TL;DR: HIPAA Audit in San Diego: Local Risk Analysis & Gap Assessment — what it actually involves and how to get it shipped without a 6-week consulting engagement. PJ Zonis (SideGuy Solutions, Encinitas) builds these for North County San Diego operators in days, not months — using Claude, n8n, AWS, and direct work. $100/hr, no retainer, no meetings — text 858-461-8054 to start.
HIPAA Audit in San Diego: Local Risk Analysis & Gap Assessment
You're either prepping for an OCR audit, onboarding a new payer, or a client just asked for your HIPAA docs and you don't have them. Here's what actually matters.
What you need to know about HIPAA audits in San Diego
- There are two kinds of "audit" people mean. The federal one is the HHS Office for Civil Rights (OCR) audit — rare, but triggered by complaints or breaches. The far more common one is the self-assessment required by the HIPAA Security Rule (45 CFR §164.308(a)(1)(ii)(A)) — a written risk analysis every covered entity and business associate must conduct and update. Most San Diego practices fail this one, not OCR.
- California adds CMIA on top of HIPAA. The Confidentiality of Medical Information Act (Civil Code §56) is stricter than federal HIPAA — unauthorized disclosure penalties start at $1,000 per violation and California AG enforcement is active. Your audit needs to cover both frameworks, not just federal.
- A real audit has 7 deliverables: asset & ePHI inventory, threat/vulnerability analysis, administrative safeguards review (policies, training logs, sanctions), physical safeguards walkthrough (your Encinitas or Sorrento Valley office), technical safeguards (access controls, audit logs, encryption at rest/in transit), Business Associate Agreement (BAA) review, and a remediation plan with owners and dates.
- Cost in San Diego runs $3,500–$15,000+ from traditional compliance firms for a single practice. A leaner option: a local consultant who uses AI-assisted tooling to generate the documentation and walks your office in person. That's what I do — flat $100/hr, no retainer, you own all the output.
What a SideGuy HIPAA audit covers
- NIST 800-66 aligned risk analysis document
- ePHI data-flow map across your EHR, email, backups, and vendors
- Policy pack: 18 required HIPAA policies, customized to your practice
- BAA tracker for every vendor that touches PHI (Google Workspace, billing, shredding, IT)
- Remediation roadmap with priority, effort, and cost
- On-site walkthrough anywhere in San Diego County
Who I work with in San Diego
- Solo & small-group medical, dental, and behavioral health practices
- Chiropractic & physical therapy clinics in North County
- Med-spas offering treatments that create PHI
- SaaS & tech companies that are Business Associates and need BAA-ready docs
- Practices migrating EHRs or switching billing companies
- Anyone who just got a client-security questionnaire they can't answer
$1.5M
Max annual HIPAA penalty per violation category
70%
Of OCR-audited practices lack a current risk analysis
3–5 days
Typical SideGuy audit turnaround for a small practice
How the engagement works
- Day 1 — Kickoff call (free): 20 min to scope your environment, EHR, vendor list, and audit trigger.
- Day 2 — Intake & walkthrough: I come to your office (Encinitas, Solana Beach, Carlsbad, La Jolla, Sorrento Valley, Downtown — anywhere in the county) for physical safeguards review.
- Day 3–4 — Documentation: Risk analysis, policies, BAA audit, and remediation plan drafted with AI-assisted tooling (faster and more consistent than manual templates).
- Day 5 — Delivery & training: 60-min review call, staff training recording, and all source files handed to you. You own everything.
Need a HIPAA audit done this month?
Text me your situation — OCR letter, new BAA, payer request, breach, or just overdue. I'll tell you within an hour if I can help and what it'll cost.
Text 858-461-8054