About Rosewalk Quarter

You want to hire someone who’ll explain the risk in plain English. Here’s who that is.

We’re a small consultancy on Sunset Drive in Fairfield, IA. We do three things for small medical and dental practices, we price them before we start, and we send the bill after the report.

A walnut desk with an annotated report and a hardware security key in warm window light
Fig. 3Sunset Drive, 4:50pm. A report getting its last pencil pass.

Why this shop exists

Small practices got the same rules as hospitals and none of the staff

HIPAA’s Security Rule doesn’t scale down. A four-chair dental office owes the same risk analysis as a hospital system, and usually has an office manager doing it between phone calls.

Most of what’s on offer is either a 90-page binder nobody reads or a software subscription that scans and shrugs. We started Rosewalk Quarter to do the middle thing: sit in the back office, look at what’s actually there, and write down what to fix first.

We work with practices of two to thirty people. That’s deliberate. It means the person who walks your office is the person who writes your report and the person who answers the phone when you have a question about line seven.

The name is a street joke: a walk around the quarter, noting what’s unlocked.

How we work

Four habits we don’t break

  • Price before access

    You get a fixed fee in writing before anyone sits at your front desk. If the scope changes, we say so before the work does, not on the invoice.

  • Ranked, not alarming

    Every finding is scored by likelihood and cost. A missing screen lock and a flat network don’t get the same red font.

  • Keys over codes

    We recommend hardware keys on email, your EHR and remote access because they can’t be typed into a fake login page. We say so even when it costs us a longer install day.

  • Report first, invoice second

    The invoice follows the prioritized remediation report. If a finding isn’t in the report, it isn’t on the bill.

What we do

Three engagements, one report

  • HIPAA security risk assessment, from $2,480
  • Hardware-key MFA rollout, from $1,860
  • Staff training with a phishing drill, $640 a session
  • An annual re-check for returning clients, $960

What we leave alone

Not our trade

  • Selling you hardware or software on commission
  • Running your day-to-day IT or help desk
  • Promising you won’t be audited
  • Handing your findings to anyone but you

A typical engagement week

Where the ten business days go

Day 1On site. Walk-through of every room that touches patient data.
Days 2–3Device list, vendor agreements and access review, mostly by phone and email.
Days 4–7Risk register built and scored. Safeguards mapped to §164.308, .310 and .312.
Days 8–9Report drafted, costed, and read aloud once to a colleague who hasn’t seen your office.
Day 10Delivered. Then, and only then, the invoice.

Ready when you are

A fixed price before we set foot in the building

A risk assessment from $2,480, a ranked report in ten business days, and an invoice only after it arrives.

Call (641) 451-4843 frontdesk@rosewalkquarter.com