CxO™ DELIVERABLE
HIPAA Gap Assessment
A HIPAA gap assessment is a review of how your administrative, physical and technical safeguards compare with the HIPAA Security Rule. DAG Tech's vCCO checks how you protect electronic protected health information, documents every gap and gives you a prioritized plan to close it.
Custom proposal · Last updated October 2026
The Short Answer
What Is a HIPAA Gap Assessment?
A HIPAA gap assessment compares your current safeguards for electronic protected health information (ePHI) with the requirements of the HIPAA Security Rule and lists what is missing or weak. The HIPAA Security Rule (45 CFR Part 164, Subpart C) applies to covered entities, such as providers and health plans, and to their business associates. It requires administrative, physical and technical safeguards for ePHI. Some specifications are required and some are addressable, which means you must implement them or document why an equivalent measure is reasonable. The rule also requires an accurate and thorough risk analysis, which is one of the items regulators most often find missing or out of date. We assess you against the current rule.
DAG Tech focuses on the technology and security side of HIPAA. We are not a law firm, so questions about the Privacy Rule, breach determinations or contract language go to your counsel. A HIPAA gap assessment is often the first deliverable after a CxO initiation for healthcare organizations and their vendors. The vCCO then recommends who should close each gap, whether that is your team, another provider or DAG Tech.
At a glance
SPEC SHEET- DELIVERABLE TYPE
- Framework gap assessment
- ALSO KNOWN AS
- HIPAA Security Rule assessment, HIPAA readiness review, HIPAA compliance gap analysis
- PRACTICE AREA
- IT Compliance (CxO™)
- BEST FOR
- Covered entities and business associates that store, process or transmit ePHI
- WHAT WE NEED
- Systems holding ePHI, current policies, prior risk analysis and business associate agreements
- NEXT STEP
- Request a HIPAA gap assessment proposal
Scope
What We Evaluate
We test each area of the HIPAA Security Rule against how your environment actually runs.
Security risk analysis
Whether your risk analysis is current, covers every system with ePHI and drives a risk management plan.
Administrative safeguards
Security officer assignment, workforce training, sanctions, contingency planning and periodic evaluation.
Physical safeguards
Facility access, workstation use and security, and device and media controls.
Access control
Unique user IDs, emergency access, automatic logoff and MFA in systems such as Microsoft 365 or Entra ID.
Audit controls
Whether activity in systems holding ePHI is logged and reviewed.
Integrity and transmission security
How ePHI is protected from improper change and encrypted in transit and at rest.
Contingency and backup
Data backup, disaster recovery and emergency mode operations for ePHI.
Business associates
Whether every vendor handling ePHI has a business associate agreement and appropriate safeguards.
The Deliverable
What You Receive
- HIPAA Security Rule gap report by safeguard and specification
- Updated security risk analysis inputs and risk register
- Addressable specification decisions and documentation gaps
- Business associate inventory
- Prioritized remediation roadmap with owners and scoped hours
How It Works
How It Runs
- STEP 01
Kickoff
We identify where ePHI lives, how it moves and who touches it, including vendors.
- STEP 02
Document Review
The vCCO reviews your policies, risk analysis, training records and business associate agreements.
- STEP 03
Safeguard Testing
We check system settings and interview owners to confirm each safeguard works as written.
- STEP 04
Readout
You get the gap report, risk ranking and a dated plan to close every finding.
When to Start
Signs You Need a HIPAA Gap Assessment
- Your HIPAA risk analysis is more than a year old or was never done.
- You moved ePHI to new cloud platforms since your last review.
- A health system client asked for proof of your HIPAA safeguards.
- You cannot list every vendor that touches ePHI.
- MFA and encryption are not yet in place everywhere ePHI lives.
Compare
HIPAA Gap Assessment vs. Cybersecurity Risk Assessment
| HIPAA Gap Assessment | Cybersecurity Risk Assessment | |
|---|---|---|
| Question it answers | Where do our safeguards fall short of the HIPAA Security Rule? | What are our biggest security risks across the business? |
| Output | Specification-level gap report, BA inventory and remediation roadmap | Risk findings and recommendations across the IT environment |
| When | You handle ePHI and need to show HIPAA compliance | You want a broad security baseline, regulated or not |
| Led by | DAG Tech virtual compliance officer (CxO™) | DAG Tech IT assessments team |
Related
Often Paired With
FAQ
HIPAA Gap Assessment Questions
What is a HIPAA gap assessment?
It is a review of your administrative, physical and technical safeguards against the HIPAA Security Rule. It shows which required and addressable specifications are missing, weak or undocumented, and what to fix first.
Is a HIPAA gap assessment the same as a HIPAA risk analysis?
No, but they connect. The risk analysis is a required part of the Security Rule that identifies threats to ePHI. The gap assessment checks every Security Rule requirement, including whether your risk analysis is complete and current.
Is there a HIPAA certification?
No. HHS does not certify organizations as HIPAA compliant. A gap assessment and a documented remediation plan help you show reasonable and appropriate safeguards to regulators, customers and partners.
How much does a HIPAA gap assessment cost?
Every deliverable is scoped in hours at the CxO rate, based on how many systems hold ePHI and how many locations you have. Your proposal shows the total before work starts.
Does DAG Tech give legal advice on HIPAA?
No. DAG Tech is not a law firm. We cover the technology and security safeguards. Privacy Rule questions, breach determinations and contract terms go to your counsel, and the vCCO works with them as needed.
Get Started
Request a HIPAA gap assessment
Tell us what you need. We scope the hours and send a CxO proposal.
Sent with your request: CxO: vCCO: HIPAA Gap Assessment
- 01A scoping call with a fractional executive
- 02Every task, deliverable, hour and cost in one proposal
- 03A roadmap with start date
The CxO™ Program
Explore Every Practice Area
About DAG Tech HIPAA Gap Assessment
A HIPAA gap assessment is a review of how your administrative, physical and technical safeguards compare with the HIPAA Security Rule. DAG Tech’s vCCO checks how you protect electronic protected health information, documents every gap and gives you a prioritized plan to close it.
A HIPAA gap assessment compares your current safeguards for electronic protected health information (ePHI) with the requirements of the HIPAA Security Rule and lists what is missing or weak. The HIPAA Security Rule (45 CFR Part 164, Subpart C) applies to covered entities, such as providers and health plans, and to their business associates. It requires administrative, physical and technical safeguards for ePHI. Some specifications are required and some are addressable, which means you must implement them or document why an equivalent measure is reasonable. The rule also requires an accurate and thorough risk analysis, which is one of the items regulators most often find missing or out of date. We assess you against the current rule.