HIPAA compliance for an Indian company selling to US healthcare

The challenge

The company was entering the US market, and its first US healthcare customers wanted a signed business associate agreement and evidence that protected health information (PHI) would be safe. HIPAA was new to the team: they had sound engineering practices but nothing mapped to US healthcare requirements.

What we did

• Mapped where PHI enters, is stored and leaves the company's systems, including offshore support and cloud services.
• Ran a gap assessment against 55 requirements: 48 from the HIPAA Security Rule and 7 from the Breach Notification Rule.
• Guided the team through the risk analysis, access controls, encryption, audit logging, workforce training, contingency planning and business associate agreements with their own vendors.
• Shared policy and procedure templates the team adapted, and added two controls the first draft had missed: vulnerability and patch management, and anti-malware.
• Closed three documentation gaps before the assessment.
• An independent assessor, who took no part in the readiness work, then tested the evidence and issued a third-party HIPAA assessment report the company can share with US customers.

Timeline

1. PHI mapping and gap assessment
2. Risk analysis and remediation with our guidance
3. Independent assessment and report, two months after kickoff

Results

• All 55 Security and Breach Notification Rule requirements assessed, with gaps closed before the independent assessment.
• A third-party HIPAA assessment report ready for US customers' vendor reviews.
• The company won the US healthcare contract.

What made it work

Treating HIPAA as a US customer requirement, not just a legal checklist: the work focused on what US healthcare buyers check in vendor reviews, so the report answered their questions directly. There is no official HIPAA certification; an independent assessment report is how vendors show compliance.