Written for practice administrators and founders who need to make a decision this month.
Three common paths. Same Security Rule duty. Different depth and what you can reuse later.
Guided questionnaires, templates, and a generated report.
You have someone internal who can own answers and follow-up.
Thin evidence for carriers and payers when someone asks for proof; rushed answers leave gaps.
A faster, cheaper look with limited interviews and light documentation.
Budget is the main constraint and scope is already narrow.
Gaps that show up at renewal; little continuity into next year.
A flat-fee Security Rule risk assessment (typical single-site remote, fixed fee, scoped on a short call, 2 to 4 weeks) with ranked remediation and evidence you can reuse. The Annual Security Program keeps that analysis current as Quarter 1 of a prepaid year.
You want usable carrier/payer evidence and a calm path: Assess → Remediate → Annual → Train.
We guide and verify. Your IT or MSP usually implements. Hands-on Harborline engineering is optional after a scoping call (quoted separately).
Twenty things carriers ask for at renewal, grouped by identity, devices, backups, policies, and what to send the broker. Read it on the page, tick the boxes, and download it.
Get the checklistA calm hour-by-hour plan for the first three days after a letter arrives, written for practice admins. Read it on the page, download it, or print it.
Get the checklistDated OCR, Verizon, IBM, and KLAS numbers writers can cite, with primary links.
View the citation hubWhat a HIPAA Security Rule risk assessment costs, what it has to include, and how it leads into the Annual Security Program.
Read the guideThe evidence carriers now ask for at renewal, and how to close the real gaps before your broker submits the application.
Read the guideHow the fixed fee is set for a typical single site, what affects the scope, and what you get in 2 to 4 weeks.
Read the guideA side-by-side of the one-time report and the Annual Security Program, plus three questions that settle it.
Read the guideWhat each one answers, when a practice needs which, and which one carriers and auditors usually ask for.
Read the guidePlain-English posts for practice admins and owners.
What cyber insurance questionnaires ask small practices about MFA, backups, and EDR, and the evidence a practice admin should have ready before signing.
Front desk habits are where outpatient program security shows up day to day: badges, PHI at reception, shared logins, EHR workstations, and MSP handoffs.
A plain-language guide to HIPAA risk assessments for small outpatient clinics. What it covers, how long it takes, and what happens after.
A checklist tells you what to do. Four outside lenses tell you why it matters. Here is how outpatient practices get more from a security review.
The most common HIPAA security risk analysis mistakes for practices with 5 to 100 staff, and how to fix them without a free assessment or a checkbox PDF.
A short HIPAA compliance guide for practice admins and owners at 5 to 100 staff clinics. What to keep current, what to ignore, and when to scope a flat-fee assessment.
A practical picture of HIPAA Security Rule readiness for outpatient practices. Administrative, physical, and technical safeguards without enterprise theater.
Why cyber insurers ask for immutable or offline backups and a dated restore test. A practical evidence checklist for medical and dental practices.
Short MFA hardening checklists for Google Workspace and Microsoft 365 in medical and dental practices. Evidence carriers ask for, without enterprise theater.
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.