We’ll review all aspects of your company that are relevant to the HIPAA Privacy and Security Rules (45 CFR Subtitle A, Subchapter C, Part 164), which at a high level cover: Administration safeguards (§ 164.308) Risk analysis Risk management Assigned security responsibility Workforce security Security awareness and training Security incident procedures Data backup plan Disaster recovery plan Physical safeguards (§ 164.310) Facility access control Facility security plan Maintenance records Workstation use Device and media disposal Technical safeguards (§ 164.312) Unique user IDs Automatic logoff Encryption and decryption Organizational requirements (§ 164.314) Policies and procedures and documentation requirements (§ 164.316) Breach notification requirements (§ 164.4) Minimum necessary requirement (§ 164.502) This includes your end-user devices, network/IT infrastructure, physical security, physical document storage, company policies, and training.