An independent, documented risk assessment covering every system that creates, receives, maintains, or transmits ePHI.
Why an independent assessment
Self-attestation stopped working the moment your customers started sending vendor questionnaires. An independent hipaa risk assessment gives you a dated, third-party document that answers procurement, satisfies cyber-insurance underwriting, and shows an investigator you took §164.308(a)(8) seriously.
Scope
- Every system, application, and third party in the ePHI path
- All relevant implementation specifications, marked required or addressable
- Technical validation against live configuration where access permits
- Interviews with the people who actually operate the controls
Deliverable
Risk Assessment Report + risk register, containing:
- Executive summary with an overall posture rating
- Finding-by-finding detail: observation, rule citation, risk rating, recommendation
- Prioritised remediation plan with effort estimates
- Evidence appendix listing what was reviewed and when
- A shareable customer-facing summary
Timeline and price
| Duration | 2–3 weeks |
| Starting price | $5,500 |
| Re-assessment | Included within 90 days |
| Formats | PDF, DOCX, and loaded into your workspace |
What happens after you fill the form
- You get the deliverable immediately. No “a rep will contact you to unlock your download.”
- We read your answers before we call. The scoping call starts with what you told us, not a discovery script.
- You get a fixed-scope, fixed-price proposal in 2 business days — or a straight “you don’t need us yet,” which we say more often than you’d expect.
On the word “certified.” There is no government HIPAA certification. Any vendor selling you a “HIPAA Certificate” is selling a PDF they printed themselves. What regulators, customers, and insurers actually accept is a documented risk analysis, implemented safeguards, and evidence that both are maintained. That is what SuperHIPAA produces.