.
01 · Data map
Nobody can list every system that stores patient data.
We inventory the EHR, email, forms, phones, backups, and vendor apps first.
02 · Risk analysis
The last risk analysis is an old downloaded template.
Each system gets threats, likelihood, impact, and current controls rated and written down.
03 · Vendors
Contractors reach patient records with no business associate agreement.
A BAA inventory shows which vendors touch ePHI and which agreements are missing.
04 · Proof
Policies sit in a binder nobody has opened.
Policies match how your staff really work, with signed acknowledgments stored as evidence.
Your front desk scans insurance cards into a shared folder. Intake forms arrive by email from your website. A billing contractor logs in to the EHR from a home laptop, and nobody remembers signing a business associate agreement with them. The last risk analysis is a template someone downloaded years ago. Then a hospital customer, a payer, or OCR asks for your current risk analysis and policies. You have days to produce documents that were never written, for systems nobody has listed.
We start by listing every place electronic protected health information (ePHI) lives: the EHR, email, phones, forms, backups, and vendor apps. Then we document a risk analysis the way the Security Rule asks, rate each risk, and write the policies and BAAs your setup needs. Fixes come in order of risk. You get evidence an investigator can read, not a paid certificate HHS doesn't recognize.
Every ePHI system mapped
EHR, email, forms, phones, backups, and vendor apps listed with everyone who can reach them.
A risk analysis on paper
Threats, likelihood, impact, and current controls rated for each system, as the Security Rule asks.
Evidence you can hand over
Policies, BAAs, training sign-offs, and fix records kept together in one folder you own.
Our HIPAA Compliance Services Process
From First Call to a Documented HIPAA Program in Five Clear Steps
You approve the systems in scope, review every risk rating with us, and sign off on each policy before it becomes part of your program.
We ask how you see patients or serve providers, which systems hold their data, and who your vendors are. You get a written scope and a fixed price. If HHS's own Security Risk Assessment Tool covers your case, we'll tell you before we quote.
What's Included
What You Get With HIPAA Compliance Consulting
Each engagement covers the ePHI inventory, the risk analysis, a checklist mapped to the rules, policies, BAA review, and the technical fixes your plan includes.
Compare Options
DeveloperLook vs Compliance software vs Law firm
Compliance software and other HIPAA compliance solutions suit teams with time to run them, and a law firm gives legal advice we don't. Here is where each one fits.
| Feature | DeveloperLookBest fit | Compliance software | Law firm |
|---|---|---|---|
| Planning | Systems mapped in staff interviews | Template questionnaire | Legal scope review |
| Risk analysis | Written and rated per system | Self-entered answers | Rarely included |
| Policies | Matched to your workflows | Generic templates | Drafted with legal review |
| Technical fixes | MFA, encryption, and logging set up | Not included | Not included |
| Legal advice | Referred to your attorney | Not included | Yes, under attorney privilege |
| Ownership | Every document is yours | Stored in the vendor's platform | Yours to keep |
| Support | 60 days after handover | Vendor help desk | Billed by the hour |
| Cost | Fixed price from $1,050 | Lowest yearly cost | Hourly legal rates |
DeveloperLook
Compliance software
- Planning
- DeveloperLook: Systems mapped in staff interviewsCompliance software: Template questionnaire
- Risk analysis
- DeveloperLook: Written and rated per systemCompliance software: Self-entered answers
- Policies
- DeveloperLook: Matched to your workflowsCompliance software: Generic templates
- Technical fixes
- DeveloperLook: MFA, encryption, and logging set upCompliance software: Not included
- Legal advice
- DeveloperLook: Referred to your attorneyCompliance software: Not included
- Ownership
- DeveloperLook: Every document is yoursCompliance software: Stored in the vendor's platform
- Support
- DeveloperLook: 60 days after handoverCompliance software: Vendor help desk
- Cost
- DeveloperLook: Fixed price from $1,050Compliance software: Lowest yearly cost
Projects We've Built
Healthcare Apps and Websites We Have Built
Medical apps, doctor booking platforms, and clinic websites we designed and built. Systems like these hold the patient data a risk analysis has to cover.
LifePulse Medical Web Design & Development
- Medical
- Booking System
- Dashboard
MediPulse Medical App Design & Development
- Medical
- Booking System
- Dashboard
DocLink Doctor Booking App Design & Development
- Business
- Medical
- Booking System
TruDoc Medical Appointment App Design & Development
- Medical
- Booking System
- Dashboard
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built apps, platforms, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Healthcare Teams Trust Us With Patient Data Work
Compliance work means seeing how your practice really runs, shortcuts included. These habits keep patient data safe while we look and keep the paperwork honest.
