Does the HIPAA Security Rule apply to our health plan and who pays for compliance?
Yes. A health plan is a covered entity under HIPAA, so the Security Rule applies to every electronic protected health information (ePHI) system the plan creates, receives, maintains or transmits, whether the plan is insured, self-funded, run by the employer or outsourced to a third-party administrator. No HIPAA certificate exists. HHS states that no Security Rule standard requires certification and that it does not recognize private certifications, so the plan shows compliance through a current risk analysis, written policies and procedures, and documentation of how each required and addressable specification was handled. Start by confirming which entity is the covered entity, which entity holds the claims and eligibility data, and where that data sits across the sponsor, the administrator and any vendors. Cost and effort depend mostly on the plan's structure. An insured plan may rely on the carrier for much of the technical safeguard work, while a self-funded plan run by the sponsor carries most of it directly. A plan administered by a TPA must confirm which safeguards the TPA performs and which the plan retains, and must have business associate terms that match. The cost components are staff time for the security official and privacy roles, technology for access control, audit logging and encryption, the risk analysis itself, and outside help. Some of these are one-time, such as the initial risk analysis and policy build, while others recur, such as annual review, workforce training and log monitoring. Enforcement amounts give context for the stakes. SG Health Plan paid $245,000 in January 2026 and L.A. Care Health Plan paid $1,300,000 in 2023, which is why the risk analysis and plan document work should be budgeted early, not after an incident. The organization owns its controls and decides how to meet them. A partner such as DeployOpen can prepare systems, configurations and evidence, but that work does not produce an audit report or attestation. Only an independent assessor or auditor reports on the controls, and that role must be separate from the team that built them. When requesting a quote, ask the partner to list which Security Rule safeguards it will prepare, which evidence it will hand over, and which items remain the plan's own responsibility. Confirm the scope against the plan's actual data flows before signing, and check the current status of the proposed rule at the Federal Register notice for the proposed Security Rule revision.
Which plan duties apply to insured, self-funded and administered plans
In a fully insured arrangement, the insurer or HMO issues the coverage and carries the claims risk. The group health plan is still a covered entity in its own right, but the insurer holds and processes most of the ePHI and runs most of the Security Rule program for those systems. The employer sponsor should receive only what the plan document permits, typically summary information and enrollment data, and the plan document must still require the sponsor to safeguard any ePHI it handles for the plan. Under 45 CFR 164.314(b)(1), the group health plan must ensure that its plan documents include that requirement, unless the only ePHI disclosed falls under the exceptions the rule lists.
- Covered entity: the group health plan is a covered entity, and the insurer is a separate covered entity responsible for its own systems.
- Business associate: under 45 CFR 160.103, a plan sponsor that receives PHI from its group health plan, where 164.504(f) is met, is excluded from the business associate definition.
- Plan document duty: the plan document must require the sponsor to reasonably and appropriately safeguard the ePHI it handles for the plan.
- Sponsor obligations: the required provisions make the sponsor implement administrative, physical and technical safeguards, keep plan ePHI separated from employment functions, ensure its agents accept the same measures, and report security incidents to the plan.
Check whether anyone in HR or benefits administration receives more than summary or enrollment data. If they do, the plan document duty applies in full, and the sponsor's safeguards become part of the plan's evidence.
In a self-funded arrangement, the employer carries the claims risk and the plan itself is the covered entity. A third-party administrator (TPA) usually performs claims, enrollment and member services under contract. In most cases the TPA creates, receives, maintains or transmits ePHI for the plan, which makes it a business associate, so the Security Rule reaches the TPA directly through its business associate agreement. The plan document duty still applies to the sponsor, but only where the sponsor receives ePHI beyond the exceptions in 164.314(b). Business associate status turns on the functions the vendor performs, so the contract should describe them in detail. OCR's 2025 settlement with Consociate, a business associate providing health plan administration, shows what happens when the administrator's own risk analysis is missing. Consociate paid $225,000 in December 2025 after a 2021 ransomware attack, and OCR cited the failure to conduct a risk analysis.
