Kief Studio

HIPAA compliance consulting

Protect

Pass the audit because the system is actually hard to attack.

HIPAA compliance consulting helps a healthcare or biotech business build systems that meet the HIPAA Security Rule and hold up to a real attacker. It is also for Massachusetts businesses working through 201 CMR 17, and for teams facing SOC 2 or PCI DSS questions. Kief Studio reviews your controls and your design, closes the gaps in the systems themselves, and helps you document the result.

What we do

  1. Map the rules that apply to you and where regulated data actually lives.
  2. Review controls and system design against those rules and against real attack paths.
  3. Close the gaps in the systems first, then bring the documentation in line.
  4. Prepare evidence your auditor can use, and keep it current as the systems change.

Who it is for

Healthcare, biotech, and other regulated businesses handling protected health information, or personal information about Massachusetts residents.

When to look elsewhere

A certificate with no change to the systems behind it. We are also not your auditor of record, and we keep those roles apart.

What we can stand behind

  • Security is a byproduct of good engineering.
  • No shared hosting. Dedicated infrastructure.
  • 13+ year client relationships.

HIPAA and compliance consulting: common questions

  • Are you our auditor of record?
    No. We help build and harden the systems and prepare the evidence. Your auditor is a separate, independent firm, and keeping those roles apart is part of doing this right.
  • Is passing an audit the same as being secure?
    No. An audit checks that controls exist at one moment. Security is whether an attacker can get in. You need both, and the systems should come first so the paperwork describes something real.
  • Do you help with 201 CMR 17?
    Yes. Massachusetts requires a written information security program from businesses holding residents' personal information. We help build the program and the technical controls it describes.
  • Where can we read the rules themselves?
    MyRHC at myrhc.com indexes compliance frameworks and the official documents they come from. It is a good place to read the source before we talk.
Knowledge base

Read the long version

All Protect services