Ongoing risk management for the year, not a one-off report
Fixed fee, scoped on a short call. The Security Rule risk assessment is Quarter 1. Four quarterly check-ins keep the plan current, evidence is verified with your IT team or MSP, and async questions are included up to 4 hours per quarter.
Fixed fee, no surprises
Two clear steps. You can buy the assessment on its own; the program adds the rest of the year.
Quoted in writing after a short scoping call, for a typical single site, remote, delivered in 2 to 4 weeks. It is also Quarter 1 of the Annual Security Program.
Quoted in writing after a short scoping call. Prepaid. Light continuity across four quarters, not a fractional CISO retainer.
What the program includes
- 1 annual reassessment, the Security Rule risk assessment as Quarter 1
- 4 quarterly check-ins
- Light async questions, capped at 4 hours per quarter
- A named Harborline advisor who knows your environment
- Board-ready reporting: two pages on what changed, what is open, what it costs to close
- Evidence organized for insurers, payers, and regulator requests
Additional sites are a fixed fee, scoped on a short call, confirmed on the scoping call. Anything beyond that scope is quoted separately. The 4 hour quarterly cap is a hard cap, so nobody is guessing what is included.
What a year looks like
Every quarter has a deliverable and a date. Nothing waits until the week before a renewal.
Annual HIPAA Security Rule risk assessment, findings report, and a remediation plan ranked by risk and effort.
Policy and procedure refresh, workforce security training, and evidence collection you can hand to an auditor or payer.
Incident response and business continuity tabletop, vendor and business associate review, and access recertification.
Remediation verification, security metrics, and a board-ready summary of posture and next year's plan.
The triggers we see most often
Insurance renewal
Cyber insurance carriers now ask for real evidence: risk assessment, policies, training, incident response. We build that evidence before renewal season.
OCR letter
An OCR inquiry or breach notification deadline exposes every gap at once. The annual program means the documentation is already current and the response is calm.
Board or payer pressure
Owners, boards, and payers want proof that security is managed, not hoped for. We give you a program and metrics they can read.
Breach scare or near miss
A phishing test, ransomware headline, or vendor incident makes it clear that once-a-year compliance is not enough. We turn the reaction into a plan.
Annual program questions
What is an Annual Security Program?
A prepaid year of light continuity: one annual reassessment, four quarterly check-ins, and async Q&A (4 hours per quarter cap). Designed for practice admins who want a named Harborline senior-practitioner touchpoint without a heavy retainer.
How is it different from a one-time assessment?
The assessment is a standalone analysis and roadmap (typical delivery 2 to 4 weeks). The Annual Security Program adds year-round rhythm. You can buy the assessment on its own; the program adds the rest of the year.
Is the Annual Program four more full assessments?
No. Continuity model: one annual reassessment plus quarterlies and capped async Q&A. Not four full assessment fees.
Does “prepaid” mean we pay everything up front?
The program is billed as a fixed fee, scoped on a short call, prepaid, for the agreed year of light continuity. Exact payment terms are confirmed in the SOW after scoping.
When does a fractional CISO make more sense?
When you need deeper ongoing ownership than light quarterlies and capped async Q&A. Harborline can discuss ongoing advisory support separately, and it is quoted on the scoping call.
Can we join the Annual Program without a Harborline assessment first?
Sometimes, if you already have a solid recent analysis and mainly need continuity. Fit is decided together on the scoping call.
Where does implementation fit with the Annual Program?
Assessment finds and ranks issues. Remediation closes them (MSP primary + Harborline verify, or Harborline implementation options when scoped). The Annual Program keeps rhythm after that (reassessment, quarterlies, capped async Q&A). Training sits with that continuity so the office does not lose the habit.
If light annual continuity fits better than a one-time binder, book a 30-minute scoping call and we will map assessment vs Annual Program together.
See whether the annual program fits
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.