Compliance
IT compliance services in Baton Rouge. Every organization with more than one employee has rules to follow.
We tell you which ones apply to you, put the technical safeguards in place and hand you the policies, before anyone outside asks.
Owner-operated in Baton Rouge since 2003
See if you’re regulated
- Where your rules come fromYour funders, the data you handle, the law and your contracts
- What we put in placeThe technical safeguards, on the computers we manage
- What we hand youThe policies your rules call for, fitted to your organization
Wahaya IT finds which rules your organization answers to, such as HIPAA, the FTC Safeguards Rule, Louisiana’s data security law or your card processor’s rules.
Where your rules come from
You probably have rules, even if no one asked.
Many owners don’t know what they have to follow. Your rules come from four places.
Your funders
Federal and state grants carry their own rules. We meet the IT terms your grant sets, even the dated ones.
The data you handle
Your HR files hold copies of driver’s licenses and Social Security cards. We ask where that data lives and who can reach it.
The law
Some rules come from the law itself, and health privacy law is one of the best known. We know the rules our clients answer to.
Your contracts
If you take credit cards, your card processor sets rules in its contract. We find out what your processor expects.
Sooner or later, someone outside will ask whether you’re compliant and which laws you fall under. We find you the answer first, by asking.
IT compliance: we act on all three safeguards.
Your rules call for protection in three forms. We recommend what you need in each.
Technical: we set up the protections
We set up the protections your rules call for on your computers, your network and your accounts, and keep them patched.
Physical: we tell you what’s missing
Your rules may require a monitored server room: a camera, or card-swipe entry with an audited record. We check your space and recommend what’s missing.
Administrative: we hand you policies
You get written policies for how staff handle sensitive information. For tax and accounting firms, that includes a written information security plan (WISP). If staff push back on a policy, we explain it and hold the line.
Frameworks we work with most often: HIPAA, 42 CFR Part 2, the FTC Safeguards Rule, PCI DSS, CMMC and SOC 2.
The technical side
We run the technical safeguards for you.
For Managed IT clients, we build them in during onboarding.
We recommend blocking USB drives
A staff member who copies patient data to a stick and loses it leaves you with a compliance problem.
We block unapproved AI tools
Our web filter keeps staff off AI tools nobody approved, and patient and personal information stays out of strangers’ hands.
Prints wait for their owner
In medical offices, we can set prints to wait at the printer until the person who sent them releases them with a card or key.
Backup and training, already in place
Rules like HIPAA call for backup and security awareness training. Every client we manage has both running, so you have an answer when someone asks.
Questions first
It starts with a conversation about the rules you follow.
Before we recommend anything, we sit down with you and ask questions, without touching a computer.
Our owner personally performs your onboarding compliance review.
We follow a 14-page checklist.
What we ask
- 01What compliance rules do you know you need to follow?
- 02How do you store sensitive data like payroll, HR files, health information or accommodation records?
- 03Who has administrator access to your systems?
- 04Do you use AI in your business, and what data have you shared with it?
From your answers, we tell you which rules apply to you, where the gaps are and what we recommend for each of the three safeguards.
Every environment is different, so we quote after that conversation.
After an incident
We find the policy that covers it.
-
Call us and tell us what happened.
-
We’ll name the policy that should cover it, then ask, “Do you have it?”
-
If not, we give you the policy and explain it to your staff before the next time.
Policies we hand you
Questions owners ask about IT compliance
What is IT compliance?
IT compliance means your computers, accounts and data meet the rules you answer to: laws like HIPAA and the FTC Safeguards Rule, your grant terms, and contracts such as your card processor’s. Those rules call for technical, physical and administrative safeguards, plus written proof they’re in place. They apply because of the data you hold, whatever your size.
Does HIPAA apply to our practice, and what might change?
We find out whether it applies to you in the risk conversation. HIPAA is one of the best-known health privacy standards in the United States. Proposed changes to its Security Rule would require a second sign-in check, which the current rule doesn’t. Every user at a client whose IT we manage already signs in with one.
If it applies, we sign a business associate agreement with you, hold signed agreements with every vendor that can touch patient information, and do a HIPAA risk assessment every year with a written report and a plan to fix what it finds. Substance use disorder treatment records carry added confidentiality protections under 42 CFR Part 2.
Does the FTC Safeguards Rule apply to our tax or accounting office?
Under the Gramm-Leach-Bliley Act, offices that complete tax returns count as financial institutions. The rule asks for a written information security program, a second sign-in for every user and oversight of your service providers. We help you write the program and keep it current. Your attorney or compliance advisor has the final word on whether it applies. See IT for accounting and CPA firms.
Will you make us compliant?
We can’t make you compliant alone, because your staff follow the policies every day. We keep the technical safeguards running, hand you the policies, explain them to your staff and, if something happens, tell you which policy covers it.
Built for healthcare, nonprofits, professional firms and growing businesses
Healthcare and treatment centers
Grant-funded nonprofits
Small businessesTech Tips
IT compliance guides.
Find out where you stand before anyone asks.
-
15 minutes
Tell us what your organization does, who funds it and what data you keep.
-
We’ll tell you where your rules come from and what we’d put in place first.
-
If we’re not the right fit, we’ll say so.
15 minutes