No patient records needed
We map systems and settings, not charts. When a screen shows ePHI, we look over a screen share you control, and we never copy records.
A BAA before any access
If our work needs access to systems holding ePHI, we sign a business associate agreement first. Your own consultant should never become one of your gaps.
Advice, not legal opinions
We explain what the rules require in plain English and say when a question needs your attorney. You won't get legal conclusions dressed up as consulting.
Policies your staff can follow
Every policy we write matches how your team actually works. A policy nobody follows is a finding waiting to happen, so we keep them short and specific.
Fixes ranked by risk
High risks get fixed first, even when a low one is quicker. Your budget goes to the gaps an attacker or an investigator would find first.
Your documents, your folder
Risk analyses, policies, and evidence live in your storage, not ours. We remove our access at handover and list every account we used.
Overview
What do HIPAA compliance services include?
DeveloperLook provides HIPAA compliance services for practices, clinics, and health tech vendors that handle patient data. We map every system holding ePHI, document the security risk analysis, write policies, review BAAs, and fix technical safeguards. Projects start at $1,050 and take 2 to 10 weeks, with a fixed scope agreed up front.
DEVELOPERLOOK
Project facts · HIPAA Compliance Services
- Service
- HIPAA compliance services (ePHI map, risk analysis, policies, BAA review, safeguards)
- Typical timeline
- 2 to 3 weeks for gap assessments, 4 to 10 weeks with fixes
- Platforms
- Cloud EHRs, Microsoft 365, Google Workspace, AWS, and Azure
- Built with
- HHS SRA Tool, NIST SP 800-66r2 guidance, Entra ID, and Intune
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 60 days of support after handover
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $1,050 USD, fixed scope after a free scoping call
Reviewed 22 Oct 2026 by Saimul Islam
Good fit
Small medical, dental, and therapy practices
Your practice has never written a security risk analysis, and a payer audit or a patient complaint now asks to see one.
Health tech startups serving providers
Your first hospital customer sent a BAA and a security questionnaire, and you need HIPAA compliance consulting before their patients' data reaches your app.
Billing, IT, and transcription vendors
You handle claims or records for clinics as a business associate, and they now want written proof that your HIPAA compliance program exists.
Practice managers inheriting a messy setup
Your practice runs on Microsoft 365 or Google Workspace and a cloud EHR, and you need a HIPAA compliance consultant to show what's missing.
Agencies and MSPs serving clinics
Your clinic clients keep asking about HIPAA, and you need a partner who runs risk analyses and policy work under your brand.
Not a fit
Only the website needs work
Your gap is a practice website with contact forms and no BAA behind them. Our HIPAA compliant website design service fixes that from $950.
Customers want SOC 2
Your enterprise buyers ask for a SOC 2 report, not HIPAA paperwork. Our SOC 2 compliance services page covers that readiness work and the evidence auditors test.
Need a legal opinion
You need a legal opinion on whether you're a covered entity, or help answering an OCR investigation. A healthcare attorney is the right first call, and we can work alongside one.
Budget under $1,050
Your budget is under $1,050 and you run a solo practice on one cloud EHR. HHS's own Security Risk Assessment Tool, used carefully, is a sensible first step.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for HIPAA Compliance Services
These are starting points in USD. Your final price depends on the systems holding ePHI, your number of sites, and the fixes needed, and you get a fixed proposal after a free scoping call.
For small practices and vendors that need a documented risk analysis and a clear fix list.
$1,050one-time, USD
- Free scoping call and ePHI system inventory
- Gap review against the Security Rule safeguards
- Documented risk analysis for up to 10 systems
- Ranked fix list with owners and dates
- Evidence folder set up for 6-year retention
- 60 days of support after handover
Recommended
For practices and vendors that also need written policies, BAAs, and staff sign-offs.
$2,850one-time, USD
- Everything in HIPAA Gap Assessment
- Risk analysis for up to 25 systems and 3 sites
- Privacy, Security, and Breach Notification policies
- BAA inventory and vendor review checklist
- Workforce training plan with sign-off records
For organizations that want safeguards fixed and a program that runs all year.
