Compliance Sprint · From $19,500

HIPAA Audit + Remediation for Mirth Connect — 6-Week Sprint

Comprehensive HIPAA security audit covering PHI data-flow mapping, TLS/SSL encryption, access control review, audit logging, password policies, and vulnerability assessment — followed by a full remediation plan and execution. Fixed-price 6-week sprint starting at $19,500. The right starting point for annual compliance reviews, post-incident remediation, or pre-audit preparation.

Free Discovery Call See All Pricing

Talk About: HIPAA Audit + Remediation

Tell us about your environment in 60 seconds. A solutions architect will reach out within 24 hours to confirm scope.

Why Teams Do This Sprint

Annual compliance review

HIPAA Security Rule implies an annual review. Most teams skip it until a real audit forces the issue — this sprint resets the clock.

Post-incident remediation

If you've had a security incident or near-miss, this sprint identifies what failed and closes the gap with concrete fixes.

Pre-audit preparation

If you're facing a payer audit, an OCR investigation, or a SOC 2 examination, this sprint produces the evidence pack auditors expect.

Concrete fixes, not just a report

Many security audits produce a 50-page PDF and end there. This sprint includes the remediation work — TLS hardening, audit-log fixes, RBAC tightening — built into scope.

BAA + documentation

Standard deliverable: full BAA review, signed update if needed, plus documentation pack ready for procurement and compliance teams.

What We Deliver

Concrete deliverables. Code in your Git repo at the end.

PHI data-flow map (where PHI enters, transforms, and exits Mirth + downstream systems)

TLS/SSL audit (admin console, channel listeners, client connectors) + remediation

Access control review (RBAC roles, user provisioning, dormant account cleanup)

Audit logging audit (what's logged, where logs go, retention policy) + fixes

Password policy review (rotation, complexity, MFA where supported) + tightening

Vulnerability assessment (CVE scan against installed Java + Mirth + plugin stack)

Penetration testing of admin console + channel listeners (or coordination with your pentest vendor)

Channel-level data minimization review (does each channel handle only the PHI it needs?)

Remediation execution: every Critical and High issue closed before sprint handover

Final audit report + remediation evidence pack (suitable for OCR or payer audit response)

BAA review and updated BAA execution if needed

Operational runbook for ongoing HIPAA hygiene (quarterly checklist)

Common Problems We Fix

If any of these match your situation, the sprint resolves them.

Admin console exposed to public internet without IP allowlist

Root cause: Default deployment with admin port open. Solution: IP allowlist or VPN-only access; admin behind WAF.

TLS configured but using deprecated ciphers (TLS 1.0/1.1)

Root cause: Java default TLS settings or legacy keystore. Solution: enforce TLS 1.2+ with modern cipher suites; disable SSLv3 and TLS 1.0/1.1 explicitly.

Channel logs containing PHI in plaintext

Root cause: Verbose channel logging includes message payload. Solution: configure log sanitization filters or move sensitive logs to encrypted storage with access control.

Mirth admin users sharing accounts

Root cause: Single shared admin login for the whole team. Solution: per-user accounts with named identity and role assignment; enable audit log of admin actions.

Audit log retention shorter than HIPAA-required period

Root cause: Default Mirth retention is operational, not compliance-grade. Solution: forward audit logs to long-term storage (S3 with object lock, immutable Splunk index, etc.) with 6+ year retention.

Java + plugin stack has unpatched CVEs

Root cause: Older Mirth/Java versions accumulating known vulnerabilities. Solution: upgrade Java to 17 LTS, upgrade Mirth to NextGen Connect current, replace plugins with maintained equivalents.

Productized Pricing

Pricing — All Numbers Public

Three productized sprint sizes, plus an optional managed-support continuation.

🎁

Free Assessment

30-minute call to confirm scope. We review your environment count, BAA status, and any prior audit findings — produce a written effort estimate.

Claim Free Assessment

HIPAA Audit + Remediation Sprint

From $19,500

6 weeks · single environment

Standard sprint. Full audit + remediation execution + final report. Closes all Critical and High findings before handover.

Multi-Environment Audit

From $34,000

8 weeks · dev + staging + prod

Audits and remediates all environments. Suited for teams facing payer audit or SOC 2 examination.

Add Ongoing HIPAA Hygiene

From $6,800/mo

Silver Managed Support

After the sprint, continue with monthly Silver support — quarterly HIPAA hygiene checklist, CVE patching cadence, audit-log review automation.

Continue with managed Silver Mirth Connect support after the sprint — from $6,800/month.

HIPAA Audit + Remediation — FAQ

Is this audit different from a SOC 2 audit?

Yes. SOC 2 is a broader organizational audit covering security, availability, confidentiality, processing integrity, and privacy across your whole org. Our HIPAA Audit + Remediation Sprint focuses specifically on the Mirth Connect deployment and the PHI flows through it. The two are complementary — many teams do both, with our sprint feeding evidence into the SOC 2 examination.

Do you do penetration testing?

We do basic application-level pentesting of the Mirth admin console and channel listeners as part of the sprint. For comprehensive infrastructure pentesting (network, endpoints, social engineering) we coordinate with a specialist pentest vendor — typically your existing one — and integrate their findings into the remediation plan.

What if you find something we can't fix in 6 weeks?

Critical and High findings are closed inside the sprint scope — that's the commitment. Medium and Low findings get prioritized in a remediation roadmap with target dates; we can execute that under a follow-on Silver support engagement, or your team can take it forward. We don't leave Critical issues open at handover.

Will you sign a BAA before the audit?

Yes. The Business Associate Agreement is signed before any access to your environment or any PHI exposure. The BAA review is itself part of the sprint scope — we verify your existing BAA is current and execute an update if needed.

How does this compare to the free Mirth Health Check?

The free Mirth Health Check is a 60-minute diagnostic — high-level posture check, no remediation, no formal report. The HIPAA Audit + Remediation Sprint is a full 6-week engagement that produces an audit-grade report and closes findings with executed remediation. They're complementary — the Health Check tells you whether the audit is needed; the audit does the work.