- Covered entity: the self-funded group health plan is the covered entity.
- Business associate: the TPA is typically a business associate for the ePHI it handles for the plan. Confirm the functions in the contract.
- Plan document duty: the sponsor's duty under 164.314(b) is separate from the TPA's agreement and applies only to ePHI the sponsor receives.
- Enforcement exposure: the Consociate case shows that a missing risk analysis at the administrator can produce a settlement for the administrator.
Ask the TPA for its most recent risk analysis, the scope of its business associate agreement, and a list of which sponsor staff can see member-level data.
A public health plan, such as a government-run program for eligible residents, is generally a health plan and therefore a covered entity. It has no employer sponsor in the usual sense, so the group health plan plan document requirement in 164.314(b) is not the main lever. Its duties come from its own Security Rule program and from the contractors and agencies that handle its ePHI. The business associate definition in 45 CFR 160.103 excludes certain government agencies that determine eligibility or enrollment for public benefit plans, but that exclusion is narrow and depends on the specific arrangement, so it should be confirmed with counsel for each function. The largest publicly operated US plan, L.A. Care Health Plan, paid $1,300,000 in 2023 to resolve Security Rule issues arising from member portal and ID card mailing incidents.
- Covered entity: the public health plan itself is the covered entity.
- Business associate: contractors that handle plan ePHI for the plan are usually business associates. Confirm whether any government function falls under the 160.103 exclusion.
- Plan document duty: 164.314(b) addresses group health plans and their sponsors. A public plan with no employer sponsor usually has no sponsor disclosure to govern, so confirm whether any sponsor-like relationship exists.
- Enforcement record: the L.A. Care settlement shows that member-facing channels, such as portals and mailed ID cards, carry Security Rule risk in their own right.
Review each contractor's business associate agreement and confirm with the agency's counsel whether any eligibility function falls within the 160.103 exclusion.
What OCR cases against plans and administrators show
OCR's recent settlements with health plans and a plan administrator share a pattern: the risk analysis was missing or inaccurate, and the breach began with an ordinary attack such as phishing or a misdirected mailing. Each case below points to a control that a plan or administrator can check in its own environment before an investigator does.
SG Health Plan's risk analysis gap
SG Health Plan is an employer health benefits plan. It paid $245,000 in January 2026 after a 2021 ransomware attack affected 9,316 individuals. OCR cited both an impermissible disclosure and a failure to conduct an accurate and thorough risk analysis. For a plan sponsor, the lesson is that the risk analysis must cover every system where plan ePHI sits, including systems run by the sponsor's HR or benefits staff. Check whether your plan's risk analysis lists those locations and whether it was updated after any change to them.
L.A. Care's portal and mailing incidents
L.A. Care Health Plan, described as the largest publicly operated US health plan with more than 2.7 million members, paid $1,300,000 in 2023 to resolve Security Rule issues tied to member portal and ID card mailing incidents. The case shows that a large plan's exposure often comes from routine member-facing processes, not only from attacks. Review how portal access is granted and monitored, and how ID cards and member documents are checked before they leave the plan.
Consociate's phishing to ransomware chain
Consociate Health, a business associate providing health plan administration, paid $225,000 in December 2025. A January 2021 ransomware attack followed a phishing compromise six months earlier and reached a server holding PHI of about 136,539 individuals. OCR cited the failure to conduct a risk analysis. An administrator should treat an early phishing compromise as a warning sign that calls for a risk analysis, and should confirm that email account compromise is detected and that servers holding PHI are segmented from general user access.
Risk analysis comes first
Two of the three cases cite the risk analysis directly, and the third cites a disclosure problem that a stronger analysis could have surfaced. OCR treats the analysis as the starting point for every other safeguard. Plans and administrators should ask whether their analysis names each system, data flow and third party that touches ePHI, rates the threats to each, and records the decisions taken about them.