$5,600one-time, USD
- Everything in Risk Analysis and Policies
- MFA, encryption, and audit logging set up
- Backup restore test with written results
- Incident response plan and tabletop exercise
- Risk management plan tracked to closure
- Yearly review calendar for your security official
For Agencies
White-Label HIPAA Consulting for Agencies and MSPs
You own the client relationship. We supply the risk analysis, policies, and safeguard work under your brand, and join client calls only when you ask. Your clinic clients get documented HIPAA work without you hiring a compliance specialist.
How the partnership works
White label: your client only ever sees your brand
- Your client
- You, the agency
- DeveloperLook
Share the client brief
Send the clinic's systems, vendors, and the questions their payer or auditor asked.
- Client needs
- You share the details
- Details received
We scope and price
You get a written scope, a data request list, and a fixed price per client.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Assess, write, hand off
We map ePHI, document the risk analysis, and deliver policies in your template.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
Stay client-facing
You present the risk analysis while we work quietly under your brand.
Your document templates
Policies and reports written in your format, with your logo and wording.
Healthcare-specific detail
EHRs, intake forms, and BAAs handled by people who know clinic workflows.
One clinic or many
Run one practice's assessment or yearly reviews across your whole client list.
The Right Technology for Your Project
Technology Stack
These are the tools practices and vendors already run, plus the federal guidance we map controls to. Every change we make is logged and reversible.
- Microsoft 365
- Google Workspace
AWS
Microsoft Azure
- Microsoft Entra ID
- Microsoft Intune
- BitLocker and FileVault
- Bitwarden
- Microsoft Purview Audit
- AWS CloudTrail
- Azure Backup
- Google Vault
- HHS SRA Tool
- NIST SP 800-66r2
Google Sheets- Jira
FAQ
Frequently Asked Questions
Straight answers on cost, timing, what the rules require, who is responsible, and how long records must be kept.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
DeveloperLook's HIPAA work starts at $1,050 for a gap assessment and documented risk analysis covering up to 10 systems. Adding policies, a BAA inventory, and training records for up to 3 sites moves you to $2,850. The $5,600 program adds MFA, encryption, audit logging, a restore test, and an incident response tabletop.
A gap assessment with a documented risk analysis takes 2 to 3 weeks. Policies, BAAs, and training records bring that to 4 to 6 weeks, and technical fixes take the full program to 6 to 10 weeks. Vendor replies about BAAs are usually the slowest part, so we chase them from the first week.
Being HIPAA compliant means following the federal rules that protect health information: the Privacy Rule, the Security Rule, and the Breach Notification Rule. They apply to covered entities (providers, health plans, and clearinghouses) and to their business associates. In practice that means limiting who sees patient data, safeguarding ePHI, and reporting breaches on time.
Day to day, being HIPAA compliant means you can show on paper that patient data is handled safely and only by people who need it. Staff log in with their own accounts, laptops are encrypted, vendors have signed BAAs, and a current risk analysis exists. When someone asks, you hand over evidence instead of good intentions.
Covered entities and their business associates must comply with HIPAA. Covered entities are health plans, clearinghouses, and providers who send health information electronically in standard transactions such as claims. Business associates are vendors that create, receive, keep, or send PHI for them: billing firms, IT providers, cloud apps, and many health tech startups.
Getting compliant with HIPAA starts with mapping where ePHI lives, documenting a risk analysis, and fixing the risks it finds. Then you write policies, sign BAAs with vendors, train staff, and keep evidence of each step. HHS doesn't recognize any official HIPAA certificate, so be wary of anyone selling one as proof.
An accurate, current risk analysis is the key, because every other HIPAA safeguard decision should follow from it. The Security Rule requires one at 45 CFR 164.308(a)(1)(ii)(A). Practices that skip it end up with policies that match neither their systems nor the risks they actually face, and the gaps show the moment someone asks.
HIPAA documentation must be kept for 6 years from the date it was created or last in effect, whichever is later. That covers policies, risk analyses, training records, and similar documents under 45 CFR 164.316(b)(2). Medical records themselves follow state retention laws, which are often longer. We build these dates into your evidence folder.
The covered entity or business associate itself is responsible, led by a designated privacy official and security official. In a small practice one person often holds both roles. Every workforce member still has duties, and leadership answers for the result if OCR investigates. We help those officials run the program; we don't replace them.
Staying compliant with HIPAA takes a yearly cycle of review, training, and testing, not a one-off project. Update the risk analysis when you add a system or vendor, retrain staff, test a backup restore, and check audit logs. Our program plan ends with a review calendar so your security official knows what's due.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.