Every practice that handles electronic patient information is required by the HIPAA Security Rule to do an accurate and thorough risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and to keep it current. Many small practices skip it because they assume it means a long, expensive engagement. It does not have to.
What you should get
- An inventory of where patient information lives: EHR, imaging, email, billing, backups and the devices people actually use.
- A list of threats and weaknesses for each, rated by likelihood and impact.
- A review of the policies and procedures HIPAA expects, and where yours are missing or out of date.
- A remediation plan in priority order that your staff or IT provider can actually follow.
- Documentation you can hand to an auditor, an insurer or a partner who asks.
How I do it
I run the analysis remotely over 10 business days. We start with a short kickoff, I interview the people who run the office and review your setup, and you get a written report and a walkthrough call. The scope is policy and process, so there is no technical testing involved. That keeps it fast and predictable.
Pricing
- $2,750 flat for a practice with up to 25 staff.
- $3,950 for multi-site practices or healthtech companies.
- A founding client price of $1,950 for the first few practices who agree to share a testimonial afterward.
I have looked after one medical practice’s security for 15 years, so I know what a small office can realistically fix and what can wait. This article is general information and not legal advice.
If any of this sounds like your situation, book a 30-minute call and tell me a little about your organization. I reply personally.
Need ongoing management? See Dark Edge plans.