HIPAA, CMMC and IT compliance in Tampa
Compliance is a set of controls you can prove are in place, not a certificate on the wall. The work is a risk assessment, the technical safeguards it calls for, and the documentation that shows an auditor or insurer you did it.
Signs you have a compliance gap
- You're a medical, dental or therapy practice and nobody can produce a current HIPAA risk assessment
- A defense prime or a government contract is asking about CMMC or NIST 800-171
- Your cyber insurance application had questions you guessed on
- Patient or client data is on personal phones and home computers
- Policies exist in a binder from a template but don't match what actually happens
- A customer's vendor questionnaire is sitting unanswered
What we deliver
Risk assessment
The documented assessment HIPAA requires and CMMC builds on: where sensitive data lives, how it moves, and what could go wrong.
Technical safeguards
Encryption, access controls, audit logging, multifactor authentication, secure email and device management, implemented and monitored.
Policies and procedures
Written policies that match your actual operation, with the training records to go with them.
Evidence and reporting
Screenshots, logs and reports organized so a question from an auditor, insurer or prime contractor gets answered in an afternoon.
Vendor and business associate review
Agreements and access reviews for the software vendors and contractors that touch your data.
Ongoing maintenance
Annual reassessment, quarterly access reviews, and updates when the rules or your business change.
What affects the price
- Which framework: HIPAA, CMMC Level 1 or 2, PCI, or an insurer's checklist.
- Number of users, devices and locations in scope.
- How much is already in place versus starting from scratch.
- Whether you need ongoing maintenance or a one-time assessment.
You get a written quote for your job or your monthly plan before anything is billed.
Compliance in the Tampa Bay economy
Tampa has a large healthcare sector of independent practices, surgery centers and therapy groups that all fall under HIPAA, and with MacDill Air Force Base and the commands based there, a deep layer of small defense subcontractors who are now being asked by their primes to show CMMC readiness. Both groups are usually too small to have a compliance officer and too regulated to ignore it.
Florida adds its own layer: the Florida Information Protection Act requires reasonable measures to protect personal information and notification within 30 days of a breach. The technical side of that overlaps almost entirely with what HIPAA and CMMC already ask for.
Common questions
Can you make us HIPAA compliant?
No one can hand you compliance; it's an ongoing obligation that belongs to the practice. What a provider can do is perform the risk assessment, implement the technical safeguards, produce the documentation and keep it current. That's what this service is.
What's the difference between CMMC Level 1 and Level 2?
Level 1 covers basic safeguarding of federal contract information, 17 practices, and is self-assessed. Level 2 aligns with NIST 800-171's 110 controls for controlled unclassified information and typically needs a third-party assessment. Your contract and your prime determine which applies.
Do you provide legal advice?
No. The work here is technical and documentary. For questions about what the law requires of your specific business, you'll be pointed to healthcare or government-contracts counsel.
Will this satisfy our cyber insurer?
The controls insurers ask about, such as multifactor authentication, endpoint detection, tested backups and training, are the same ones these frameworks require. You'll have the evidence to answer the application accurately. See cybersecurity.
Related services
- CybersecurityMonitored endpoint protection, email filtering, MFA and staff training.
- Managed IT and helpdeskFlat-fee IT department for 5 to 100 people: helpdesk, monitoring, patching, vendors.
- Backup and disaster recoveryTested backups and a plan to run the business when the office is closed by a storm.
Areas we serve
HIPAA, CMMC and compliance across Tampa and these nearby communities: