Pick the piece you need now. Every engagement is scoped in writing before it starts.
We look at doors, badges, clinics, and how the waiting room really works. You get observed physical-safeguard findings and a sit-down with the people who run the office. Your IT contact or MSP still implements. Remote remains the default for the HIPAA Risk Assessment.
A facilitated exercise for your leadership and clinical operations teams, built on a scenario that fits your organization. Includes the scenario design, the session, and a written after-action report with assigned follow-ups.
A focused review of the controls that decide whether a ransomware event is a bad week or an existential one: backups, recovery testing, segmentation, privileged access, and detection coverage.
For healthcare vendors whose customers now require a report. We map your current state to the trust services criteria, write what is missing, and get you audit ready without inventing bureaucracy.
Management system design, statement of applicability, risk treatment, and internal audit preparation for organizations whose international customers expect the certification.
Senior security leadership on a monthly basis: program ownership, vendor and customer security reviews, roadmap and budget, and reporting to your board or leadership team.
Every engagement is scoped on a short call and quoted in writing before work starts.
Most organizations begin with the flat-fee risk assessment, then roll into the annual program.
If you're starting with a risk assessment, see HIPAA risk assessment cost and what changes it.
Yes. Most clients start with the HIPAA Risk Assessment and add a Physical Security Walkthrough, tabletop, or fractional CISO support once the priorities are clear.
It is an add-on with the assessment, fixed fee, scoped on a short call. It is separate from additional assessment-site pricing, which adds travel at cost for on-site. Remote remains the default for the HIPAA Risk Assessment.
No. We do not do hands-on engineering, managed security, or MSP work. Before Quarter 2 begins, we drive the urgent agreed gaps to closed: an owned work plan, worked with your IT team or MSP, with evidence verified as items land. They keep running the technology. We own the program, the priorities, and the verification.
No free assessments. Every engagement starts with a free 30-minute scoping call so we can confirm fit and scope together. The HIPAA Security Rule risk assessment itself is a fixed fee, scoped on a short call because it includes interviews, analysis, and a written plan. If you need the assessment, we do that work as paid delivery, not as a free preview.
Hours per month, number of customer security reviews, and whether you need board-level reporting. We set the tier on the scoping call and revisit it annually.
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.