HIPAA Security Rule Gap Assessment
HIPAA Security Rule gap assessment to prioritize safeguard improvements
Evaluate how your safeguards, policies and supporting evidence align with the HIPAA Security Rule. ICA's scoped review gives compliance and IT leaders a safeguard gap matrix, findings report and corrective-action priorities for planning improvements.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Decide which safeguard gaps need attention
Your policies may describe controls that are difficult to demonstrate. A customer due-diligence request may expose missing records. Compliance and IT teams may disagree about which Security Rule gaps deserve attention first.
This assessment is intended for healthcare compliance officers, CISOs and IT directors who need a documented view of safeguard alignment. It connects the agreed review areas to available evidence so leaders can distinguish policy work from operational improvements. That gives budget and delivery discussions a concrete starting point.
Review safeguards in their operating context
Coverage is agreed across administrative, physical and technical safeguards, together with relevant policies, procedures and supporting records. The review concerns electronic protected health information, or ePHI, within the defined entities and environments.
Administrative coverage may include security responsibilities, workforce practices, incident procedures and contingency planning evidence.
Physical coverage may address documented facility access, workstation safeguards and device or media handling.
Technical coverage may consider evidence for access controls, authentication, activity review and transmission safeguards.
Scoping identifies the entities and safeguard areas to review, plus the depth of sampling. A shared policy may apply across several locations while implementation differs locally. The assessment boundary should make those differences visible rather than imply that a small sample represents every setting.
Compare written procedures with supporting evidence
The proposed method is document and evidence review. Policies establish the intended practice; supporting records help show how that practice operates. Depending on scope, evidence might include training records, access-review records, documented incident procedures or device-handling records.
Your control owners help clarify the materials and explain gaps or inconsistencies. The review should distinguish missing documentation from evidence that a safeguard needs improvement. Where records are incomplete, findings should explain the uncertainty instead of treating a written policy as proof of effectiveness.
This method does not include vulnerability scanning, penetration testing or hands-on configuration validation. Those activities need a separately agreed technical scope and appropriate authorization.
Use the findings to plan corrective action
Typical deliverables are defined in the engagement scope. They organize the review into three connected planning outputs.
Safeguard gap matrix. A structured comparison of the agreed safeguard areas with the evidence reviewed and identified gaps. Compliance and control owners can use it to see where supporting documentation or practices need attention.
Findings report. An explanation of the assessment coverage and observations, including material evidence limitations. Leadership can use it to understand the basis for the findings before deciding how to address them.
Corrective-action priorities. Recommended priorities for addressing the gaps. Your team can use these to discuss sequencing and assign responsibility within its own improvement process. They do not include executing the changes.
Set the scope around your entities and evidence
Cost and timing depend on the number of entities, safeguard coverage and sample depth. Evidence readiness and the participation of relevant owners also affect the work. A broad multi-entity review requires different effort from a focused review of selected safeguards.
Prepare an outline of the entities and ePHI environments in scope, alongside current Security Rule policies and relevant prior findings. Identify who can explain the safeguards and provide supporting records. Agree appropriate evidence-access and handling arrangements before sharing sensitive materials; the review should use only what is necessary for its purpose.
Keep gap review distinct from risk analysis
A compliance gap review is not by itself a complete enterprise risk analysis. HIPAA risk analysis considers potential risks and vulnerabilities across all ePHI an organization creates, receives, maintains or transmits. A limited safeguard review does not automatically satisfy that organization-wide requirement.
Coordinate this work with CMP-01, HIPAA Security Risk Assessment & Risk Management Plan, when risk analysis or risk-treatment planning is the primary need. Privacy practices and breach-notification processes require a different review focus. This assessment supports improvement decisions without certifying HIPAA compliance or guaranteeing a regulatory outcome.
Questions about the safeguard gap assessment
Who is this assessment for?
Healthcare compliance officers, CISOs and IT directors evaluating Security Rule alignment. It suits policy-gap concerns and customer due diligence where a defined evidence review can support corrective-action planning.
Will it cover every entity and safeguard?
Coverage depends on the agreed scope. Entities, safeguard areas and sampling depth must be explicit, with exclusions recorded. Selected samples should not be presented as exhaustive review of the organization.
Can we begin with the documents we already have?
Yes. Existing policies and supporting records provide the starting point. Their completeness affects what the review can establish, and control owners may need to clarify how documented procedures operate.
What determines cost and timing?
The number of entities, safeguard coverage, sample depth and evidence availability shape the effort. The engagement scope needs those details before price and timing can be confirmed.
How does this differ from a HIPAA risk assessment?
This review focuses on safeguard alignment and gaps. CMP-01 addresses ePHI risks and risk-management planning. Coordinate the scopes when both are needed; a limited gap review alone is insufficient for complete enterprise risk analysis.
Does ICA implement the corrective actions?
The catalog outputs are assessment and planning deliverables. Your organization owns implementation; remediation execution or subsequent validation requires a separate agreement. The findings do not certify compliance.
