Governance, Risk & Compliance · Govern
Organisations touching US health data often discover HIPAA through a healthcare client's assurance request, frequently without a documented risk analysis in place. We establish whether you act as a covered entity or business associate and for which data, then perform the security risk analysis the Security Rule requires with decisions recorded. From there we implement the administrative, physical and technical safeguards and put the business associate agreements and breach procedures in place. Because there is no recognised HIPAA certification, the deliverable is defensible evidence rather than a certificate — and we design for offshore teams explicitly where they can reach protected health information.
In short
HIPAA compliance work implements the safeguards and agreements required when handling protected health information. There is no official HIPAA certificate, so compliance is shown through a documented risk analysis, implemented safeguards and the evidence behind them.
Start a conversationWhat we do
We establish whether you act as a covered entity or a business associate, and precisely which data and systems that covers. The role determines which obligations fall on you and which flow through contracts, so getting it wrong misdirects the whole programme. It also clarifies which of your clients' and subcontractors' arrangements you depend on.
We perform the security risk analysis the Security Rule requires, with the decisions and their rationale documented. This analysis is not optional and is the first thing a regulator or auditing client looks for, yet it is the most commonly missing piece. Documenting the reasoning is what lets a later reviewer see that risks were considered rather than ignored.
We implement access control, encryption, audit logging, and the workforce and physical safeguards the rules call for. The safeguards are chosen to be proportionate and addressable, as the standard allows, rather than applied uniformly regardless of risk. Implementing them to fit existing operations keeps them in place once the project ends.
We put business associate agreements and breach assessment procedures in place so responsibilities and notification duties are clear in advance. Agreements that are missing or unreviewed leave you exposed to the actions of parties you do not control. A defined breach procedure means an incident is assessed against the notification thresholds calmly rather than improvised under pressure.
What you receive
Documented output your teams keep and can act on without us in the room.
When this work helps
How an engagement runs
Establish the obligations, decision rights, and risks that genuinely matter to this organisation. We separate the requirements that truly apply from those assumed to, so effort is not spent governing risks you do not carry.
Review existing controls, policy, evidence, and how the work is actually performed. We compare the control on paper with the control in practice, because the gap between the two is usually where the real risk sits.
Design a proportionate control set with named ownership, evidence, and review cadence. Every control has an owner who can operate it and a defined source of evidence, so nothing depends on memory or heroics.
Embed the changes with the teams doing the work, and test that the controls operate. We hand over controls the process owners can run themselves, rather than a framework only we understand.
Where we work
Fidova provides governance, risk and compliance consulting from Delhi, India, and works with organisations operating in several jurisdictions at once, mapping obligations across regions to one coherent control set.
Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end, with on-site time planned where a phase genuinely benefits from being in the room.
Related services
NIST framework implementation uses the Cybersecurity Framework to assess maturity and plan improvement across functions. It is a structured way to decide where to invest, not a certification, and its value is in the roadmap it produces.
Business continuity and disaster recovery planning establishes how the organisation keeps operating and recovers when systems or sites fail. An untested plan is an assumption, so the work is only finished once an exercise has shown it holds.
Third-party risk management controls the risk your suppliers, processors and partners introduce across their lifecycle. It is organised by what each supplier can actually affect, so scrutiny lands where it matters and routine purchases are not held up.
Questions
Straight answers to what buyers ask us before an engagement begins.
Enquiries
Your enquiry lands in the same inbox as every other on this site and is read by us. Tell us the requirement and we will reply with a practical next step.
Prefer email? contact@fidovaadvisory.com
Next step
