HIPAA Security Rule risk assessment, fixed fee, scoped on a short call
Quarter 1 of the Annual Security Program. One fixed fee buys a clear report across four dimensions, not just a checklist.
Where are the likely breach points? We map the people, systems, and vendors that could expose patient data.
Where do you stand against the HIPAA Security Rule? We identify gaps that regulators and payers ask about first.
What do your notices, consents, and workflows actually promise? We check where privacy obligations and practice reality diverge.
We look at operational, regulatory, and patient-trust impact so you can prioritize fixes in order of real risk. No actuarial dollar estimates.
What it costs
Each item is a fixed fee, quoted in writing after a short scoping call. On-site visits add travel at cost.
One fixed fee, agreed before we start. No free assessments, no unpaid gap lists, no surprise hourly invoices.
For extra locations, on-site work, and what moves the price, see HIPAA risk assessment cost.
Four ways we look at your environment
We examine your risk the way an outsider would: as a patient, a regulator, an attacker, and a peer. Each lens points to a different set of concrete findings.
Patient view
We look at your practice the way a patient would if they requested their records or filed a complaint. Common findings include missing access logs, unclear record-release workflows, and front-desk staff who are unsure how to verify identity. These are the gaps that turn a routine request into a privacy incident.
Regulator view
We review your documentation the way OCR or a state attorney general would during an inquiry. That means checking for an outdated risk analysis, missing required policies, and business associate agreements that do not match your actual vendor list. These are the documentation gaps OCR and state AGs commonly request early in an inquiry.
Attacker view
We trace the paths a low-skill attacker would actually use: stolen credentials, exposed remote access, and untracked devices. Typical findings include weak multi-factor authentication coverage, unmonitored vendor accounts, and old administrator passwords shared among staff. These are the controls that stop opportunistic breaches.
Peer view
We compare your controls against organizations of similar size and specialty, not against a theoretical ideal. We often find incident response plans that are shorter than peers expect, backup testing that lags the usual cadence, and training that does not cover phishing. These are the gaps that show up in payer questionnaires.
How the engagement runs
- 01
Kickoff
A short call to confirm scope, name the people we need for interviews, and set the delivery date.
- 02
Review and interviews
We examine administrative, physical, and technical safeguards, review documentation, and talk to the people who actually run the systems.
- 03
Report and readout
You get the written risk analysis, a ranked remediation plan, and a live walkthrough with your leadership team.
What you receive
- Written risk analysis mapped to the HIPAA Security Rule
- Findings ranked by likelihood, impact, and effort to fix
- Remediation plan with owners and suggested timing
- Executive summary written for non-technical readers
- Evidence index you can reuse for payer and client requests
Risk assessment questions
Do you offer a free assessment or a quick look first?
No free assessments. Every engagement starts with a free 30-minute scoping call so we can confirm fit and scope together. The HIPAA Security Rule risk assessment itself is a fixed fee, scoped on a short call because it includes interviews, analysis, and a written plan. If you need the assessment, we do that work as paid delivery, not as a free preview.
What counts as a site?
Each physical location where staff work with protected health information. The first site is included in the flat fee. Each additional assessment site is a fixed fee, scoped on a short call, plus travel at cost for on-site. That means reviewing another location as part of the assessment scope. The Physical Security Walkthrough is a separate optional visit.
Do you have to come on site?
Usually not. Most HIPAA Risk Assessments are remote at a fixed fee, scoped on a short call, for a typical single site. If you want someone on the floor for physical safeguards, add a Physical Security Walkthrough with the assessment. That is separate from pricing an additional assessment site (travel at cost for on-site).
What is the Physical Security Walkthrough?
Most Harborline HIPAA Risk Assessments run remote. That stays the default. When a practice wants someone on the floor looking at doors, badges, clinics, and how the waiting room really works, we offer a Physical Security Walkthrough. You get observed physical-safeguard findings and a sit-down with the people who run the office. Not a questionnaire you fill out alone. Your IT contact or MSP still implements. We stay the third-party view. It is an add-on with the assessment, fixed fee, scoped on a short call.
How long does the whole thing take?
Two to four weeks from kickoff to delivered report for a typical single-site, remote engagement.
How much of our staff's time does it need?
Plan on about three to five hours total across interviews and document gathering, spread over the engagement.
Is this the same as a penetration test?
No. This is a Security Rule risk analysis of your safeguards and documentation. Technical testing can be scoped separately if you need it.
Three ways practices handle this
Your staff fill in the questionnaires. The practice owns the answers and whatever happens next.
You receive a document. It may not include a year-round cadence to keep the findings current.
Operator-led Security Rule assessment and a ranked remediation plan, then the Annual Program so it does not sit on a shelf. Led by Harborline senior practitioners.
Software can guide you through questions. It cannot take responsibility for the answers.
Quarter 1 of a year that is already planned
The assessment is Quarter 1 of the Annual Security Program, a fixed fee, scoped on a short call. It is one engagement for the year, not a report you decide whether to renew.
- What we map: Breach risk, compliance posture, privacy requirements, and practical impact. That becomes the work plan.
- How gaps close: Before Quarter 2 begins, we drive the urgent agreed gaps to closed: an owned work plan, worked with your IT team or MSP, with evidence verified as items land. Your IT team or MSP keeps running the technology. We own the program, the priorities, and the evidence verification.
- The rest of the year: Quarterly check-ins keep the plan current and you have a named Harborline advisor between milestones, so next year starts ahead instead of behind.
Scope your assessment
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.