Skip to content

Solutions / Medical & dental practices

Patient data protected, and the paperwork to prove it.

HIPAA expects every practice to have a current security risk assessment and to act on it. We run yours, fix what it finds and keep the documentation ready for an auditor or an insurer.

1assessment
HIPAA expects one on file, kept current as your practice changes.
6years
How long HIPAA asks you to keep security policies and records.
60days
The outer limit for telling patients about a breach of their records.
20min
Is all we need from you to get started.

How it works

From first call to a finished assessment

Most of the work is ours. We need a little time from whoever runs your front office.

Your HIPAA plan

Ready for an auditor or insurer
  1. Week 1

    20-minute call

    Which systems hold patient data: practice software, imaging, email, front-desk PCs.

  2. Week 2

    Risk assessment written

    Every place patient data lives, what could go wrong and how likely it is.

  3. Weeks 3–4

    Fixes in place

    Two-step login, encrypted laptops, tested backups and locked-down Wi-Fi.

  4. Every year

    Reviewed and refreshed

    Short staff training, and a fresh assessment whenever your setup changes.

Questions from practices

What practice owners ask us first

Our practice software is in the cloud. Isn’t security their job?

Partly. The vendor protects its own servers. HIPAA still holds your practice responsible for who logs in, the computers in your office, your email and your backups. Your assessment covers all of it.

We filled out a risk assessment template once.

That’s a start, but HIPAA expects the assessment to reflect how your practice works today, and to be acted on. We check it against your real setup and fix the gaps.

Will you need to see patient records?

No. We work on the systems around them: logins, computers, email and backups. If any part of our work could touch patient information, we sign a business associate agreement before we start.

Does this cover therapists and chiropractors too?

Yes. If you send claims or other standard transactions electronically, HIPAA treats you as a covered entity, whatever your specialty. The plan scales down to a solo practice.

What happens if we have a breach?

Call us first. We help you contain it and work out what was exposed. HIPAA gives you at most 60 days to tell affected patients, and breaches are also reported to HHS.