Business associate duties for administrators
The Consociate case shows that a plan administrator carries Security Rule obligations of its own, not only those of the plan it serves. Administrators should confirm that their business associate agreements define who runs the risk analysis, how incidents are reported to the plan, and which safeguards each party operates. Ask for evidence of these duties, not only a signed contract.
What compliance costs a health plan and who gets paid
This table lists the main cost components of meeting the Security Rule as a health plan or plan administrator, who is paid for each, whether the cost is one-time or recurring, and what drives it up. Use it to build a quote request and to decide which work stays in-house. No fee levels are shown because none were researched; ask each provider for written scope and rates.
| Cost component | Who is paid or who bears it | One-time or recurring, and what drives it |
|---|---|---|
| Internal privacy and security staff | Your own payroll; a named security official must be assigned | Recurring. Driven by plan size, number of plan administrators you oversee, and how much policy and evidence upkeep you keep in-house |
| Outside risk analysis or assessor | An independent assessor or consultant you hire to test ePHI systems against the Security Rule | One-time for the initial analysis, then recurring updates. Driven by how many systems and vendors hold member data and how many new ePHI flows appear |
| Implementation partner for systems and evidence | A firm such as DeployOpen that configures, hardens and documents systems you own, under a written scope | Mostly one-time build, then recurring support or retainer. Driven by the number of systems in scope and the state of current controls |
| Tooling and licenses | Software vendors, or open-source platforms run in your own infrastructure with hosting and staff time | Often recurring subscriptions or hosting. Driven by log volume, identity and encryption needs, and whether you self-host |
| Plan document and contract review by counsel | Outside counsel for plan document amendments and business associate or administrator agreements | One-time for amendments, recurring when contracts renew or plan terms change. Driven by the number of administrators and sponsor data flows |
| Independent audit or third-party report, if pursued | An independent auditor or assessor; HHS does not issue HIPAA certificates | Recurring if you commission periodic reports. Driven by report scope and whether the plan wants a voluntary attestation |
| Enforcement exposure (for comparison) | The plan pays penalties, settlements and corrective action plan costs | Unbudgeted. OCR's resolution with SG Health Plan was $245,000 (January 2026); L.A. Care Health Plan paid $1,300,000 (2023) |
How a health plan gets its Security Rule program ready
The sequence moves from confirming who holds ePHI and what role each party plays, through plan document and risk analysis work, to remediation, documented policies and testing. Each phase produces an artifact the plan can show an assessor or OCR.
Confirm covered entity and business associate roles
Start by establishing which entity is which. A group health plan is a covered entity, and an employer sponsor, a third-party administrator or a vendor may hold a different role under 45 CFR 160.103. The plan's privacy and compliance lead, with counsel, documents each relationship: who receives PHI, for what purpose, and under which agreement or plan document. Confirm whether the sponsor qualifies for the exclusion in the business associate definition. The output is a role map listing each party, its status and the contract or plan provision that governs it. The step is done when every party that touches plan ePHI has a documented role.
Review plan documents against 164.314(b)
Compare the plan document with the provisions 45 CFR 164.314(b) requires. The sponsor must agree to reasonably and appropriately safeguard ePHI it handles for the plan, implement administrative, physical and technical safeguards, support separation of plan information with security measures, ensure its agents agree to the same measures, and report security incidents to the plan. Legal and compliance staff run the gap review, and the sponsor's HR and IT leads confirm what the sponsor actually does. The output is a marked-up plan document and a list of missing or inaccurate provisions. The step closes when each required element has a matching clause and a named owner.
Complete the enterprise risk analysis
Perform a risk analysis that covers all ePHI the plan creates, receives, maintains or transmits, including data held by its administrators, claims processors, portals, call centers and any subcontractors. Inventory systems and data flows, identify threats and vulnerabilities, rate likelihood and impact, and record the current safeguards. The SG Health Plan and Consociate Health resolutions both cited inaccurate or missing risk analyses, so the scope must reach the administrator's environment as well as the plan's own. The output is a written analysis with an asset inventory and a list of ranked risks. The step is done when the analysis is signed off by the security official and the scope statement names every organization holding plan ePHI.
