Scope & responsibilities
Specific scope.
Clear responsibilities.
A website implementation can support your obligations. Compliance also depends on your organization, vendors, and operating practices.
Included when agreed in writing
Public-facing page design, accessible forms for non-sensitive inquiries, security headers, tracking inventory, documented data flows, and implementation of the consent behavior specified in the project scope.
Separate engagement required
Patient portals, PHI processing, clinical intake, sensitive integrations, compliance audits, penetration tests, legal opinions, formal accessibility certification, and continuing security monitoring. These require appropriate expertise, controls, vendors, and contracts.
Healthcare vendor review
A vendor used to create, receive, maintain, or transmit ePHI on behalf of a regulated entity may be a business associate. BAA eligibility alone does not establish that a particular configuration or workflow is appropriate.
Client and implementation responsibilities
The client owns its organizational risk assessment, notices, policies, vendor approvals, and operating procedures. Scott delivers the agreed technical scope and documents relevant assumptions and limitations. No blanket HIPAA certification is offered.
Read the compliance scope. Primary guidance: HHS cloud computing guidance and HHS tracking technology guidance.
Clarity starts with a conversation
Let’s make your next
digital decision a good one.
Book a 20-minute strategy call No pitch deck. Just the problem you want to solve.