HIPAA is an annual obligation, not a one-time project

---

"Copperhead Defense runs the risk analysis, the workforce training and the technical safeguards the HIPAA Security Rule actually asks for — for medical and dental practices, imaging centers and senior living communities across Michigan. "

• A documented risk analysis, reviewed at least annually
• Security awareness and training for your whole workforce, with a record of who completed it
• Technical safeguards: access control, audit controls, data integrity, and transmission security
• A signed agreement with every vendor whose systems touch patient data

Most practices we meet are not negligent. They have a risk analysis from three years ago, training nobody logged, and a vendor list nobody has checked since the software was installed. The gap is ownership, not intent — the work is nobody’s job, so it does not happen.

1. Annual HIPAA risk analysis. Scoped with you, carried out against your real environment, and delivered in writing with a remediation plan you can actually work through — not a 90-page export nobody reads.
2. Workforce security awareness training. Delivered and recorded. The completion record is the evidence, not the training, and it is the part practices are most often missing when someone asks.
3. Technical safeguards, implemented and monitored. Multi-factor authentication on every account, conditional access, encrypted backup with restores that are actually tested, managed endpoint protection and patching, and intrusion detection at the network edge.
4. Evidence you can hand to somebody. Because the question is never “are you secure” — it is “show me.”

Nobody can sell you HIPAA compliance. There is no certification, no badge, and no product that makes a practice compliant by being installed. Any vendor who says otherwise is selling you a feeling.

What we can do is make the requirements concrete, do the work that satisfies them, and leave you holding the documentation that proves it.

Forty-five minutes, no cost, no obligation. We walk your current position against what the Security Rule requires and tell you where the gaps are. You keep the findings whether or not we ever work together.