Remediate the highest-ranked risks
Turn the risk ranking into a risk management plan. For each risk, assign an owner, choose a control, set a target state and record the decision. For addressable implementation specifications, document whether the measure is reasonable and appropriate, and if not, what equivalent alternative was adopted, as 45 CFR 164.306(d) requires. Typical early work includes multi-factor authentication on member portals, access reviews, encryption of ePHI at rest and in transit, and logging. Ask administrators for their remediation evidence in writing. The output is a risk management plan with status and evidence references, and the step closes when the highest-ranked items show completed or accepted status.
Document policies, procedures and retention
Write the policies and procedures that operate each Security Rule requirement for the plan, then align them with the plan sponsor and each administrator. Under 45 CFR 164.316, the documentation must be retained for six years, kept available to the people who need it, and updated after changes. Assign an owner to each procedure and set a review trigger tied to system changes, incidents and risk analysis updates. The output is a controlled policy set with version history, owners and a retention record. The step is complete when staff at the sponsor and administrators can locate the current version and confirm they have read it.
Test safeguards and review the evidence
Test the controls the risk analysis depends on. Sample access grants, review audit logs for the plan's systems and the administrator's, test incident reporting from the administrator to the plan, and walk through a tabletop exercise on a ransomware or misdirected-mailing scenario, the kinds of events in the L.A. Care and SG Health Plan cases. Record results and fix gaps. An independent assessor can test the program, but it cannot certify compliance for the plan. The output is a test report with findings, corrective actions and retest results. The step closes when the findings are assigned and the program is ready for ongoing review.
What must be in place before an assessment of plan ePHI
A plan that holds electronic protected health information needs its paperwork and records in order before anyone tests its safeguards. The six items below connect the Security Rule duties of a health plan with the sponsor and administrator relationships that often hold the data.
Current risk analysis covering administrators
The risk analysis must reach every system where plan ePHI is created, received, maintained or transmitted, including systems run by a third-party administrator. Recent OCR cases against plans and administrators cited inaccurate or missing risk analyses as a core failure. To check it, confirm the analysis names the administrator's platforms, lists threats and vulnerabilities for each, and carries a dated risk management plan with owners.
Signed business associate agreements
A third-party administrator that creates, receives, maintains or transmits plan ePHI is a business associate and needs a written agreement with the plan. Confirm the contract requires the administrator to apply Security Rule safeguards, to pass the same obligations to its subcontractors, and to report security incidents. A plan without a signed agreement cannot show that its vendor is bound.
Sponsor agreement and plan document language
A group health plan must ensure its plan documents require the plan sponsor to safeguard the ePHI it handles for the plan, unless an exception applies. The required terms cover administrative, physical and technical safeguards, security measures for adequate separation, agents bound to the same measures, and reporting of security incidents to the plan. Check that the signed plan document contains each of these terms and that the sponsor's HR and benefits staff follow them.
Inventory of ePHI flows and vendors
Plans often lose track of ePHI once claims data, eligibility files and enrollment feeds leave the core system. Build a map showing each data flow, its source and destination, the storage location, and each vendor, clearinghouse or subcontractor that touches it. To check the map, pick one member record and trace it from enrollment to archive. Any hop missing from the inventory is a gap an assessor will find.
Documented policies and procedures
The Security Rule requires written policies and procedures for each safeguard, and documentation that is retained and kept current. For a plan, the set should cover workforce access, sponsor firewall rules, incident handling and vendor oversight. Confirm each policy names an owner, shows a review date, and matches how staff actually work. Policies that describe controls the plan does not run are harder to defend than a shorter, accurate set.
