HIPAA security risk assessment
Walk-through, risk register and the prioritized report, delivered in ten business days.
$2,480Up to 10 staff. 11–30 staff: $3,790.
Ask about this
Fairfield, IA · Security for small medical & dental practices
You want patient records that stay private. Here’s how it happens.
A fixed-fee HIPAA security risk assessment, a ranked report your office manager and an auditor can both read, and hardware keys on the accounts that matter. Built for practices of two to thirty people.
Priced firstA fixed fee, written down before anyone opens a laptop in your office.
Invoiced lastThe bill arrives when the prioritized remediation report does.
Mon–Fri 8am–6pmEvenings by appointment, for practices that see patients all day.
How an engagement runs
From the front desk to the invoice
The walk-through
Half a day on site. We trace where patient data really lives: the front-desk PC, the imaging workstation, the fax that became an email, the router in the supply closet.
The register
Every gap goes into a risk register, scored by how likely it is and how much it would cost you. Not by how alarming it sounds.
The report
A prioritized remediation report, delivered within ten business days. Ranked, costed, with an owner and a date beside each line. This is the point we invoice.
The fixes
Optional. We roll out hardware-key MFA, run the staff session, or hand the list to your current IT vendor. Either is fine by us.
Field notes
The back office, as we usually find it
What you actually receive
Three things you can put on the desk
The report
A line for every finding, in the order to fix them
Not a 90-page binder. Each finding names what we saw, the Security Rule safeguard it touches (administrative §164.308, physical §164.310, technical §164.312), what it costs to fix, and who in your office can do it.
- Ranked by risk, not by category
- A cost and a date next to every line
- Written so a billing clerk and an auditor read the same page
The keys
Phishing-resistant means a key, not a code
A texted code can be typed into a fake login page. A hardware key won’t answer one. We enrol each person at their own desk, on email, your EHR and remote access, and register a backup key for every account.
A practice of eight is usually done in a day.
Before we arrive
On the desk the morning we come
Nobody needs to tidy up. It helps if these are findable:
- Your last risk analysis, if there was one, even if it’s old
- A list of every device that touches patient records
- The name of your EHR or practice-management vendor, and your agreement with them
- Who holds a key or a code to the building
- The router’s admin login. Please not the sticky note.
Fixed fees
What it costs, written down first
Phishing-resistant MFA rollout
Hardware keys enrolled at each desk, with a backup key per person.
From $1,860Up to 15 accounts. Keys at cost, $52 each.
Ask about this
Staff security training
Ninety minutes on site, with a phishing drill run against your own inboxes.
$640Per session, up to 20 people.
Ask about this
Annual re-check
A year later we re-run the register and reissue the report with what changed.
$960Flat, for existing clients.
Ask about this
If a finding isn’t in the report, it isn’t on the invoice.Our billing rule
Billing
Invoiced on delivery
Nothing is billed until the prioritized remediation report is in your hands. Then one invoice, net 30.
- ACH
- Check
- Visa
- Mastercard
Book a walk-through
Half a day, then you know where you stand
Mon–Fri 8am–6pm · evenings by appointment
Find us
Most work happens at your practice
908 Sunset DriveFairfield, IA 52556
We travel to practices within an easy drive of Fairfield, IA. Come by the office if you’d rather talk it through first.
- Mon–Fri
- 8am–6pm
- Evenings
- By appointment
Tell us about the practice
How many chairs, how many staff, which EHR
Ready when you are
A fixed price before we set foot in the building
That’s the offer. A risk assessment from $2,480, a ranked report in ten business days, and an invoice only after it arrives.