FAQ

HIPAA Security updates are expected in 2026. Starting now helps ensure your security foundation is already in place when those changes take effect. We include a one-time documentation update at no additional cost if the rule is finalized. Learn More

Our service is designed to provide an efficient, structured approach for solo and group practices. To keep the service simple and affordable, it is not intended for every scenario.

This service may not be the best fit for:

• Practices with complex technical environments or compliance requirements (for example: multiple staff members, many devices, servers, or specialized systems) 

• Practices seeking hands-on implementation or direct management of systems and security controls

• Practices that prefer call-based or real-time support rather than email/text communication

Even as a small practice, you are required to perform a risk assessment, implement safeguards, and maintain documentation under the HIPAA Security Rule.

In many cases, audits and enforcement actions are triggered by data breaches or complaints. Lack of proper risk assessment, safeguards, and documentation can significantly increase the risk of heavy penalties.  

Most providers are not missing this because it’s difficult to interpret and implement correctly. This service helps you handle those requirements in a structured, practical way.

No. We never require direct access to your systems or patient information. Our service is designed so you remain fully in control of your practice systems while we provide structured documentation and implementation guidance. 

Because we do not access or manage your systems directly, we do not operate as a Business Associate under a BAA agreement. 

No security or compliance approach can guarantee complete protection or regulatory outcomes.

Our service provides structured documentation and practical guidance aligned with the HIPAA Security Rule, while you remain in control of implementation and ongoing maintenance within your practice. When properly implemented and maintained, this approach can significantly reduce risk and help support a defensible compliance position.

Our documentation is mapped to the HIPAA Security Rule (45 CFR § 164 Subpart C) to support alignment. The documentation is designed to address all core HIPAA security rule components. A detailed crosswalk is available upon request.

No process is completely error-proof, especially when it depends on inputs about your day-to-day workflows. The primary risk is incomplete or inaccurate representation of your actual workflows, particularly for uncommon scenarios.

We reduce this risk through a structured, multi-layered approach:

• Focused Questionnaire: Designed to establish a baseline of standard workflows across a typical solo practice

• Assumption Check: As part of the questionnaire, you review and confirm a short list of key assumptions one by one

• Clarification Follow-Up: When responses appear unclear, inconsistent, or suggest potential edge cases, we may follow up with additional questions

• Documentation Review: You receive all prepared documentation and can request corrections before finalization

This approach keeps the process simple while providing a strong, defensible foundation. Final accuracy depends on the completeness and accuracy of the information provided.

Our service includes a structured risk assessment, documentation, and guidance based on your responses. You are responsible for implementing and maintaining any recommended safeguards, policies, and procedures. We provide clear safeguard guidance to help you do so.

You can click here review the full agreement.

You may request a full refund at any point before documentation preparation begins. If work has already started, we can provide a partial refund based on the work completed. After your drafted documentation is delivered, you may request reasonable corrections within 30 days at no additional cost. 

I'm a Software Quality engineer with a Master’s degree in Computer Science working in the medical device industry. Part of my work focuses on performing software and cybersecurity risk management and developing related procedures under FDA guidance and standards like IEC 62304 and ISO 14971.

My background includes hands-on experience with cybersecurity concepts through formal coursework and practical exercises, but more importantly, I work in a regulated environment where security risks must be systematically identified, documented, and mitigated. I apply that same structured, risk-based approach to help practices implement practical, HIPAA-aligned safeguards. 

Most solo practices are simpler because one person manages most systems, devices, and workflows directly.

Group practices introduce additional complexity around multiple users, authorization roles, shared systems, staff access, onboarding/offboarding, workforce training, and maintaining consistent security practices across the organization. For group practices, there is typically one primary practice contact who coordinates the process and helps provide information about workflows, systems, devices, and staff access. Depending on the practice, this may be the owner, office manager, operations lead, or the person most familiar with the practice’s technical setup. 

Our approach is designed to remain practical for practices while accounting for these additional considerations.