Independent guidance on the services practices actually buy. The full provider directory sits behind every topic.
Paneling, payer enrollment, CAQH, timelines, vendor selection.
In-house vs outsource, pricing models, coding, payer contracts.
EHR selection by specialty, migration, practice-management software.
Starting a practice, consultants, MSOs, vetting and costs.
HIPAA rules, malpractice coverage, healthcare counsel, verified vendors.
Five regulatory domains an independent practice actually has to manage. One of them -- HIPAA privacy and security -- has a real self-check tool today. The other four don't yet; this table says so plainly.
| Domain | The question | Self-check now | When to bring in help |
|---|---|---|---|
| HIPAA Privacy & Security | Are our safeguards where an audit would expect them? | Yes HIPAA Quick-Check, ~2 min → |
A risk analysis finds a real gap, or you're building or buying new systems. HHS has proposed stricter Security Rule safeguards (90 FR 898, proposed rule, 2025-01-06); if it finalizes, the bar moves. |
| HIPAA Breach & Incident | Do we have a response plan before we need one? | Partial Breach playbook → (a checklist, not a tool) |
Any suspected breach, immediately -- this is a clock, not a maybe: 60 calendar days from discovery for individual notice under 45 CFR 164.404, and the breach playbook is written to that clock. |
| Malpractice & Liability Coverage | Is our coverage the right type and limit? | Partial Comparison worksheet → |
A coverage change, a claim, or a new procedure or location. |
| OSHA & Workplace Safety | Are we exposed on the standards that actually get cited? | Partial OSHA guide → |
After any citation-triggering incident, or new equipment. The bloodborne pathogens standard also requires the exposure control plan to be reviewed and updated at least annually (OSHA, 29 CFR 1910.1030(c)(1)(iv), last amended 84 FR 21598, 2019-05-14). |
| Legal Counsel & OIG Exclusion | Do we need an attorney, and are we screening vendors and staff? | Partial Attorney guide → / OIG screening → |
Before a contract, or when setting up an exclusion-screening program. OIG publishes the List of Excluded Individuals/Entities with monthly supplements (OIG, LEIE database and supplement downloads, last update 2026-09-10); hiring anyone on it can trigger civil monetary penalties. |
When the triage matrix says to bring in help, this is who you would be bringing in: what each one sells, how it charges, and what stays your job after you sign. Built to be cited and embedded.
| Counterparty | What you buy | When it fits | Cost shape | What stays with you | |
|---|---|---|---|---|---|
DDo it yourselfPractice staff |
Staff time + the free HHS/ONC risk assessment tool | Staff know your own systems; a small screening population in one billing state | Staff time (manual OIG screening: roughly 15-45 min a month) | Everything, including the dated evidence | Full guide → |
SCompliance softwareProgram platform |
Policy templates, guided risk analysis, training, BAA templates | You want a structured program and a paper trail without a consultant | Monthly subscription | The ePHI inventory and each risk-management decision | Full guide → |
AOutside assessorCompliance consultant |
A third-party risk analysis and its documentation | Staff lack technical familiarity with your systems, or an audit exposure is already known | Per-engagement quote | The ePHI inventory and each risk-management decision; the Security Rule does not require an outside assessor | Full guide → |
ITIT vendor or MSPBusiness associate |
Management of the systems that hold ePHI | You need IT run for you, and the vendor signs a business associate agreement first | Ongoing service agreement with a BAA attached | A missing BAA is the practice's failure; the vendor's systems stay inside your risk analysis | Full guide → |
BMalpractice brokerInsurance |
Quotes from multiple carriers, specialty underwriting knowledge | A first policy, a carrier switch, or leaving a claims-made policy (the tail question) | Broker's fee paid by the carrier | Reading the actual policy form: consent-to-settle, retroactive date, tail terms | Full guide → |
LHealthcare attorneyLegal counsel |
Counsel on formation, contracts, transactions, audits, breaches | Before you sign an agreement or joint venture; on a breach, audit, or investigation | Hourly, flat fee, or monthly retainer | The breach notice clock: individual notice no later than 60 calendar days after discovery (45 CFR 164.404) | Full guide → |
HIPAA, malpractice, legal and regulatory obligations, and self-assessment are different questions with different answers. Each group below links the strongest existing guide for that question.
