HIPAA Security Rule assessments for UK service providers.
If you’re a UK Business Associate to US Covered Entities, we run the §164 risk analysis, evidence the safeguards, and produce the report your customers and their auditors want to see.
What is HIPAA?
The Health Insurance Portability and Accountability Act is the US federal law governing the use and disclosure of protected health information (PHI). It comprises three rules: the Privacy Rule, the Security Rule (45 CFR Part 164, Subpart C), and the Breach Notification Rule. The Security Rule covers electronic PHI specifically and is what we focus on in our assessment work.
For UK organisations, HIPAA reaches you when you act as a Business Associate — a contracted service provider to a US Covered Entity (a health plan, healthcare clearinghouse, or healthcare provider). Your contract with the Covered Entity (a Business Associate Agreement) flows down HIPAA obligations to you, and breaches involving your systems can trigger US regulatory attention through your customer.
Key facts
- 45 CFR Part
- 164
- Safeguard categories
- 3
- Our typical client role
- BA
- US enforcement body
- OCR
What we do
Four engagement components covering risk analysis, safeguards, contracts, and ongoing operation.
Risk analysis (§164.308(a)(1)(ii)(A))
The foundational HIPAA Security Rule requirement. We document the ePHI you handle, threats and vulnerabilities, current safeguards, residual risk, and the analysis methodology.
Safeguards review and gap report
Test administrative, physical, and technical safeguards against §164.308 / §164.310 / §164.312. Evidence-based findings with remediation guidance.
BAA review and support
Review of Business Associate Agreements with your Covered Entity customers and any subcontractors. Identify gaps, drafting support, and negotiation positioning.
Remediation and ongoing support
Where safeguards need work, we support implementation. Ongoing review on retainer for clients with frequent customer audits or new processing on ePHI.
How a HIPAA engagement runs
Five stages from scoping call to reassessment cycle. Annual cadence thereafter.
- 1
Scoping call
30 minutes, freeWe confirm your role (Business Associate, subcontractor BA, or both), the ePHI you handle, your Covered Entity customers, and the trigger for the engagement (new contract, customer audit, post-incident).
- 2
Risk analysis
3–5 weeksThe §164.308(a)(1)(ii)(A) risk analysis — documented inventory of ePHI, threats and vulnerabilities, likelihood and impact, current safeguards, residual risk. The foundation document.
- 3
Safeguards gap assessment
2–4 weeksAdministrative, physical, and technical safeguards tested against §164.308, §164.310, §164.312. Findings come with severity, evidence, and remediation guidance.
- 4
Remediation support
VariableWe support your team through fixes — policies, technical controls, training programmes, BAA drafting. No throw-it-over-the-wall handover.
- 5
Annual reassessment
AnnualHIPAA expects risk analysis to be ongoing. We reassess annually or when there is a significant change to systems, ePHI flows, or your customer base.
The three Security Rule safeguard categories
The HIPAA Security Rule organises its requirements into three categories. Each contains both required and addressable implementation specifications.
Why 1 Sequence Cyber
PCI SSC-listed QSAC
Listed on the PCI Security Standards Council website as a Qualified Security Assessor Company. Independent assessment is what we do; HIPAA Security Rule assessments apply the same evidentiary discipline.
CREST DPT alignment
Penetration Testing aligned to the CREST Defensible Penetration Test specification — directly relevant to §164.312(a)(1) (technical access control) and §164.308(a)(6) (security incident procedures).
Ready for your HIPAA assessment?
Tell us your role (Business Associate or subcontractor BA), the ePHI you handle, and what triggered the engagement. We’ll come back with a fixed-fee proposal within 48 hours.
Back to all services.