Give your safeguard improvement plan a documented basis
Discuss the entities, safeguard concerns and evidence behind your current decision. A well-defined gap assessment can help your compliance and IT teams agree what needs attention and use the findings to plan corrective action within a clear review boundary.
Decide which safeguard gaps need attention
Your policies may describe controls that are difficult to demonstrate. A customer due-diligence request may expose missing records. Compliance and IT teams may disagree about which Security Rule gaps deserve attention first.
This assessment is intended for healthcare compliance officers, CISOs and IT directors who need a documented view of safeguard alignment. It connects the agreed review areas to available evidence so leaders can distinguish policy work from operational improvements. That gives budget and delivery discussions a concrete starting point.
Review safeguards in their operating context
Coverage is agreed across administrative, physical and technical safeguards, together with relevant policies, procedures and supporting records. The review concerns electronic protected health information, or ePHI, within the defined entities and environments.
Administrative coverage may include security responsibilities, workforce practices, incident procedures and contingency planning evidence.
Physical coverage may address documented facility access, workstation safeguards and device or media handling.
Technical coverage may consider evidence for access controls, authentication, activity review and transmission safeguards.
Scoping identifies the entities and safeguard areas to review, plus the depth of sampling. A shared policy may apply across several locations while implementation differs locally. The assessment boundary should make those differences visible rather than imply that a small sample represents every setting.
Compare written procedures with supporting evidence
The proposed method is document and evidence review. Policies establish the intended practice; supporting records help show how that practice operates. Depending on scope, evidence might include training records, access-review records, documented incident procedures or device-handling records.
Your control owners help clarify the materials and explain gaps or inconsistencies. The review should distinguish missing documentation from evidence that a safeguard needs improvement. Where records are incomplete, findings should explain the uncertainty instead of treating a written policy as proof of effectiveness.
This method does not include vulnerability scanning, penetration testing or hands-on configuration validation. Those activities need a separately agreed technical scope and appropriate authorization.
Use the findings to plan corrective action
Typical deliverables are defined in the engagement scope. They organize the review into three connected planning outputs.
Safeguard gap matrix. A structured comparison of the agreed safeguard areas with the evidence reviewed and identified gaps. Compliance and control owners can use it to see where supporting documentation or practices need attention.
Findings report. An explanation of the assessment coverage and observations, including material evidence limitations. Leadership can use it to understand the basis for the findings before deciding how to address them.
Corrective-action priorities. Recommended priorities for addressing the gaps. Your team can use these to discuss sequencing and assign responsibility within its own improvement process. They do not include executing the changes.
Set the scope around your entities and evidence
Cost and timing depend on the number of entities, safeguard coverage and sample depth. Evidence readiness and the participation of relevant owners also affect the work. A broad multi-entity review requires different effort from a focused review of selected safeguards.
Prepare an outline of the entities and ePHI environments in scope, alongside current Security Rule policies and relevant prior findings. Identify who can explain the safeguards and provide supporting records. Agree appropriate evidence-access and handling arrangements before sharing sensitive materials; the review should use only what is necessary for its purpose.
Keep gap review distinct from risk analysis
A compliance gap review is not by itself a complete enterprise risk analysis. HIPAA risk analysis considers potential risks and vulnerabilities across all ePHI an organization creates, receives, maintains or transmits. A limited safeguard review does not automatically satisfy that organization-wide requirement.
Coordinate this work with CMP-01, HIPAA Security Risk Assessment & Risk Management Plan, when risk analysis or risk-treatment planning is the primary need. Privacy practices and breach-notification processes require a different review focus. This assessment supports improvement decisions without certifying HIPAA compliance or guaranteeing a regulatory outcome.
Questions about the safeguard gap assessment
Who is this assessment for?
Healthcare compliance officers, CISOs and IT directors evaluating Security Rule alignment. It suits policy-gap concerns and customer due diligence where a defined evidence review can support corrective-action planning.
Will it cover every entity and safeguard?
Coverage depends on the agreed scope. Entities, safeguard areas and sampling depth must be explicit, with exclusions recorded. Selected samples should not be presented as exhaustive review of the organization.
Can we begin with the documents we already have?
Yes. Existing policies and supporting records provide the starting point. Their completeness affects what the review can establish, and control owners may need to clarify how documented procedures operate.
What determines cost and timing?
The number of entities, safeguard coverage, sample depth and evidence availability shape the effort. The engagement scope needs those details before price and timing can be confirmed.
How does this differ from a HIPAA risk assessment?
This review focuses on safeguard alignment and gaps. CMP-01 addresses ePHI risks and risk-management planning. Coordinate the scopes when both are needed; a limited gap review alone is insufficient for complete enterprise risk analysis.
Does ICA implement the corrective actions?
The catalog outputs are assessment and planning deliverables. Your organization owns implementation; remediation execution or subsequent validation requires a separate agreement. The findings do not certify compliance.
Give your safeguard improvement plan a documented basis
Discuss the entities, safeguard concerns and evidence behind your current decision. A well-defined gap assessment can help your compliance and IT teams agree what needs attention and use the findings to plan corrective action within a clear review boundary.