Security incident and access logs
Logs show whether safeguards operated over time and whether incidents were detected, reported and closed. Keep a record of security incidents, sponsor and administrator access to plan ePHI, and responses to events such as phishing or mailing errors. Check that the log captures the date, the systems affected, the response and the follow-up, and that it is reviewed on a set schedule rather than only after a complaint.
Who owns the controls, who prepares evidence and who issues the report
The covered health plan, or the employer sponsor acting under a group health plan, remains legally responsible for the Security Rule safeguards that protect electronic protected health information. Under 45 CFR 164.314(b), a group health plan must make sure its plan documents require the plan sponsor to safeguard the ePHI it handles for the plan. That duty cannot be delegated away on paper, so the sponsor must decide the policies, name accountable people and approve the risk management plan.
- Risk analysis decisions: The organization decides what counts as reasonable and appropriate for each addressable specification and documents the reasoning.
- Named security official: A workforce member must be accountable for Security Rule compliance, even when vendors do much of the technical work.
- Plan document terms: Sponsor commitments on safeguards, agent agreements and incident reporting to the plan must be written and signed.
- Business associate oversight: The plan must hold its administrators and vendors to written contract terms and monitor their performance.
- Sign-off on evidence: Leadership should review and adopt policies, risk findings and remediation status before any assessor sees them.
Before engaging anyone, confirm which of these decisions your organization will keep in-house and which it expects a partner to draft for approval.
An implementation partner helps the plan or sponsor build and run the technical and procedural controls, then assembles the records that show they work. In DeployOpen's model, that means preparing self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, then documenting the configuration and collecting evidence. The partner works for the organization and does not decide whether the organization complies.
- System preparation: Configuring access control, audit logging, encryption, backup and monitoring on systems the client operates.
- Evidence packaging: Exporting configurations, logs, test results and change records in a form the client can hand to its auditor.
- Documentation support: Drafting procedures for the client to review, adopt and maintain under the documentation standard.
- Security testing: Running vulnerability and penetration tests that inform the risk analysis, with results owned by the client.
- Ongoing operation: Upgrades, patching and continuous testing, offered through retainers where the client wants them.
Ask any partner to state in writing that it will not issue reports, attestations or certificates, and that its deliverables are inputs to the client's own compliance program.
An independent assessor tests the safeguards against the Security Rule and states what it found. Its report is the only third-party output a buyer can rely on for assurance, and it is only as useful as its scope, sampling and evidence. HHS does not certify compliance, does not endorse private certifications and does not treat them as a shield against later enforcement, so the assessor's report describes a point in time and a defined scope.
- Independence: The assessor should not design the controls it tests, and it should disclose any prior work it did for the same client.
- Scope and sampling: The report should name the systems, locations, time period and sample sizes examined.
- Evidence testing: The assessor reviews records directly rather than relying on the client's summary.
- Limits of the report: It does not settle legal obligations or bind OCR, which can still investigate.
- Engagement terms: Confirm the assessor's qualifications, methodology and report format before contracting.
Before signing, ask whether the same firm would be designing the controls it later certifies, since that conflict is the boundary most likely to undermine the report.
How to choose a consultant or assessor for a health plan
A health plan or plan administrator buying outside help needs to know who will do the work, who will sign off on it, and what they will hand over. The cards below cover the checks that separate a useful engagement from one that produces a document without changing the plan's safeguards. Remember that HIPAA has no certification, so no consultant can issue one.
Group health plan and TPA experience
Ask whether the firm has worked with self-funded group health plans, fully insured plans and third-party administrators, since their data flows differ. A firm that has only reviewed hospital networks may not map claims systems, eligibility feeds or member portals correctly. Ask for the systems they reviewed in similar engagements, how they traced ePHI through a TPA, and who on the team has done that work. Confirm that named staff, not only the sales lead, will perform the analysis.
Understanding of 164.314 plan documents
Under 45 CFR 164.314(b), a group health plan must make sure its plan documents require the plan sponsor to safeguard the ePHI it handles for the plan. A capable consultant will review those plan documents, check the required sponsor duties on safeguards, agents and incident reporting, and flag gaps. Ask them to show a sample gap finding from a plan document review, and confirm they will read the actual documents rather than a template.
