HIPAA security for independent clinics · Sayville, NY
Fixed-scope HIPAA security risk assessments, phishing training and endpoint hardening for independent medical and dental practices. One invoice per job, a ranked fix list, and paperwork that holds up when someone asks for it.
Mon–Fri 8am–6pm · evenings by appointment
Priced engagements
Every engagement has a fixed scope and a number on it. If we trip over something outside that scope, we tell you what it is and what it would cost, and you decide. We don’t quietly bill for it, and we don’t run a meter while we “investigate.”
Flagship
Up to 15 staff and 20 devices. Office walkthrough, technical checks, ranked remediation roadmap and the written risk analysis HIPAA requires.
Scope this onePeople
A 90-minute live session at your office, then three simulated phishing emails over 60 days. We report who clicked to you only as a group, never as names.
Book a sessionMachines
Disk encryption on, local admin rights off, patching automated, MFA on email. Done after hours so the front desk never stops.
Price my machinesFollow-up
We sit with your practice manager and sort every finding into this month, this quarter, or honestly, later.
Reserve two hoursYearly
We re-test last year’s findings, log what changed, and update your documents so the risk analysis is never a year stale.
Schedule the recheckBigger office than 15 staff or 20 devices? Same method, quoted per head. See the full scope sheets.
You see the total before kickoff. Jobs over $1,500 split in two: half at kickoff, half when the roadmap lands.
business days from kickoff to your written roadmap.
Run late on our side and the invoice drops by $150. Run late on yours (nobody found the router password) and we’ll say so.
No commissions, no preferred vendors. If the fix is a free setting in Windows, that’s what the report says.
The quiet part, out loud
We’d rather say it than sell around it: most independent clinics don’t need a six-figure stack. They need encryption switched on, admin rights taken away, and one lunch hour where everyone learns what a fake invoice email looks like. That’s mostly the job.
Independence, in writing
No software commissions, no managed-service upsell tucked into the roadmap. When something paid is the right call, we name two options and the trade-off between them, including the cheaper one that’s a little more work for you.
Paperwork, not shelfware
Each finding names the room, the machine, the person it touches, how bad it is, how long the fix takes and what it costs. The same pages double as your risk-analysis record if an auditor ever asks to see it.
What happens to your two weeks
Your front desk will notice us on day 1 and forget about us by day 3. Here’s the whole run.
A fixed quote by invoice, based on headcount, workstations and locations. Nothing starts until you approve it.
Front desk, operatories, the closet with the router. We ask where the password list lives and don’t flinch at the answer.
Patch levels, encryption, backups, email filtering, MFA. Anything heavy waits for before 8am or after 6pm.
Every finding scored by likelihood and damage. Cheap, high-impact fixes go first.
Plain-English report, risk-analysis documents, and a 60-minute team walkthrough.
Before the first call
Don’t have all of it? Call anyway. We’ll help you find it.
Straight answers
No, and anyone who says it does is selling something. The assessment is the required analysis; compliance is what you do with the roadmap afterward. We hand you the documents, the ranked list and the order to tackle it in. You fix it yourself, or hire us for the hardening job.
Checks during clinic hours are read-only and light. Anything heavier, such as patching or encrypting drives, happens before 8am or after 6pm. We never scan your live EHR during appointments without your say-so.
We don’t resell software, run 24/7 monitoring, or act as your day-to-day IT desk. If you need a managed IT provider, we’ll tell you, and give you the five questions to ask them before you sign.
By invoice, one per engagement, quoted up front. ACH, check or card. For jobs over $1,500, half is due at kickoff and half when we deliver. There is no retainer and no hourly meter.
Then you hear it from us first, not from an attacker or a regulator. Findings go to you and nowhere else. If something might count as a reportable incident, we tell you that day so you can call your attorney.
Get a price
Fifteen minutes on the phone is enough to scope most jobs. Mon–Fri 8am–6pm, or evenings by appointment.
Two numbers and your EHR name. You’ll get a fixed quote back, usually within one business day.
340 Wyandanch Rd, Sayville. Bring the sticky note with the router password on it. We won’t judge, much.
Quote form
Tell us roughly how many people and computers you have and what’s worrying you. A human reads every message, and we reply during business hours.
No newsletter, no sales sequence. One reply from us, with a price.
