Spec 00 · Northport, NY · HIPAA security
Fixed-fee HIPAA security for independent dental and therapy practices — assessed remotely, written in plain English, invoiced only when it’s done.
Nothing to install and nothing billed monthly. We look at your practice over video and screenshare, write down plainly which gaps would actually hurt you, and send the invoice after the report is already in your inbox — not a day before.
Spec 01 · What you can buy
Every engagement has a number before it starts and an invoice after it ends. Nothing in between runs on a meter, and nobody calls you to “discuss scope” in week two.
$1,740 per location · up to 15 staff
Not includedA penetration test. If you genuinely need one, we’ll say so and tell you why.
Quote the assessment$685 per 90-day campaign
Not includedA shaming leaderboard. Clicks are a training problem, not a firing offense.
Quote a campaign$1,190 or $640 with an SRA
Not includedThe fixes themselves. We don’t do IT work, and that’s on purpose.
Quote the roadmapBooking the assessment and the roadmap together? The roadmap drops to $640, because by then half its homework is already done — and charging you twice for the same homework would be silly.
Price both togetherSpec 02 · Objections, answered
Short answers, including the ones that cost us business. If one of these makes you decide you don’t need us, good — that’s cheaper for you.
Panel A · Is it worth the money
If your practice stores or sends patient information electronically — scheduling software, digital X-rays, e-prescribing, a billing portal — the HIPAA Security Rule expects a documented risk analysis, kept current. It’s also the first document OCR asks for after a breach, and it keeps showing up on cyber-insurance renewal forms.
Sometimes, honestly. It’s a decent tool. If someone in your office has a few free afternoons and the patience to answer it truthfully, use it and keep the $1,740. Most practices we talk to opened it once, got partway in, and closed the tab. You’re paying us for the legwork, the judgment calls, and a document written in sentences.
Panel B · What it costs besides money
About three hours spread over two weeks: a 60-minute kickoff, a 30-minute video walkthrough, and a 45-minute readout. Your office manager will spend extra time pulling a device list. We send a template so they’re not guessing what we want.
Mostly, yes. The trade-off: we won’t personally poke around your supply closet. Someone walks us through it on a phone camera — router, server, the X-ray PC, the fax machine nobody admits still works. It’s thirty slightly awkward minutes, and it’s why the price isn’t double.
No. We aren’t your IT provider and we don’t want the conflict of interest of grading our own homework. The roadmap is written so your IT person — or whoever you hire — can act on it directly.
Panel C · If it goes sideways
Some will feel caught the first time. That’s sort of the point. But we report by role, not by name, unless you specifically ask, and the debrief is about the tell-tale signs, not the culprits. Nobody gets a wall-of-shame slide.
Say so in the readout. If we missed something you showed us or got a fact wrong, we correct the document before the invoice goes out. Disagreeing with a risk rating is fine too — we’ll explain our reasoning and record your position in writing.
Yes, before we look at anything. If your attorney prefers their own BAA template, send it over — we’ll review it rather than insist on ours.
You don’t need a security program. You need to know the three things that would actually hurt you — and fix those first.
Spec 03 · Who this is for
Most small practices don’t get breached by some hooded genius. They get breached by a reused password, an old PC nobody wanted to replace, and a convincing email at 4:45 on a Friday. That’s the scale we work at, and it’s the only scale we work at.
Spec 04 · Sample roadmap page — format only, not a client
No 80-slide deck, no heat map in six shades of red. A ranked list of findings, each with the fix, the owner and a believable effort estimate. This is the format, filled in with the kind of thing that turns up in a typical office.
Front desk shares one Windows login (“frontdesk”) across three PCs.Fix: individual logins for each person, screen lock after five idle minutes.
Panoramic X-ray PC still on Windows 10, past end of support.Fix: upgrade with the imaging vendor, or isolate it on its own network segment.
Patient Wi-Fi and office Wi-Fi are the same network.Fix: split a guest network; change the password taped under the waiting-room TV.
Backups run nightly. Nobody has ever tested a restore.Fix: quarterly restore test of one patient chart, logged with date and initials.
SRA $1,740 · Roadmap $640 when booked together
Spec 05 · Get a number
Fill in the form and we’ll reply within one business day with one price, what it covers, and what it doesn’t. If we think you don’t need us yet, we’ll say that too.
Replies Mon–Fri 9:30am–4:30pm
One price, in writing, with what’s covered and what isn’t. No discovery call required unless you want one.
We both sign the BAA. You pick a 60-minute kickoff slot that doesn’t collide with your patient schedule.
Readout call, written report, then the invoice — net 30. That order never changes.
Invoices payable by