01 — INVENTORY
Where your patient data actually lives
A complete ePHI asset inventory: every system, software platform, and vendor that stores, sends, or can access patient data — including the ones nobody thinks about until something goes wrong.
HIPAA Risk Assessments
Your HIPAA risk analysis, done by an independent assessor — fixed fee, in about 30 days.
I assess vendor security programs for a living. I don’t sell IT, and I don’t grade my own homework.
Serving the Washington DC metro — small dental and medical practices across DC, the Maryland suburbs, and Northern Virginia. Work is mostly remote, with the final report written for the practice owner.
- ✓ Fixed fee, published below — no “call for a quote”
- ✓ BAA signed with every client
- ✓ Annual refresh available
The service
HIPAA Security Risk Assessment
HIPAA’s Security Rule — 45 CFR §164.308(a)(1) — requires every practice to have an accurate, thorough risk analysis on file. Most small practices have never had one done properly. This is that analysis, done independently and documented so you can hand it to an auditor, insurer, or lawyer.
02 — RISK REGISTER
Threats & vulnerabilities, rated
A threat and vulnerability review turned into a risk register with clear severity ratings, so you know what is urgent, what is important, and what can wait.
03 — ROADMAP
What to fix, in fix-first order
A prioritised remediation roadmap your IT provider can actually work from — sequenced by risk, not by what someone wants to sell you.
04 — POLICY GAPS + REPORT
Gap list & plain-English final report
A policy gap list measured against the HIPAA Security Rule, plus a management summary and final report in plain English — written for the owner, not for other consultants.
How it works — about 30 days, kickoff to final report
1
Kickoff call
Scope, staff count, systems in use, and what triggered the assessment.
2
Interviews & evidence
Mostly remote sessions with you and your team, plus evidence review.
3
Draft findings
You see the risk register and roadmap before anything is finalised.
4
Final report
Documented analysis you keep on file — ready for an auditor or insurer.
Engagement notes, stated plainly: a Business Associate Agreement (BAA) is signed with every practice. The work runs from interviews and evidence wherever possible, avoiding direct access to patient data. And there is no such thing as “HIPAA certified” — no certification exists for this work, and anyone selling you one is selling a badge, not a legal status.
Why small practices, why now
For dental & medical practices: one complaint is enough
In October 2026, one patient’s complaint about getting her records led federal regulators to investigate a solo Pennsylvania dental practice — it settled for $140,000. No hacker. No breach. One complaint was enough for the regulator to look.
$103,000
Risk-analysis settlement — Feb 2026. A treatment center settled after a phishing incident exposed patient data, because it had never conducted an accurate, thorough risk analysis. That failure — not the phishing itself — was the violation.
14+ actions
The Risk Analysis Initiative. The regulator (HHS Office for Civil Rights) launched a named enforcement initiative in late 2024 focused specifically on missing risk analyses. It has produced at least 14 enforcement actions — most against small practices — each with a settlement plus a 2-year corrective action plan.
Other risk-analysis settlements in the same initiative include $100,000 (solo gastroenterology practice), $25,000 (small neurology practice), and $10,000 (surgical group). The pattern is consistent: the practices hit hardest are the ones with no documented analysis at all.
Fixed pricing
HIPAA Risk Assessment — fixed fees
Almost nobody in this field publishes prices. These are the fees.
Solo / Small Practice
$1,995
1–3 staff. The right size for a solo dentist or single-provider office that has never had a formal assessment.
- ✓ Full risk analysis & register
- ✓ Remediation roadmap
- ✓ Final report + BAA
Multi-Provider Practice
$3,495
4–10 staff. For growing dental and medical practices with more systems, vendors, and locations to cover.
- ✓ Everything in Solo
- ✓ Full vendor & systems inventory
- ✓ Policy gap list vs. Security Rule
Larger Practice
Priced on intake
11–25 staff. Scoped on the intake call once systems and sites are known — you get an exact fixed number before any work starts.
- ✓ Same deliverables, larger scope
- ✓ Exact fee quoted up front
- ✓ Annual refresh available
“If another firm won’t publish a price, ask why. The assessment is a defined piece of work — it should have a defined price.”
HIPAA requires the analysis to stay current — an annual refresh is available for returning practices.
About
Independent assessors, not an IT company
We’re Certified Third-Party Risk Professionals (CTPRP), also holding CISM and CISSP certifications. We independently assess the security programs of organisations across multiple frameworks — HIPAA, SOC 2, ISO 27001, and NIST. Assessing how organisations actually handle sensitive data is what we do.
That independence is the point. When your IT company bundles a “free” HIPAA assessment, it is grading its own homework. We don’t sell IT services, we don’t sell software, and we have nothing to upsell you after the report. The assessment is the product.
Based in the Washington DC metro, serving dental and medical practices across DC, the Maryland suburbs, and Northern Virginia.
Book a 15-minute call
Tell us a little about your practice first, so the call is useful. For DC-metro dental & medical practices.
We reply within one business day to schedule your call. Please don’t include patient information in this form.
Privacy
Privacy Policy
Last updated: November 2026
What we collect
When you use the intake or booking form on this site, we collect the information you submit: your name, your practice name, your contact details, your practice size, when you last had a risk analysis, and anything you type in the message field.
How we use it
We use that information only to respond to your inquiry and to provide the assessment service — nothing else.
Sharing
We never sell your information. We do not share it with third parties except for the service providers needed to operate this site and our email — for example, our website host, email, and booking providers — and only as needed for them to provide those services.
Please do not send patient information through this form. Please do not send patient records or protected health information (PHI) through this form — the assessment process has a separate, secure way to exchange evidence.
Cookies and logs
We keep this minimal: this site uses basic hosting logs only, with no analytics cookies at launch. If analytics are added later, this policy will be updated.
Requesting deletion
To request deletion of information you submitted, contact us through the booking form on this page or by replying to any email we sent you, and we will delete it.