Services · Fixed fees

You want to know what this costs before anyone arrives. Here it is.

Four engagements, each with a price written down first. We bill when the prioritized remediation report is delivered, not before.

Assessment

HIPAA security risk assessment

The analysis the Security Rule asks for (§164.308(a)(1)), done on site and written for the people who have to act on it. Half a day at your practice, then a risk register and a prioritized remediation report within ten business days.

  • Walk-through of every device and room that touches patient data
  • Risk register scored by likelihood and cost
  • Report with an owner and a date beside each line
  • One follow-up call to go through it with your office manager

$2,480

Fixed fee, up to 10 staff.

11–30 staff
$3,790
On site
Half a day
Report
10 business days
Request this quote
A floor plan of a small clinic being marked up with a pencil beside a laptop and clipboard
Access

Phishing-resistant MFA rollout

Hardware security keys, enrolled at each person’s own desk on email, your EHR and remote access. Every account gets a registered backup key, so a lost key is an inconvenience and not a lockout.

  • Enrolment at the desk, one person at a time
  • Backup key registered for every account
  • Text-message codes switched off once the key works
  • A one-page recovery sheet for your office manager

From $1,860

Up to 15 accounts.

Keys
$52 each, at cost
Eight-person practice
Usually one day
Request this quote
People

Staff security training

Ninety minutes in your break room, built from your own findings. Before the session we run a phishing drill against your real inboxes, so the examples on the screen are ones your staff nearly clicked.

  • Phishing drill a week ahead, results shown without names
  • What to do when a patient emails a photo of their insurance card
  • Sign-in sheet kept for your HIPAA training file

$640

Per session, up to 20 people.

Length
90 minutes
Timing
Before opening or at lunch
Request this quote
Follow-up

Annual re-check

A year on, we re-run the register against what changed: new staff, a new scanner, a new EHR module. You get the report reissued with each line marked fixed, open or new.

  • Register re-scored, not rewritten from scratch
  • A dated report that shows your progress year to year

$960

Flat fee, for existing clients.

Timing
12 months after the report
Request this quote

Scope

What the fee covers, and what it doesn’t

Inside the fixed fee

  • Travel to practices within an easy drive of Fairfield
  • The on-site day and every hour of writing up
  • One review call after the report
  • Evening visits, by appointment

Quoted separately

  • Hardware keys beyond the first set, at $52 each
  • Replacing equipment the report flags
  • A second training session for more than 20 people

If a finding isn’t in the report, it isn’t on the invoice.

Side by side

Which one to ask about first

Fixed fees, invoiced on delivery
ServiceBest whenTime on siteFee
Risk assessmentYou have no current analysis, or it’s three years oldHalf a day$2,480
Hardware-key MFAStaff sign in to email and the EHR with a password and a texted codeA day for eight peopleFrom $1,860
Staff trainingYour last session was a slideshow in 202290 minutes$640
Annual re-checkYou’ve had the report for a yearA few hours$960

Before you call

The questions practice managers ask first

Is the fee really fixed?

Yes. The number in the quote is the number on the invoice. Hardware keys are the one variable, at $52 each, and you approve the count first.

When do we pay?

After the prioritized remediation report is delivered. One invoice, net 30, by ACH, check, Visa or Mastercard.

Will this disrupt patients?

Not usually. We work around the schedule, and evening visits are available by appointment for practices that see patients all day.

Do we have to hire you for the fixes?

No. The report is written so your current IT vendor can work from it. We’ll do the key rollout and training if you ask us to, and we’re fine if you don’t.

We’re a practice of three. Is that too small?

The Security Rule applies to a practice of three the same as one of thirty. Practices of two to thirty are who we built this for.

Ready when you are

A fixed price before we set foot in the building

A risk assessment from $2,480, a ranked report in ten business days, and an invoice only after it arrives.

Call (641) 451-4843 frontdesk@rosewalkquarter.com