Led by our privacy and compliance lead and Kurt Wiedenhoeft
Scope and deliverables
A data inventory and flow map. A regulatory applicability decision: HIPAA covered entity, business associate, or neither; CCPA, GDPR, the FTC Health Breach Notification Rule, state consumer health data laws. The policy set and notices, the vendor and subprocessor program, a privacy-by-design review of the product itself, and the diligence binder an acquirer expects. A portfolio program is available at five or more companies, with a shared playbook.
Confirm the fit before starting
In the introductory conversation, we’ll discuss your priorities, the systems or workflows involved, and the people needed for the work. The engagement agreement confirms the scope, responsibilities, fee, and timeline before work begins.
- Identify the decisions the engagement needs to support.
- Agree on access, inputs, and client responsibilities.
- Confirm the deliverables and how they will be reviewed.
- Identify any specialist or implementation work that requires separate scope.