A US partner sent a HIPAA questionnaire and we don't know where to start.
We run a data-flow audit: what you collect, where it is stored, who can access it. You get a gap list with priorities and a remediation plan.
A website and workflow you can legally run in healthcare, finance and education
We configure your site, forms, CRM and AI agents to meet HIPAA (US health data), KYC (customer verification in finance) and FERPA (US student records). The site brings in customers and the automation does not create legal exposure. We are not a law firm, so your counsel or auditor makes the final call.
Quote and schedule after your brief
Who it's for
- Clinics, telehealth services and software vendors handling US patient data
- Fintech startups, exchanges, lenders and payment services that must verify customers
- Education platforms and schools with US students or parents
- Vendors whose partner has just sent a security questionnaire before signing
Problems we solve
Our booking form emails patient details over regular email.
We replace it with an encrypted form with access logging. We also remove trackers such as Meta Pixel and analytics scripts from pages where they could pass health data to third parties.
New customers are verified by hand and applications sit for days.
We connect an identity verification provider (Sumsub, Veriff or similar): ID document, liveness check, sanctions screening. Results land in your CRM, and straightforward cases need no manual review.
We worry that a chatbot or automation will pull in more personal data than it should.
We limit what the bot can see, strip sensitive fields from logs, and check that the vendor will sign the required agreement (for HIPAA, a BAA). If there is no agreement, we do not connect it.
What's included
- Data-flow audit: forms, email, CRM, analytics, chat, storage
- Gap list against HIPAA, KYC or FERPA with priorities
- Secure forms and client portals with role-based access
- Encryption in transit and at rest, two-factor login for staff
- KYC provider integration: ID check, liveness, sanctions screening
- Audit log: who accessed what and when
- Retention and deletion rules configured in the system
- Privacy policy, consent and form text drafts for your lawyer to review
- CRM and AI agent setup so they receive only the data they need
- Staff guide: what to do and what to avoid with sensitive data
Choose the scope
Use a package to describe what you need. We agree on the quote and schedule after reviewing your brief and requirements.
01
Audit & plan
Teams that don't yet know how far they are from the requirements
- Data-flow map
- Prioritised gap list
- Cost estimate for fixes
- Questions list for your counsel
02
Implementation
Services ready to fix the gaps and launch
- Secure forms and portals
- KYC integration or data access limits
- Audit log and retention rules
- Policy drafts for your lawyer
- Staff training
03
Ongoing care
Teams that finished implementation and want to stay in order
- Quarterly access review
- Updates to forms and integrations
- Help with partner questionnaires
- Fast fixes for issues we find
How we work
Brief and requirements
You describe the task and current workflow. We clarify requirements, choose a first stage and prepare a quote.
Data audit
We trace what data you collect and where it goes. We produce a gap list and agree a pilot with a measurable KPI, for example verification time or number of unprotected forms.
Pilot
We fix one flow first: one form or one customer check. We measure it against the KPI.
Rollout
We apply the same fixes to the remaining flows. Payment is in stages, and all accounts and access are yours under the agreed terms.
Handover and training
We hand over documentation, train your staff and pass the materials to your counsel for final review.
Scope and limits
- We do not promise a HIPAA certificate: there is no official one. Compliance is assessed by a lawyer or auditor.
- We do not replace your lawyer: our policy and consent texts are drafts that your counsel must approve.
- We do not guarantee approval by a regulator, bank or partner: we prepare the system, they make the decision.
FAQ
Do I need HIPAA if I only work outside the US?
Usually not. HIPAA covers US health data. It applies if you handle data of US patients or act as a vendor to a US clinic, insurer or similar organisation.
What is KYC and who requires it?
KYC (know your customer) means verifying who your customer is. Anti-money-laundering law, banks and payment providers require it. The exact checks depend on your country and business type, so we confirm the list with your counsel.
Do you store my customers' documents?
We try not to. Verification runs through a KYC provider, and your system keeps the result and the minimum data needed. All accounts and access belong to you.
Can I use an AI agent if we handle health data?
Yes, if the model vendor signs the required agreement and your data is not used for training. Without those terms, we keep the agent to general questions with no personal data.
How do you estimate the cost?
We prepare a quote after reviewing your brief and requirements. A first stage can cover: data-flow map; Prioritised gap list. Scope, payment and schedule are agreed before work starts.
How does this connect to the website and getting customers?
In healthcare, finance and education, buyers and partners often ask about security before the first deal. Once that is covered, the site and ads bring customers, and automation such as CRM and AI agents runs without extra risk.
Start with your task
Describe your business, the outcome you need and your current workflow. We will clarify the requirements and prepare a quote after your brief.