HIPAA auditor (small-practice focus) to audit our golden build M365 tenant, AI-native workflow

We build HIPAA-compliant Microsoft 365 workplaces for small healthcare practices (1 to 10 person dental, therapy, and specialty clinics). One standardized blueprint: M365 Business Premium, Intune device management, policies, staff training, annual risk analysis. You will audit our golden build tenant: the live, fully configured reference environment every client deployment is cloned from. Auditing it means auditing exactly what our clients get. We run our own company on the same stack. Important: this is a small-practice engagement. If your background is mostly enterprise or hospital-system audits, this is not for you. A compliant 5-person practice scopes very differently from a 500-bed system, and we need someone who judges "reasonable and appropriate" at that scale for a living. What you will review: - The M365 tenant and Intune controls against the Security Rule safeguards (administrative, physical, and technical, Part 164 Subpart C) - The policy set (10 documents) - The training portal and completion records - The completed risk analysis (second-pass review, not a redo) Deliverables: (1) your independent written compliance report under your own name, and (2) a signed one-page attestation letter we can show clients. How we work: we are an AI-native company. You tell us what evidence you want to see, our agent produces it (configs, exports, screenshots, logs), you judge it. No site walkthroughs, no long discovery calls. If your process is manual checklists over screen-share calls, we are not a fit. If you already use AI in your own audit practice, you will move fast here. About you: - You audit small practices for a living (solo and group practices, dental, behavioral health, med spas), not hospital systems - A credential (CHC, CHPS, HCISPP, CISA or similar) is preferred, but demonstrated work matters more; we know this field is unregulated and screen accordingly - You are comfortable reviewing agent-produced evidence and saying no when it is not good enough To apply, answer these five: 1. Describe two HIPAA Security Rule assessments you completed for practices under 20 staff: scope, one finding you're proud of, and the final deliverable. 2. Name one control you would require from a hospital but not a 4-person practice, and why. 3. How do you use AI in your own audit work today? Be specific. 4. A client claims MFA is enforced for all users. What evidence do you ask for first? For the right person, two ongoing roles follow: 1. Compliance officer, ad hoc: every new client gets an identical deployment of this audited blueprint. You review the per-practice evidence and sign each report. Recurring, predictable work. 2. Weekly roundtable moderator: our community of practice owners submits questions in advance, our HIPAA-trained agent drafts answers, you run the live session and correct anything the agent gets wrong. The ongoing compliance officer and roundtable roles are separate engagements, discussed after.