Which Compliance Rules Apply to Your Business
The rules that cover you depend on the kind of data you hold, how you take payment, and where your customers live. Most businesses in Southern California answer to more than one, and a single office can fall under several at once.
Medical and Dental Practices
HIPAA applies to healthcare providers, health plans, and clearinghouses, and to every business associate that handles protected health information on their behalf, from billing companies to IT providers. The Security Rule requires administrative, physical, and technical safeguards for electronic patient data, and it applies to a solo dental office the same way it applies to a hospital. Our HIPAA compliance services cover the risk analysis, policies, and technical controls a practice needs. A proposed update to the Security Rule, published in January 2025, would add more specific requirements, but as of our October 2026 review it had not been finalized, with final action expected no earlier than July 2027.
Businesses That Take Card Payments
PCI DSS applies to any business that stores, processes, or transmits payment card data, which includes most offices that accept cards at a front desk or online. Version 4.0.1 is the current standard, and the requirements that were future dated in version 4.0 became mandatory on March 31, 2025. The biggest practical decision is scope: how much of your network ever touches card data. Keeping that footprint small, for example by using payment terminals and processors that keep card numbers off your systems, makes PCI DSS compliance far simpler to meet and to prove.
Tax Preparers, Lenders, and Other Financial Firms
The FTC Safeguards Rule covers a wider group than most people expect. The FTC’s own examples include mortgage brokers, finance companies, collection agencies, credit counselors and other financial advisors, tax preparation firms, and investment advisors that are not required to register with the SEC. Covered firms need a written information security program based on a written risk assessment, with a qualified person responsible for it. Since May 2024, they must also notify the FTC within 30 days of discovering a security event that involves the information of at least 500 consumers. Firms holding information on fewer than 5,000 consumers are exempt from a few parts, including the written risk assessment and the incident response plan, but not from the rule itself. Our work with financial services firms starts by confirming which of these obligations apply.
Law Firms
Law firms do not have a single federal security rule, but the professional obligations are real. In California, the comment to Rule 1.1 on competence has said since March 2021 that a lawyer’s duty includes keeping up with the benefits and risks of relevant technology, and lawyers have a statutory duty to protect client confidences. Clients, especially corporate and healthcare clients, increasingly send security questionnaires before engagement as well. For law firms, compliance usually means being able to show reasonable safeguards for client files, email, and remote access.
Any Business With California Customers
The California Consumer Privacy Act applies to for-profit businesses that meet certain thresholds, the best known being annual gross revenue above $26,625,000, the inflation-adjusted figure in effect since January 1, 2025. Newer CCPA regulations on cybersecurity audits and risk assessments took effect on January 1, 2026, with the first audit reports due in 2028 for the largest businesses and later years for smaller ones. Separately, California’s breach notification law applies to businesses of any size. Since January 1, 2026, affected residents must be notified within 30 calendar days of discovering a breach, and when more than 500 Californians are affected, the Attorney General must be notified within 15 days after that.
Other requirements come from contracts rather than law. A larger customer may ask for a SOC 2 report, a defense supplier may face CMMC requirements, and a cyber insurance application will ask about specific controls. Identifying all of these at the start avoids building one program, then rebuilding it for the next request.
The Risk Assessment Sits Underneath Every Framework
Different frameworks use different vocabulary, but nearly all of them start in the same place. HIPAA requires an accurate and thorough risk analysis. The FTC Safeguards Rule requires a written risk assessment. PCI DSS 4.0.1 asks for targeted risk analyses to justify how often certain controls are performed. Even cyber insurers effectively run a risk assessment through their application questions.
This is also where enforcement tends to land. In April 2026, the HHS Office for Civil Rights announced four ransomware settlements, each of which cited a failure to conduct an accurate and thorough risk analysis, bringing its Risk Analysis Initiative to 13 completed investigations. A risk assessment that exists only as a template does not protect a practice when something goes wrong.
A useful assessment answers concrete questions. Where does sensitive data live, including laptops, email, cloud apps, and vendor systems? Who can reach it, and should they? What would happen if each system were lost, stolen, or locked by ransomware? Which risks will you fix, which will you accept, and why? Done once and done well, the same assessment can support HIPAA, PCI DSS, and Safeguards Rule obligations at the same time instead of three separate exercises. That is the main reason compliance and risk management work best as a single program rather than two.
