Risk Assessment
The written, current risk assessment is the first document regulators request. Not having one is itself a finding.
Free Tool · HIPAA Security Self-Check
Is your practice HIPAA-ready? Find out in 2 minutes
After a breach, regulators do not ask whether you meant well. They ask for your risk assessment, your training records, your encryption and your agreements. This free self-check covers the safeguards they look at first, instantly and privately. Educational, not legal advice.
⏱ 2-Minute Check
🏥 Built for Practices
🔒 Private & Free
★ By Orca IT
For medical, dental and healthcare practices · instant results, answers stay in your browser
What We Check
The safeguards reviewers ask for first
The 12 questions map to the everyday technical and process safeguards that decide how a breach investigation goes.
Business Associate Agreements
Every vendor that touches patient data, from email to backups to IT, needs a signed BAA. Missing ones are a classic penalty.
Encryption & Devices
A lost laptop with encrypted data is a non-event. Unencrypted, it is a reportable breach.
Logins, MFA & Access
Individual logins, multi-factor and role-based access are the technical core of the Security Rule.
Backups & Disposal
Patient data must be recoverable, and provably destroyed when hardware retires.
Training & Response
Documented annual training and a written breach procedure are what turn an incident into a managed event.
Why It Matters
Compliance is cheaper than the alternative
Penalties scale with negligence. Practices that can show working safeguards fare very differently from those that cannot.
The paperwork is evidence
Risk assessments, training logs and BAAs are your proof of good faith. Without them, every incident looks like neglect.
Encryption is a safe harbor
Properly encrypted data that is lost or stolen generally is not a reportable breach. It is the single best protection you can buy.
Small practices are targets
Attackers know smaller practices hold the same valuable records with fewer defenses.
Staff are the front line
Most healthcare breaches start with email. Trained staff and MFA stop the majority of them.
Vendors are your risk too
Your billing service, email host and IT provider handle your patient data. BAAs and vetting are your responsibility.
Fixes are well defined
Unlike many business problems, HIPAA safeguards are a known checklist. Closing gaps is systematic work.
How It Works
From gaps to audit-ready
01
Self-Check
Answer the 12 questions above. Your result is instant.
02
Get the Report
Send it to us and we reply with a free, prioritized gap report.
03
Close the Gaps
We implement the technical safeguards and help document them.
04
Stay Ready
Ongoing protection and yearly reviews keep you prepared, not scrambling.
After a breach is the worst time to start.
Two minutes now shows you exactly where you stand, and every gap has a defined fix.
Why Orca
Why practices bring this to Orca
We handle the technical side of HIPAA for healthcare practices, and we speak plain English, not legalese.
Healthcare is a core vertical
We support medical and dental practices every day, so the workflows and systems are familiar territory.
Technical safeguards, done right
Encryption, MFA, access control, backups and disposal, implemented and documented properly.
Plain-language reporting
Your gap report reads like a to-do list, not a statute.
We work with your compliance advisors
We are your IT and security arm, and we coordinate cleanly with your legal or compliance counsel.
20+ years of experience
Two decades securing businesses, including the systems patient data lives on.
Local and accountable
Onsite across the Phoenix area, remote support anywhere, and documentation you can hand to an auditor.
Questions
The HIPAA check, answered
Is this an official HIPAA certification or audit?
No. There is no official HIPAA certification, and this is an educational self-check, not legal advice. It shows where you stand on the common technical and process safeguards so you can act before an incident.
Who should take this check?
Anyone handling protected health information: medical and dental practices, therapists, chiropractors, labs, and the business associates that serve them.
Do you see my answers?
Not unless you send them. The check runs in your browser, and your answers only reach us if you submit the form for your free gap report.
What does Orca actually fix?
The technical safeguards: encryption, individual logins and MFA, role-based access, automatic locking, tested encrypted backups, secure disposal, and the documentation for each. For policies and legal questions we coordinate with your compliance counsel.
We have a compliance binder from years ago. Are we covered?
A stale binder is one of the most common findings. HIPAA expects your risk assessment and training to be current, and your safeguards to actually be running, not just written down.
How fast can gaps be closed?
Most technical gaps, MFA, encryption, backups, screen locks, are closed within days to a couple of weeks. Documentation and training follow right behind.
What does this cost?
The check and the gap report are free. If you want us to close the gaps, we quote it plainly first, and many practices roll it into predictable monthly managed IT.
Free Tools
More free tools from Orca
No email walls, no tricks. Useful tools that run right in your browser.
Your Free Report
Get your free HIPAA gap report.
Send your result and we will reply with a prioritized, plain-language plan to close every gap. Free, no pressure. Or just call.
(602) 677-0779For healthcare practices · Onsite across the Phoenix area and remote
Send me my gap report
A few details and we’ll get right back to you to help.