The deepest set of guides here, covering both prevention and response.
The first 72 hours after discovering a HIPAA breach determine the quality of the audit trail OCR will review, whether notifications meet the Breach Notification Rule, and how the incident resolves. The hour-by-hour sequence.
Verified items across the Privacy Rule, Security Rule, breach notification, and BAA requirements.
Covered platforms, BAAs, patient consent, state licensure, audio-only rules, and documentation.
What a risk analysis must document under 45 CFR 164.308, how often to update it, and why its absence is OCR's most-cited finding.
Most small-practice HIPAA exposure is a CRM or texting tool with no signed BAA. What triggers PHI, and how to choose a compliant platform.
The thinnest group here -- and where the real tool gap sits (see the triage matrix above).
Occurrence vs. claims-made, typical premium ranges by specialty, and what to ask before you sign.
Claims-made vs. occurrence, coverage limits by specialty, carrier scorecard, and tail costs -- a structured worksheet, not an interactive tool.
Obligations outside HIPAA that aren't malpractice either -- grouped here as a practical bucket, not a legal category.
Eight situations that call for legal counsel, the Stark Law and Anti-Kickback framework, fee structures, and how to evaluate candidates.
Screening is monthly and covers contractors and vendors, not just employees. How to build a defensible, dated evidence trail.
The penalties, the four standards that drive most citations, and a five-step compliance program.
Check yourself before you pay someone. The one group with a real instrument behind it: the HIPAA Readiness Quick-Check below.
Your MSP is a HIPAA business associate. What to check on BAA terms, breach-notification timing, subcontractor flow-down, and system access scope.
A 50-point paper worksheet covering similar ground to the Quick-Check above, if you want a scored document for your files.
Free, and no email required until the end. It points to where you're exposed, not to a vendor.
12 questions across 6 HIPAA domains. About 2 minutes. No email required until the end -- see where you're actually exposed.
Start the checkThe gaps to close, in priority order, to get your practice HIPAA-ready.
Download (PDF)A self-scored assessment that surfaces your highest-risk HIPAA gaps.
Download (PDF)How to compare malpractice carriers, coverage types, and the terms that matter.
Download (PDF)Every firm in the directory below passed our tier-1 data-quality and identity-verification review before it was admitted. That review confirms the business is real and reachable. It is not a quality assessment of any firm's compliance work, and it is not a ranking. HIPAA-specific evaluation criteria for this category don't exist yet; when they do, they'll be published at /methodology/ before they're used, the same way every other category's criteria are.
76 businesses hold tier-1 membership in this category (a handful list more than one office; each is one grading event, not one per address). Listed alphabetically below -- this is a verified directory, not a ranking, and no company can pay to appear here.
The first 12 of the 76 tier-1 members in alphabetical order. Not a curated pick, and not the full roster. Selection basis is verification status only.
Tier-1 verified · Phoenix, Seattle, Tustin (3 locations)
No sponsored placements are currently running in this category. Sponsored placements always appear in this separate, labeled block, never in the tier-1 list above.
Are you a compliance or HIPAA services provider? Sponsored placements are available →
76 businesses, 12 shown above. Browse every tier-1 Compliance & HIPAA services member, filterable by state and city.
These two directories are not reviewed by this hub. They are plain, browsable listings -- what you find there may carry its own directory-level score, which is a separate thing from an editorial verdict.
Independent, never-paid comparisons of directory vendors, generated from the GetPracticeHelp directory. Ordering basis is stated on each page.