1
Scoping + security risk analysis
We confirm whether you are a covered entity or a business associate and map the PHI that flows through your systems. Then we run the security risk analysis required by 45 CFR 164.308(a)(1).
HIPAA · Privacy, Security & Breach Rules
Build a HIPAA programme that stands up to an OCR audit
HIPAA compliance for covered entities and business associates handling protected health information. We run the security risk analysis, draft the Privacy, Security, and Breach Notification policies, prepare your Business Associate Agreements, and train your workforce. The programme is built to stay current as enforcement evolves.
From $2,000 Quoted up front after a free scoping call
PHI safeguarded
Privacy + Security rules
BAAs in place
With every vendor
Breach-rule ready
60-day notifications
Legal team
GTC's privacy team
Data-protection counsel
10,747+ clients11 attorneys5 offices
10,747+ clients11 attorneys5 offices10+ years
IIPLA Top IP Consultancy 2026Upwork · Top Rated Plus
Trusted by founders and brands worldwide
How it works
How a HIPAA programme comes together with GTC
2
Policy framework + BAAs
We draft the full suite of Privacy, Security, and Breach Notification policies, and prepare Business Associate Agreement templates for the vendors and customers that touch your PHI.
3
Training + breach playbook
We deliver workforce training materials with sign-off tracking and wire the Breach Notification Rule playbook into your incident-response plan, so the 60-day clock is handled.
What it costs
Quoted by entity type and scope
HIPAA Compliance starts from $2,000. Every HIPAA engagement is quoted up front after a free scoping call, once we know whether you are a covered entity or a business associate and the size of your operation. A smaller business associate programme is scoped differently from a multi-site covered entity, and an OCR audit response is quoted per matter. No fee is committed until you have approved the quote.
What's included
- Security risk analysis to 45 CFR 164.308(a)(1)
- Privacy Rule policies: notice of privacy practices, authorisations, minimum-necessary standard
- Security Rule policies: administrative, physical, and technical safeguards
- Business Associate Agreement template plus counterparty addenda
- Privacy Officer and Security Officer designation guidance
- Workforce training materials with sign-off tracking
- Breach Notification Rule playbook and a workforce sanctions policy
- Business associate programme
- Quoted by scope
- Covered entity programme
- Quoted by scope
- OCR audit response
- Quoted per matter
- Annual compliance maintenance
- Quoted by scope
No GTC fee is committed until your status is confirmed and you have approved the quote.
Get started
Get your HIPAA programme scoped
Tell us about the PHI you handle and the systems it flows through. A GTC attorney will confirm your status, scope the work, and email a quote after a free scoping call.
No payment required Reply within 1 business dayA GTC attorney reviews it & sends a flat-fee quote.
-
01Brand details
-
02Documents
-
03Your details
Handling PHI for another company? You are likely a business associate and need your own programme plus signed BAAs — mention who you process data for and we will scope both.
Brand details
1
Legal name of the entity needing HIPAA work.
2
A Covered Entity is a healthcare provider, health plan, or clearinghouse. A Business Associate handles protected health information (PHI) on a Covered Entity's behalf. Your role sets which HIPAA duties apply.
3
PHI (protected health information) is any health data tied to an identifiable person. Pick all that apply.
4
Pick all that apply. A BAA (Business Associate Agreement) is the contract that lets a vendor handle PHI; an NPP (Notice of Privacy Practices) is the privacy notice you give patients.
5
A rough headcount is fine — it helps us scope the work.
Why GTC
Why route HIPAA through GTC
Legal team
GTC's privacy team
Data-protection counsel
Attorney-led
The risk analysis OCR asks for
The security risk analysis under 45 CFR 164.308(a)(1) is the first thing the Office for Civil Rights looks for. We run it properly and document it so the file holds up under review.
Privacy and Security policies drafted
A full policy suite: notice of privacy practices, minimum-necessary standard, and the administrative, physical, and technical safeguards the Security Rule requires.
BAAs for both directions
Business Associate Agreement templates for the vendors that touch your PHI and the customers you serve, with addenda for counterparties under the HITECH Omnibus Rule.
Kept current, not just filed
HIPAA compliance is an ongoing obligation. An optional retainer keeps the risk analysis current and the programme audit-ready as OCR enforcement evolves.
Your Customer Success Team
A dedicated team that owns your matter from start to finish.
Every GTC client gets a dedicated Account Manager and a Senior Account Manager who learn your business and stay with you from first email to final filing. They are named people who pick up the phone and already know your matter, so every step moves forward without delay.
Your Account Manager
Your day-to-day point of contact, who coordinates every matter, keeps things moving, and already knows your file. They have your full history, so you start every conversation where the last one left off.
Your Senior Account Manager
Senior oversight on strategy and escalations, stepping in as your needs grow, so every important detail stays on track.
A named person, on email or a call, at every step.
How we compare
GTC vs. a generic template or a big consultancy
| What you get | GTC | Online filing services | Doing it yourself |
|---|---|---|---|
| Security risk analysis run to 45 CFR 164.308(a)(1) | |||
| Privacy, Security, and Breach Notification policies drafted to your operation | |||
| Business Associate Agreements prepared for vendors and customers | |||
| Workforce training materials with sign-off tracking | |||
| Breach Notification Rule playbook wired into incident response | |||
| Programme kept current as OCR enforcement evolves |
Security risk analysis run to 45 CFR 164.308(a)(1)
GTC
Online filing services
Doing it yourself
Privacy, Security, and Breach Notification policies drafted to your operation
GTC
Online filing services
Doing it yourself
Business Associate Agreements prepared for vendors and customers
GTC
Online filing services
Doing it yourself
Workforce training materials with sign-off tracking
GTC
Online filing services
Doing it yourself
Breach Notification Rule playbook wired into incident response
GTC
Online filing services
Doing it yourself
Programme kept current as OCR enforcement evolves
GTC
Online filing services
Doing it yourself
Timeline
From scoping to a defensible HIPAA programme
A business associate programme typically stands up in four to six weeks. A multi-site covered entity takes longer, given the number of systems and workforce members in scope.
-
Weeks 1–2
Scoping + risk analysis
We confirm covered entity or business associate status, map the PHI flowing through you, and run the security risk analysis required by 45 CFR 164.308(a)(1).
-
Weeks 2–4
Policy framework + BAAs
We draft the full Privacy, Security, and Breach Notification policy suite and prepare a Business Associate Agreement template for your vendors and customers.
-
Weeks 4–6
Training + breach playbook
We deliver workforce training materials with sign-off tracking and wire the Breach Notification Rule playbook into your incident-response plan.
-
Annually
Compliance maintenance
An optional retainer keeps the risk analysis current and the programme audit-ready as OCR enforcement and your systems change.
In their words
All your legal, in one place.
One accountable team across every practice, operating since 2016.
10,747+
Clients served
11
In-house attorneys
5
Global offices
10+
Years since 2016
HIPAA compliance FAQs
Frequently asked questions
Covered entities are healthcare providers, health plans, and clearinghouses — the principals under HIPAA. Business associates are vendors and service providers that create, receive, maintain, or transmit protected health information on behalf of a covered entity, such as cloud hosting, billing, payroll, or analytics providers. Under the HITECH Omnibus Rule, business associates carry most of the same compliance obligations as covered entities. We confirm which you are during scoping.
Ready to build your HIPAA programme
Ready when you are.
Tell us about the protected health information you handle and the systems it flows through. We will confirm your status, scope the work, and quote up front after a free scoping call — then build the programme and keep it current.
