Baltimore's biggest employers treat patients, and its federal neighbors pay for their care.

Within 45 days of discovering the breach or being told about it by a vendor, and the Attorney General's office must hear from you first. Law enforcement can ask for a delay. Build the AG notice into your playbook so it does not hold up the resident letters.

Protected health information handled under HIPAA is treated differently from other personal data, but hospitals also run websites, apps, marketing lists and research programs that may fall outside it. Map which data sets sit outside HIPAA first, then have counsel apply MODPA to those.

We implement and document the identity, access and audit controls from the ARS baseline in your system, and prepare the evidence assessors request. The assessment itself is run by the assessor CMS accepts, and system authorization is CMS's decision.

Tie each research data grant to a protocol or project record with an end date, and feed that record into the identity platform. When the IRB closes the study or the appointment ends, access drops automatically and the PI gets a report of what was removed.

Yes, for discovery interviews, design workshops and go-live weekends. Most build and configuration work happens remotely from Frisco and our other offices.