HIPAA Security Rule
- Administrative safeguards (§164.308)
- Physical safeguards (§164.310)
- Technical safeguards (§164.312)
- Documentation and breach notification requirements
Home › Services › Healthcare Cybersecurity
Technology · Healthcare CybersecurityCybersecurity for practices without a security team.
Small and mid-size practices carry the same security obligations as large health systems, usually without a dedicated security team. Apollo XCM (AXCM) helps you document, test, and strengthen your security program.
Why listen to us
We hold ourselves to the same standard.
AXCM meets Epic’s strict security requirements, so we can support practices running Epic, something most of our competitors are unable to offer. Our team works from secured facilities on company-managed devices, and our environment is penetration tested.
We bring that same discipline to your practice.
Common gaps
Where practices fall behind.
- No dedicated security team, and often no full-time IT person
- HIPAA Security Risk Assessment overdue or never completed
- No written information security program on file
- EMR or health system partners ask for security documentation the practice can’t produce
- Staff security training inconsistent or undocumented
- No incident response plan
What’s at stake
The risk is real.
- HIPAA violations can bring civil penalties from the HHS Office for Civil Rights, assessed per violation
- Health system and EMR partners increasingly require security attestations
- A single ransomware incident can take a small practice offline for days or longer
- Security often gets attention only after an incident or a failed audit
Frameworks
Built on recognized security frameworks.
Our work maps to the HIPAA Security Rule and is aligned with ISO/IEC 27002:2022 controls.
ISO/IEC 27002:2022 control domains
- Organizational: governance, policies, roles, suppliers
- People: awareness, training, screening, remote work
- Physical: facility security, equipment handling
- Technological: access, encryption, system security, logging
Services
Take what you need, or the whole program.
Every service is available individually. Complex environments are scoped after a discovery call.
Compliance & documentation
- HIPAA Security Risk Assessment
- Written Information Security Program (WISP)
- Incident response plan, documented and tested
- Business continuity and disaster recovery planning
- Security awareness training
Security testing & hardening
- External penetration testing
- EMR security audit
- Microsoft 365 and Entra security hardening
- Monthly vulnerability scanning
Ongoing security partnership
- Monthly vulnerability scanning
- Quarterly control reviews
- Risk assessment updates
- Incident response readiness
Packages
Start where you are.
Compliance Foundation
For practices that need documented compliance for partners, EMR vendors, or regulators.
- HIPAA Security Risk Assessment
- Written Information Security Program
- Incident response plan
- Security awareness training
Security Hardening
For practices that want real security improvements, not just documentation.
- External penetration testing
- EMR security audit
- Microsoft 365 and Entra hardening
- Three months of vulnerability scanning
Complete Security Program
From no formal program to an ongoing security partner in one engagement.
- Everything in Compliance Foundation
- Everything in Security Hardening
- Twelve months of ongoing security partnership
How we keep it affordable
Built to pass the audit, priced for the practice.
Traditional security consulting is expensive because skilled people spend hours on repetitive documentation and monitoring. We use agentic operations to handle that routine work, always reviewed by people:
- Policy and compliance document drafting
- Continuous vulnerability monitoring and alert triage
- Control tracking that flags drift and keeps documentation current
- First-response triage and escalation routing during incidents
Our experts spend their time on the work that needs them.
FAQ
Frequently asked questions.
We don’t have an IT person. Can we still work with you?
Yes. Most practices we work with don’t have dedicated security staff. We explain findings in plain language and help you prioritize.
Do we need every service?
No. Every service is available on its own, and packages exist for the most common starting points.
What if we already have some security in place?
We start by reviewing what you have, then focus on the gaps instead of redoing work that’s already solid.
How does this help with EMR or health system partner requirements?
Partners often ask for evidence of a risk assessment, written policies, testing, and an incident response plan. Our deliverables are designed to give you that documentation.
Is a HIPAA Security Risk Assessment really required?
Yes. The HIPAA Security Rule requires an accurate and thorough risk analysis and ongoing risk management. We recommend reviewing it at least annually and whenever your systems or operations change significantly.
What’s the difference between vulnerability scanning and penetration testing?
Vulnerability scanning is automated and checks for known weaknesses on a recurring basis. Penetration testing is a hands-on exercise where security professionals try to exploit weaknesses the way an attacker would.
What happens during an incident?
Your incident response plan defines who does what. We help with triage, containment steps, documentation, and understanding your notification obligations.
How do we get started?
Every engagement starts with a scoping conversation, followed by a written proposal with defined scope and pricing.
Find your gaps before someone else does.
Every engagement starts with a scoping conversation about your practice, your systems, and your partners’ requirements.