Skip to main content
Harborline
HIPAA Security Rule · Risk assessment · Annual program

A clear HIPAA Risk Assessment for your practice in 2 to 4 weeks.

HIPAA requires a Security Rule risk analysis. Harborline delivers a current one for outpatient practices in 2 to 4 weeks, fixed fee, scoped on a short call.

Most security pitches ask your team to tough it out alone. We assess, explain in plain English, and stay for the year if you want continuity.

For a typical single-site remote Security Rule risk assessment, delivery is usually 2 to 4 weeks after kickoff. Same Harborline number when you call: (502) 41-HIPAA.

No breach theater. A calm path: Assess → Remediate → Annual → Train.

Book a 30-minute scoping callSee the Annual Program
Risk assessment
Fixed fee

Quoted in writing after a short scoping call. Single site. 2 to 4 weeks.

Annual program
Fixed fee

Quoted in writing after a short scoping call. Prepaid. Assessment is Quarter 1.

The Annual Security Program keeps that required analysis current: assessment is Quarter 1 of the prepaid year.

Common situations

Pick the one that matches what landed on your desk.

Cyber insurance renewal

Your carrier wants a current risk assessment and a clear remediation plan before your cyber insurance policy renewal. We quote a fixed fee up front.

Book a 30-minute scoping callCyber insurance renewal without the scramble
OCR inquiry or breach notice

You need a defensible picture of your Security Rule posture and a path forward. We respond within one business day.

Got an OCR or auditor letter?
Payer questionnaire

A payer or partner sent a security questionnaire and the answers need evidence behind them.

Stuck on a payer questionnaire?
Something looks wrong right now? Start here
How Harborline works

Assess · Remediate · Annual · Train

01

Assess

Flat-fee HIPAA / 360° risk assessment. Clear picture in 2 to 4 weeks.

Fixed feeQuoted in writing after a short scoping call. Single site. 2 to 4 weeks.
Outside Look

Four lenses (patient, regulator, attacker, peer) in plain English.

Lens 1

Patient

If a patient could see every place their data lives and every person or system that touches it, would they still feel that trust is warranted?

Lens 2

Regulator

If an auditor showed up tomorrow, what would they ask for, and could you produce it?

Lens 3

Attacker

If someone wanted to get into your systems today, where would they start?

Lens 4

Peer

What are comparable practices doing, and where do you stand relative to that baseline?

See the Outside Look
02

Remediate

Your IT/MSP implements; Harborline verifies. Optional Harborline-led packages when scoped.

03

Annual Program

Year-round cadence. Assessment is Quarter 1 of the Annual Security Program.

See the Annual Program
04

Train / tabletop

Awareness, tabletop, and readiness drills with your team.

Who we serve
  • Independent and multi-site outpatient medical practices
  • Dental, behavioral health, and specialty groups
  • Practice admins and owner-physicians (about 5 to 100 staff)
Why teams pick us

Four things that make this different

01

A clear picture of where you stand

A HIPAA Security Rule risk assessment for a typical single-site, remote practice takes 2 to 4 weeks. We scope it on a short call, then confirm the fixed fee and the start date in writing before we begin.

02

A ranked plan you can act on

You get findings ordered by real risk and effort, with owners and timing. No checkbox theater and no lecture.

03

Risk managed all year, not once

Compliance is a calendar, not a project. Quarterly work keeps the plan current, evidence organized, and someone available when a renewal or questionnaire lands. Your organization remains accountable for HIPAA compliance.

04

Operator-led, not a handoff

Software can guide you through questions. It cannot take responsibility for the answers. The work is led by Harborline senior practitioners with CISO experience at national healthcare companies, not by a junior analyst with a questionnaire.

The Annual Security Program

Risk managed across the year, with the assessment as Quarter 1

Fixed fee, scoped on a short call. The assessment is Quarter 1. You can buy the assessment on its own; the program adds the rest of the year, so insurance renewals, OCR requests, and payer questionnaires arrive against evidence that is already current.

See the Annual Program
Q1

Assessment

Breach risk, compliance posture, privacy requirements, and practical impact, turned into the work plan for the year.

Q2

Check-in

Progress review with your IT team or MSP. Evidence verified as items land.

Q3

Check-in

Plan refreshed against what changed: vendors, systems, staffing, and new requirements.

Q4

Renewal-ready

Evidence organized for insurance renewals, payer questionnaires, and regulator requests.

