HIPAA that survives contact with a health system's diligence.
We assess the agreed environment and prepare evidence requests and materials for review. You supply accurate business information and implement safeguards, or approve a separate implementation engagement.
- A real risk analysis under Section 164.308(a)(1)(ii)(A), refreshed - the first thing OCR requests
- Every addressable specification implemented or documented as to why not
- BAAs tracked in both directions, upstream and down to your subcontractors
Nobody certifies HIPAA. You have to be able to show your work.
There is no HIPAA certificate, and any vendor implying otherwise is selling you a logo. What exists is a documented program you can put in front of a health system's diligence team or a regulator - so that is what we build.
The risk analysis, done properly
The most-cited failure in OCR enforcement is a risk analysis that is missing, stale, or scoped to a fraction of where PHI lives. We map the PHI, run the analysis, and keep it current.
Addressable is not optional
Addressable specifications - encryption, automatic logoff, integrity controls - are implemented, or the reasoning and the alternative are documented. Silence is the finding.
The BAA chain, both directions
Agreements with the covered entities above you and every subcontractor below you, tracked with dates - because your customers will ask about your vendors.
Record incident responsibilities before an incident
Prepare the escalation process and identify the customer decision-makers. Incident response, legal advice, and breach notification execution are outside the annual package and require separate arrangements.
What HIPAA actually requires of you.
Three rules do the work. Which apply depends on whether you are a covered entity or a business associate - most software companies are the latter, and the obligations still land directly on you.
Administrative safeguards
Section 164.308Risk analysis and management, workforce access and sanctions, training, contingency planning, and periodic evaluation. The largest bucket by far.
Physical safeguards
Section 164.310Facility access, workstation use and security, and device and media controls including disposal and reuse.
Technical safeguards
Section 164.312Access control, audit controls, integrity, authentication, and transmission security across systems holding ePHI.
Privacy Rule
Section 164.500+Permitted uses and disclosures, minimum necessary, individual rights of access, and notice obligations.
Breach Notification Rule
Section 164.400+The four-factor assessment, individual and HHS notification, and the 60-day outer limit for notice.
Business associate agreements
Section 164.314Contracts flowing obligations from covered entities through you and on to every subcontractor that touches PHI.
There is no such thing as HIPAA certification - no government body issues one. What you can hold is a documented, evidenced program plus an independent assessment, and that is what health-system diligence teams actually evaluate.
From scoping call to defensible program.
Two phases are gated - PHI scoping and the risk analysis. Everything downstream is only as good as knowing where PHI actually lives, and that is the question most programs answer wrong.
Map where PHI lives
Systems, vendors, backups, logs, support tooling, and the places PHI ends up that nobody documented. Scope is the whole game and this is where programs quietly fail.
Run the risk analysis
A real analysis against the mapped environment, producing ranked risks and a risk management plan - the artifact OCR asks for first and the one most companies cannot produce.
Implement the safeguards
Administrative, physical, and technical safeguards implemented and evidenced. Every addressable specification either in place or documented with its alternative.
Operate, train, and stay ready
Workforce training, periodic evaluation, BAA renewals, and a breach process that has been walked through before you need it. Diligence questionnaires answered by us.
HIPAA: $20,000 a year total.
Startup base plus one framework.
$20,000/year including one framework. Each additional framework is $3,000/year. For companies under $5M revenue or 50 staff. The SOC 2 Type I, Security-only bundle includes the independent auditor fee. Type II audits, additional audit criteria, and other certification fees are quoted separately. Enterprise pricing is custom. The SOC 2 Type I, Security-only bundle is $20,000/year total, including the $3,000 independent auditor fee. Sythe coordinates preparation and the audit through the platform. The independent auditor performs the audit and issues the report. Type II audits and additional criteria are quoted separately.
For companies under $5M revenue or 50 staff. Base security services plus HIPAA support.
- 2 scoped penetration tests per year
- One scoped retest per penetration test
- 2 risk assessments per year
- 12 host-limited vulnerability scan runs per year
- Third-party risk document uploads and Q&A
- Compliance & GRC support for one included framework
- The Sythe Labs platform, run by us
Over $5M revenue or 50 staff. Negotiated to your scale and obligations.
- Enterprise scope agreed separately
- Additional assets and testing quoted to scope
- Service levels defined in your agreement
Sythe operators request and review evidence, prepare materials, and follow up in the platform. You supply business information and approve your organization's policies. Routine clarification, corrections, and supported platform integration repairs are included.
Ongoing security monitoring and incident response are additional services. We recommend fixes; hands-on changes to your systems require a separate implementation scope.
Strategic compliance advice and expressly delegated decisions use a vCISO retainer at $250/hour, with hours approved in advance. Kickoff and pentest scoping and closure meetings are included. Other routine delivery happens in the platform; recurring consulting meetings are extra.
The people who already handed it over.
"Jarred, Andrew, and their team are trusted partners - extensive penetration testing, code analysis, and security reviews that protect our users. We share a vision of prioritizing customer security above all else."
"Sythe Labs was great to work with. Extremely knowledgeable, responsive, and trustworthy. I'd recommend them to anyone looking for security or penetration testing."
"The strategic security recommendations from Sythe Labs have been invaluable. Their expertise helped us put real protection in place while keeping us moving fast."
Real engagements. Real outcomes.
The same programme, run for teams who had no security function when they started.
HIPAA, honestly answered.
The questions that come up on every HIPAA scoping call, answered before you have to ask them.
- Can we get HIPAA certified?
- No. No government body certifies HIPAA compliance, and a vendor selling you a certificate is selling a logo. What holds up in diligence is a documented program - current risk analysis, implemented safeguards, executed BAAs - plus an independent assessment.
- We are a business associate, not a covered entity. Does HIPAA apply to us?
- Yes. Since the HITECH Act, business associates are directly liable for the Security Rule and parts of the Privacy Rule, and can be enforced against directly. Most software companies serving healthcare are business associates.
- What does OCR ask for first in an investigation?
- The risk analysis, essentially every time. A missing, stale, or narrowly scoped risk analysis is the most frequently cited failure in enforcement actions, which is why we gate on it.
- Do we need SOC 2 as well?
- It depends on your customers. Some health systems ask for a SOC 2 report alongside HIPAA evidence. We scope what is needed; each additional framework is $3,000/year on top of the base plan.
- What does the $3,000 cover?
- The $20,000/year plan includes one framework; HIPAA can be that framework. Additional frameworks cost $3,000/year each. Routine evidence requests, preparation, review, and follow-up are included. Safeguard implementation, bespoke questionnaires, and advisory work require separate scope.
Answer the diligence questionnaire with evidence, not adjectives.
A 30-minute call. We will tell you where your PHI actually is, what your risk analysis is missing, and what a defensible program costs - whether or not you hire us.