Spec sheet · Services · Northport, NY
Everything we sell, what it costs, how long it takes, how much of your week it eats — and what isn’t in the box.
No packages named after metals. No “starting at” that quietly doubles on the sales call. Each service below has one price for a practice of up to 15 people, a list of what you’ll be holding when it’s done, and a short list of what we won’t do. The invoice still arrives after the report, never before it.
Sheet 01 of 05 · SKU SRA-01
This is the document §164.308(a)(1)(ii)(A) is talking about: an accurate, thorough look at where patient data lives in your practice and what could realistically go wrong with it. We do it over video, write it in sentences, and hand you a file you can put in front of OCR, your cyber insurer, or a nervous incoming associate.
| Line item | What it actually is | Your time |
|---|---|---|
| L-01Kickoff call | We learn how the practice really runs — who logs into what, where the server lives, who your IT person is, and what keeps you up at night. | 60 min |
| L-02Asset inventory | A spreadsheet of every device, account and vendor that touches patient data. We send the template; your office manager fills the gaps we can’t. | ~2 hrs, office manager |
| L-03Video walkthrough | Someone carries a phone camera from the front desk to the network closet. We point, they film. Mildly awkward, very useful. | 30 min |
| L-04Paper vs. practice | We read your policies, backup settings and Microsoft 365 or Google Workspace admin console, then note where real life has drifted from the binder. | None — our homework |
| L-05The written SRA | Threats, vulnerabilities, likelihood, impact and a risk rating for each finding — every one traced to the Security Rule section it touches. | None |
| L-06Readout | Worst risks first. You push back on anything that looks wrong, and corrections land in the document before the invoice goes out. | 45 min |
Sheet 02 of 05 · SKU PHISH-90
$685 per campaign · up to 15 staff · $940 for 16–30
A generic “you’ve won a gift card” test teaches your front desk nothing. We write lures that look like your actual inbox — your payers, your intake habits, your owner’s name — and space them about five weeks apart, so the second one lands right after everyone has relaxed.
Said plainly: results go out by role, not by name, unless you ask. We won’t hand you a list to fire from, and we won’t pretend one campaign fixes a habit.
A claim for one of your patients has been reprocessed. Please review the attached EOB within 48 hours to avoid a payment delay.
The tellNo patient name, a domain nobody has heard of, and a deadline. Payers don’t email EOBs as attachments.
Hi! Couldn’t get the portal to work so I put my insurance card and forms in a shared folder — link below. Thanks so much!
The tellThe “shared folder” is a fake Microsoft sign-in page. The patient doesn’t exist. Friendly is the disguise.
Changed banks over the weekend. Can you swap the account on file before payroll runs? In clinic all day, just reply here. Thanks.
The tellThe display name matches the boss; the address doesn’t. And bosses don’t change bank details by email at 4:41pm.
Sheet 03 of 05 · SKU ROAD-30
An assessment tells you what’s wrong. The roadmap tells you what to do about it, in what order, and roughly what it’ll cost — written so your IT provider (or your nephew, on weekends) can act on it without calling us to translate. Built from your SRA, whether we wrote it or somebody else did.
Price
$1,190$640
$1,190 on its own. $640 when booked with our SRA, because half the homework is already done. Includes a 30-day check-in call.
Add the roadmapHorizon 1
This month
Cheap, fast and embarrassing to leave alone. Usually no purchase involved — just someone’s afternoon.
Typical lineFront desk shares one Windows login. Give each person their own and lock screens after five idle minutes.
Effort · hours
Horizon 2
This quarter
Needs a vendor, a purchase, or a scheduled evening when the office is closed.
Typical lineThe panoramic X-ray PC runs an unsupported Windows. Upgrade with the imaging vendor, or wall it off on its own network.
Effort · days + a budget line
Horizon 3
This year
Structural work. Not urgent until the day it is — and then it’s the only thing that matters.
Typical lineBackups run nightly but nobody has restored one. Test a single chart restore every quarter and log it.
Effort · a small project
We resell nothing — no firewalls, no software licences, no referral fees from the IT shop down the road. If a line says “buy X,” it’s because X fixes the problem, not because we get a cut.
Sheet 04 of 05 · Side by side
Short version: if you can’t find your last risk assessment, start there. If you have a recent one and your staff still click everything, start with phishing. The roadmap is only worth buying if somebody is actually going to do the fixes.
Table · swipe sideways →
| Attribute | SRA-01Risk assessment | PHISH-90Phishing campaign | ROAD-30Remediation roadmap |
|---|---|---|---|
| Price, ≤15 staff | $1,740 | $685 | $1,190 $640 with an SRA |
| Your time | ~3 hrs, plus ~2 hrs from your office manager | 20-minute debrief | 45-minute walkthrough, then a 30-day call |
| Start to report | About 2 weeks | 90 days | About 1 week after the SRA |
| You end up holding | The written SRA, inventory, owner summary | Results by role, debrief recording | A ranked fix list with owners and costs |
| Rule it speaks to | §164.308(a)(1)(ii)(A) — risk analysis | §164.308(a)(5) — awareness training | §164.308(a)(1)(ii)(B) — risk management |
| Good first buy if… | Nobody can find the last one | Your people are the worry | You have an SRA and nothing happened after it |
| Action | Pick SRA | Pick phishing | Pick roadmap |
Add-ons · also fixed
Bigger practice, a second office, an insurance form due next week. Here’s exactly what each one adds, so nobody has to “circle back on pricing.”
Add these belowPolicies and accounts overlap, so we don’t charge you twice for reading them.
Per location. More people, more devices, a longer inventory.
Same three lures, same debrief, more inboxes to track.
One document, with a column for which office each fix applies to.
One hour together answering your renewal form from the SRA, so your answers match your paperwork.
We update last year’s document instead of starting from a blank page.
New lures, same rules. Worth it if the first one stung.
Honestly, you may be bigger than we’re built for. We’ll tell you if so.
Sheet 05 of 05 · Quote builder
This adds up the published prices on this page — nothing hidden in the math. Send it and you’ll get the binding figure in writing within one business day. It’s almost always the same number.