Solutions / Medical & dental practices
Patient data protected, and the paperwork to prove it.
HIPAA expects every practice to have a current security risk assessment and to act on it. We run yours, fix what it finds and keep the documentation ready for an auditor or an insurer.
- 1assessment
- HIPAA expects one on file, kept current as your practice changes.
- 6years
- How long HIPAA asks you to keep security policies and records.
- 60days
- The outer limit for telling patients about a breach of their records.
- 20min
- Is all we need from you to get started.
How it works
From first call to a finished assessment
Most of the work is ours. We need a little time from whoever runs your front office.
Your HIPAA plan
Ready for an auditor or insurerWeek 1
20-minute call
Which systems hold patient data: practice software, imaging, email, front-desk PCs.
Week 2
Risk assessment written
Every place patient data lives, what could go wrong and how likely it is.
Weeks 3–4
Fixes in place
Two-step login, encrypted laptops, tested backups and locked-down Wi-Fi.
Every year
Reviewed and refreshed
Short staff training, and a fresh assessment whenever your setup changes.
Questions from practices
What practice owners ask us first
Our practice software is in the cloud. Isn’t security their job?
Partly. The vendor protects its own servers. HIPAA still holds your practice responsible for who logs in, the computers in your office, your email and your backups. Your assessment covers all of it.
We filled out a risk assessment template once.
That’s a start, but HIPAA expects the assessment to reflect how your practice works today, and to be acted on. We check it against your real setup and fix the gaps.
Will you need to see patient records?
No. We work on the systems around them: logins, computers, email and backups. If any part of our work could touch patient information, we sign a business associate agreement before we start.
Does this cover therapists and chiropractors too?
Yes. If you send claims or other standard transactions electronically, HIPAA treats you as a covered entity, whatever your specialty. The plan scales down to a solo practice.
What happens if we have a breach?
Call us first. We help you contain it and work out what was exposed. HIPAA gives you at most 60 days to tell affected patients, and breaches are also reported to HHS.
Other businesses we look after
- Tax preparers & CPA firmsFTC Safeguards Rule
- Contractors & home servicesWebsite leads and payment fraud
- Manufacturers & distributorsRansomware and supplier requirements
- Retail shopsPCI DSS for card payments
- Restaurants & cafésPCI DSS for card payments
- Consultants & agenciesClient security questionnaires
- Salons, spas & gymsBooking and payment data
- Auto dealers & repair shopsFTC Safeguards Rule for dealers
- Nonprofits, schools & childcareDonor, family and student data
- Real estateWire fraud at closing
- Law firmsDuty of client confidentiality
- Financial & insurance officesFTC Safeguards Rule and state insurance laws