The Covered Entity contracted with HIPAA Secure Now, a vendor that provided a rigorous security risk assessment to address gaps in its risk assessment, develop policies and procedures to protect its patients' PHI, and update hardware and software..