Compliance
HIPAA Consulting for Austin clinics
The HIPAA program and the systems the practice runs should tell the same story. Identity, devices, email, and backups sit with the written program for Austin and Central Texas clinics.
Who it’s for
A program the environment can defend
HIPAA Consulting fits clinics, practices, and other covered entities or business associates that already have a HIPAA program, or must have one, and need the live systems to match it.
You keep the legal obligation. We run the operator work on accounts, devices, email, and backups so the paperwork and the practice are describing the same environment.
Day to day clinic support lives on Healthcare IT. The broader map of Texas and contract programs lives on Regulatory Compliance. This page is the written program and the evidence file.
Support
What ALCON DTS supports
A HIPAA program has to run on the systems the practice already uses. That means knowing where patient information lives, who can open it, which vendors touch it, and whether the written procedures match that picture.
You keep the legal obligation and the assessor. We run the operator work on accounts, devices, email, and backups, and we keep the evidence file with you: BAAs, risk analysis, training records, and procedures staff can find. Where our services require a BAA, we execute one and write the scope so both sides know what sits under it.
The result is an environment and a file that tell the same story. Patient information stays in approved systems.
Business Associate Agreements
A BAA is part of the relationship when our services require one. The agreement names the work. Patient information stays in approved systems.
Identity and access
Who can sign in, who can change privileged settings, and how access applies to staff who touch patient information. Those rules live in the directory the practice already runs, including Microsoft 365 or Google Workspace.
Managed devices and encryption
Windows, macOS, iPhone, and iPad used for clinic work stay updated, protected, and encrypted. A lost or unmanaged device is treated as something to close, with a named owner.
Mailbox controls
Inbound filtering, mailbox permissions, and forwarding stay current. Quiet forwarding is one of the ways patient information still leaves the practice.
Backups and restore
You know what is backed up, who can restore, and what back to work looks like. Patient information is restored only into approved systems.
Written procedures
Procedures describe the environment the practice operates today: who approves changes, how the system list stays current, and how BAAs are kept. Staff can find them.
What’s included
What the program includes
HIPAA Consulting is the program work that sits with Healthcare IT: assessment, training, written procedures, and a place to keep the evidence.
Risk assessment
We do the security risk analysis the practice needs to keep current: where patient information lives, which threats matter, and a work plan. Leadership leaves with a snapshot it can use.
Workforce training
New-hire and annual HIPAA security training with completion records, and reminders so training does not lapse. This is documentation the practice can show.
Policies and procedures
Policies cover HIPAA Security and Omnibus expectations and match how the practice actually runs. They stay aligned with accounts, devices, and mail.
Compliance workspace
A workspace for BAAs, incident notes, disaster plans, contracts, and the audit file. It supports the program. It does not make the covered entity HIPAA certified.
What you receive
The documents your HIPAA program runs on
- Executive summary for practice leadership
- ePHI inventory of systems, data flows, and access
- Risk register rated by likelihood and impact
- Remediation roadmap with owners and target dates
- Policy and procedure set mapped to the Security Rule
- Evidence checklist kept current in your compliance workspace
- Workforce training records
- Quarterly progress reviews and an annual risk analysis refresh
See a sample report
Samples use fictional organizations and data. Your report reflects your environment.
A sample HIPAA risk analysis for a fictional two-location clinic. Preview two pages here, or get the full seven-page sample.
Your sample is ready
We also emailed you a copy.
Download the full sample (PDF)
Want to see what a review would cover for your organization? Request a review
How it works
From review to a living program
HIPAA Consulting is the written program and the evidence file. Healthcare IT is day to day support for the clinic. Secure IT is the tighter security and compliance layer when that belongs in the same relationship.
We start with where patient information lives: which systems, mailboxes, and devices. Then we close the gaps so the program and the live environment tell the same story. EHR, billing, and hospital platforms stay with their owners. We run the infrastructure that connects and supports them.
Compare
Which path fits
A review of your needs and growth plans shows whether a written consulting scope, Healthcare IT, or Secure IT should carry the next work.
Remote IT
$100–$150 / user / month
Remote-first helpdesk, endpoints, and email. A technician can be dispatched when needed.
Unlimited remote support24/7 system monitoringVendor managementMonthly serviceQuarterly business reviews
Total IT
$150–$250 / user / month
Remote support plus a technician in the office when the request needs it.
Everything in Remote ITOn-site supportCybersecurity awareness trainingBusiness continuity planningEndpoint protection
Secure IT
$250–$400 / user / month
Everything in Total IT with tighter security and compliance built into the same support.
Everything in Total ITvCISO serviceBusiness continuity solutionEmail phishing security testingCybersecurity framework guidance
Next step
Start with a review
A review of your needs and growth plans looks at where patient information lives, what the environment already supports, and where the practice is going. You leave knowing whether Healthcare IT, Secure IT, or a written consulting scope is the next step.