Independence from the plan administrator
If the same TPA that runs claims also writes the risk analysis or signs off on its results, the review tests the vendor's own work. Ask whether the consultant has any reselling, hosting or administration relationship with the plan's administrator or its subcontractors. Where a conflict exists, ask how it will be disclosed in writing and whether the plan sponsor will receive findings directly. Independence matters most for the risk analysis, which OCR has cited in plan cases.
Written scope and boundaries
A written scope should name the plan, the sponsor, each business associate and subcontractor, the systems in scope, the time period, and the Security Rule standards covered. Without those boundaries, a review can miss the administrator's systems or the sponsor's own email and file shares. Ask for the scope in writing before work starts, along with the deliverables and what is excluded. Fixed scope with agreed deliverables makes it possible to compare quotes.
Evidence handover and ownership
Decide before work starts what the plan keeps: the risk analysis, the risk management plan, the system inventory, the plan document review and the remediation tracker. Ask the consultant to deliver the working files in formats the plan can maintain, and confirm who retains the source data. The organization owns its safeguards and records, so the consultant should prepare evidence the plan can present and update itself. Ask who will answer questions from OCR or an auditor after the engagement ends.
Questions to ask before signing
Before signing, ask for the names and roles of everyone who will touch plan data, how they will be trained and vetted, and whether a business associate agreement is in place with the consultant. Ask what they will not do, such as issue an attestation, and how their findings will be worded. Confirm that any third-party assessment is an independent opinion and that the plan retains responsibility for its own compliance. A reputable firm will answer these questions in writing.
Questions health plan buyers ask before bringing in outside help
Can a plan sponsor rely on its TPA's HIPAA compliance?
Not entirely. A third-party administrator that handles PHI for a group health plan may be a business associate, and it carries its own Security Rule duties for the ePHI it creates, receives, maintains or transmits. That does not transfer the plan's obligations to the TPA. The plan remains responsible for its own safeguards and for its contracts. Before relying on a TPA, ask for its written safeguards, its most recent risk analysis summary, its incident reporting terms and the business associate terms that flow down to its subcontractors. Confirm these in the contract rather than assuming them from a marketing statement. The Security Rule's business associate and organizational requirements in 45 CFR 164.314 set the baseline the contract should reflect.
Is a group health plan document enough to meet the Security Rule?
No. A plan document is one required piece. Under 45 CFR 164.314(b), a group health plan must make sure its plan documents require the plan sponsor to reasonably and appropriately safeguard the ePHI it handles for the plan, unless an exception in the rule applies. The provisions must cover administrative, physical and technical safeguards, support the separation required by 164.504(f)(2)(iii), require agents to agree to security measures, and require the sponsor to report security incidents to the plan. The plan still needs a risk analysis, policies, workforce controls and documentation under the rest of Subpart C. A well-drafted plan document with no working safeguards behind it will not satisfy an assessor.
How long does HIPAA readiness take for a health plan?
The honest answer is that the timeline depends on the environment, and no fixed duration is supplied for this work. The main drivers are the number of systems that hold ePHI, whether the plan's data flows through a TPA or claims platform, how mature the existing risk analysis is, how many plan document and business associate agreements need revision, and how much remediation the gap findings produce. Ask any provider for a written schedule that separates discovery, risk analysis, remediation, evidence collection and review, and for the assumptions behind each phase. The HHS-supplied risk analysis guidance and NIST SP 800-66 Rev. 2 give the structure most schedules follow.
What does the work need from our internal staff?
Internal staff must own decisions that outside help cannot make for the plan. Expect to name a security official, supply system inventories, identify who owns each claims, enrollment and member data flow, approve policies, and confirm which TPA and vendor relationships process ePHI. Staff from benefits, HR, legal and IT all contribute. The organization owns its controls and their operation, so someone internal must be able to answer for them after the engagement ends. Ask a provider which tasks it expects you to perform, how many hours of staff time it assumes, and who signs off on each deliverable. A partner can prepare systems and evidence, but it cannot run the plan's governance for it.