Compliance Is the Floor, Not the Ceiling
Meeting a framework proves that a defined set of safeguards is in place. It does not make a business immune to attack, because frameworks describe a minimum and attackers do not stop at the minimum. Treating a passed audit as the finish line is a common and expensive mistake. The practical approach is to treat compliance as the floor and build cybersecurity on top of it, which is why we handle the two together rather than as a separate paperwork project. Most controls serve both purposes anyway: multifactor authentication, tested backups, timely patching, and access that matches each person’s role.
Your Vendors Are Part of Your Compliance
Very few practices or firms keep all of their sensitive data in house. Billing services, cloud software, payment processors, outside IT support, and shredding companies all touch it, and most frameworks hold you responsible for choosing them carefully. HIPAA requires a business associate agreement before a vendor handles patient information. The FTC Safeguards Rule requires covered firms to select service providers capable of protecting customer information, to set those expectations in the contract, and to check on them periodically. PCI DSS expects a maintained list of the service providers that affect card data, written agreements with them, and a yearly look at their compliance status.
In practice, that means keeping a simple inventory of vendors and the data each one holds, filing the signed agreements where you can find them, and removing access promptly when a vendor relationship ends. It is unglamorous work, and it is one of the first things an auditor or investigator asks about after a vendor breach.
Cyber Insurance and Compliance Overlap
Cyber insurance has become another driver of cybersecurity compliance for small businesses. Applications and renewals typically ask whether you use multifactor authentication, how backups are protected and tested, whether endpoints are monitored, whether staff receive security training, and whether you have an incident response plan. These are largely the same controls the regulatory frameworks ask for. The answers on an application are statements about your business, so they should match what is actually in place, and the evidence you keep for an audit is the same evidence that supports those answers if you ever need to file a claim.
How IT Compliance Services Work
Compliance is ongoing rather than a one time project, and a well run program usually follows the same cycle:
Skipping documentation is where many otherwise solid programs fall short. Being compliant and being able to prove it are different things, and an auditor, insurer, or regulator will ask for the proof.
- Scope. Identify which rules and contracts apply and which systems, people, and vendors are in scope.
- Assess. Map where sensitive data lives and measure current safeguards against each requirement.
- Prioritize and remediate. Close the gaps in order of risk, starting with the ones most likely to cause harm.
- Document. Write the policies, procedures, and records that show what you do, not just what you intend.
- Train. Make sure staff know the rules that apply to their daily work, and keep records of that training.
- Monitor and review. Recheck controls, vendors, and the risk assessment as systems, staff, and rules change.
What Auditors, Insurers, and Clients Ask to See
Whoever is asking, the requests tend to overlap. Keeping these records current makes each new audit, renewal, or questionnaire much faster:
- A current risk assessment, with the decisions made about each risk.
- Written policies for access, acceptable use, data retention, and incident response.
- Access reviews showing who can reach sensitive systems and that former staff were removed.
- Training records with dates and attendees.
- Backup and restore test results, not just proof that backups run.
- Vendor agreements, including business associate agreements where HIPAA applies.
- An incident log, even if the only entries are minor events and how they were handled.
What Affects the Cost of Compliance Work
Pricing depends less on the framework name than on the size of the job. The main factors are how many frameworks and contracts apply, how many locations, users, and systems are in scope, how far current safeguards are from the requirements, how much documentation already exists, and whether you need a one time assessment or ongoing management. The least expensive path is usually to reduce scope first, for example by keeping card data off your network or limiting which systems hold patient records, and then to maintain the program steadily rather than rebuilding it before every audit.
Local Compliance Support in Los Angeles
Compliance work goes better with a partner who understands your practice and can sit down with you when it matters.
Much of a compliance program, such as monitoring, access reviews, and policy updates, can run remotely. Some of it cannot. Physical safeguards, such as how workstations, server closets, and paper records are secured, are best checked in person, and that is part of how we support practices and firms out to Ventura County as well.
If you are not sure which rules apply to you, or whether you could prove compliance today, book a free consultation and our team will walk through your data, your obligations, and the gaps worth closing first.