How it works

Three steps, no mystery

  1. 01

    Scoping call

    Thirty minutes. We cover your sites, systems, vendors, and any deadline pushing this forward. You leave with a scope and a price.

  2. 02

    Assessment and plan

    We review controls, interview the people who run them, and deliver a findings report with a prioritized remediation plan in plain English.

  3. 03

    Annual cadence

    Policies, training, tabletop exercises, vendor reviews, and reporting run on a schedule so next year starts ahead instead of behind.

See what a HIPAA risk assessment costs for one site and for extra locations.

What this looks like in practice

Three moments that bring teams to us

Illustrative situations we commonly see (not client quotes). Names and identifying details withheld.

Insurance renewal

A multi-site practice gathered current application answers, mapped each answer to supporting evidence, and turned unsupported controls into an owned work plan for its IT partner.

OCR inquiry

A specialty group assembled a current risk analysis and organized evidence package inside the stated OCR response window, ready for counsel review.

Peer comparison

A practice compared its vendor oversight and training cadence with peers, documented the gaps, and placed the agreed updates on a quarterly program calendar.

Who you work with

A small team of senior healthcare security practitioners

Harborline engagements are led by senior practitioners with CISO experience at national healthcare companies, HITRUST r2 certification work, and board-level reporting. You get a named engagement lead and consistent support, not a rotating analyst or a questionnaire handoff.

Credentials
Credentials earned by the team over the years have included CISSP, CISA and CRISC.
Background
CISO, national healthcare · HITRUST r2
Based in
Idaho, serving Montana, Wyoming, Oregon, Washington, and Utah
More about Harborline
FAQ

Questions we get first

Does every practice need a HIPAA risk assessment?

Yes. The HIPAA Security Rule requires a risk analysis for covered entities that create, receive, maintain, or transmit electronic PHI. Business associates have parallel duties for the ePHI they handle. OCR, cyber insurers, and many payers expect that analysis to be current. Most practices refresh at least annually so renewals and questionnaires are not a scramble. Harborline's typical single-site remote assessment is a fixed fee, scoped on a short call, and finishes in 2 to 4 weeks after kickoff.

How is Harborline different from a compliance dashboard?

A green dashboard is not a Security Rule risk analysis. Harborline delivers a ranked, practical plan and evidence you can reuse with brokers and payers. Fixed fee, scoped on a short call, typical single-site remote; usually 2 to 4 weeks after kickoff.

Who is Harborline for?

Practice admins, office managers, and owner-physicians at outpatient practices with about 5 to 100 staff who need a real HIPAA Security Rule risk analysis and a calm Assess → Remediate → Annual → Train path.

How long does an assessment take?

Most single-site remote engagements deliver in 2 to 4 weeks after kickoff, depending on how quickly your team can join sessions and share documents.

Will Harborline configure our MFA, SSO, or other controls?

Harborline's assessment produces a ranked remediation plan. Hands-on work usually stays with your practice IT or MSP, with Harborline guiding the plan and verifying evidence. When you want Harborline closer to the implementation work, we can discuss remediation options on a scoping call. We do not publish fixed MFA/SSO engineering prices on the site; those are quoted after a short scoping call.

Is there a discount or starter package?

No. The HIPAA Risk Assessment, the Annual Program, additional assessment sites (travel at cost for on-site), and the optional Physical Security Walkthrough add-on are each a fixed fee, scoped on a short call. Scope changes are confirmed on a free 30-minute scoping call before any SOW.

What is the Physical Security Walkthrough?

Most Harborline HIPAA Risk Assessments run remote. That stays the default. When a practice wants someone on the floor looking at doors, badges, clinics, and how the waiting room really works, we offer a Physical Security Walkthrough. It is an add-on with the HIPAA Risk Assessment, fixed fee, scoped on a short call. You get observed physical-safeguard findings and a sit-down with the people who run the office. Not a questionnaire you fill out alone. Your IT contact or MSP still implements. We stay the third-party view.

What is the next step if we are just exploring?

Book a 30-minute scoping call. We confirm fit and scope together. No SOW until both sides agree it makes sense.

When you are ready to see if a Harborline assessment fits your practice, book a 30-minute scoping call.

New to this? Read Choosing a HIPAA Risk Assessment for a small practice.

Next step

Book a 30-minute scoping call

Bring your renewal date, your questionnaire, or just your questions. We will tell you what the work looks like and what it costs.

Book a 30-minute scoping call