Does a third-party HIPAA assessment give us a certificate?
No. There is no HIPAA certification. HHS states that no Security Rule standard requires certifying compliance, that HHS does not endorse or recognize private certifications, and that a certification does not prevent HHS from later finding a violation. A third-party assessment or readiness review can show the work performed and the gaps found, but it is not an official finding. Be cautious about any document that calls itself a HIPAA certificate or seal. Ask for the scope, the method, the evidence reviewed and the limits stated in the report. Your own risk analysis and documentation remain the primary record that OCR will request during an investigation.
What does a fixed-scope engagement cover?
A fixed-scope engagement covers only what the written scope names. DeployOpen works this way for most engagements, with scope, deliverables and timelines agreed in writing before work starts. For a health plan, the scope should list the in-scope systems, the plan documents and TPA agreements to be reviewed, the safeguards to be implemented or documented, the evidence to be prepared and the handover items. DeployOpen implements, hardens, documents and supports self-hosted open-source platforms inside the client's own environment, and it prepares controls and evidence for assessment. It does not issue audit reports or certifications, and it does not provide legal opinions on plan documents. Ongoing support and continuous testing are available as separate retainers, and the quote follows from the written scope.
What should a health plan ask for in a quote?
Ask for a quote that lists each deliverable, the systems and TPAs in scope, the assumptions about staff time and existing documentation, and what is excluded. Separate one-time work, such as the initial risk analysis, plan document review and remediation, from recurring work, such as annual risk analysis updates, workforce training, access reviews and retainer support. Costs rise when more systems hold ePHI, when plan documents need substantial rewriting, when remediation is large, or when several TPAs must be reviewed. Costs fall when inventories are current and policies already exist. Ask who performs each task and whether an independent assessor is needed for any evidence you plan to rely on externally.
How DeployOpen prepares plan systems and evidence for assessment
DeployOpen plans, implements and documents self-hosted open-source platforms inside the plan's own infrastructure, so the safeguards and records a health plan or administrator must show are built into its environment. We prepare systems, controls and evidence for an assessment, while the organization owns its controls and an independent auditor or assessor issues any report.
How we scope
- Written scope agreed before work starts, naming the plan systems, ePHI flows and sponsor or administrator boundaries in scope.
- Scope records which plan sponsor and administrator functions are covered, so separation and plan document duties are explicit.
- Fixed-scope engagements, with deliverables and timelines confirmed in writing before any configuration begins.
How we build
- Deploy and harden open-source platforms in your own cloud accounts, data centers or air-gapped networks with access control and audit logging enabled.
- Configure safeguards mapped to each standard and implementation specification in scope, documenting any addressable decisions and alternatives.
- Integrate authentication, encryption in transit and at rest, and backup and recovery, with configuration recorded as evidence.
How we hand over
- Deliver written documentation of configurations, policies, procedures and the evidence each safeguard produces, for your review.
- Provide an evidence index that shows where logs, access reviews and test results are stored and how long they are retained.
- Walk your security official and plan staff through operation, so the organization can maintain the controls after handover.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the original engagement.
- Security testing of applications, APIs and infrastructure can be scheduled to inform the risk analysis and any later review.
- Confirm with your auditor or assessor which evidence they will accept, since DeployOpen does not issue reports or certifications.
Sources and further reading
- 45 CFR 164.314(b), eCFR ↗
- 45 CFR 160.103 Definitions, eCFR ↗
- NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide ↗
- HHS OCR: SG Health Plan Resolution Agreement and Corrective Action Plan ↗
- HHS OCR: L.A. Care Health Plan Resolution Agreement and Corrective Action Plan ↗
- HHS OCR: Consociate, Inc. Resolution Agreement and Corrective Action Plan ↗
