Every practice that stores patient records electronically must complete a HIPAA security risk analysis. We run it for you, on site or remotely, and hand you a plain-language report, a prioritized action plan, and the documentation your compliance file needs.
The HIPAA Security Rule applies to every dental and medical practice that handles electronic protected health information (ePHI), whatever its size.
Every covered entity must conduct an accurate and thorough assessment of the risks to the confidentiality, integrity, and availability of the ePHI it holds, then implement measures to reduce those risks.
45 CFR § 164.308(a)(1)(ii)(A)–(B)After a ransomware attack or a complaint, the HHS Office for Civil Rights asks for your risk analysis. In four ransomware settlements announced in April 2026, OCR cited the same core problem: an inadequate risk analysis.
HHS OCR Risk Analysis InitiativeHHS has proposed a major update to the Security Rule: an asset inventory, multi-factor authentication, encryption, and yearly compliance reviews. The final rule is currently expected in 2027. We check you against it today.
HHS proposed rule, January 2025We sign a HIPAA Business Associate Agreement (BAA) before any work that could involve protected health information.
We learn how your practice works, how many locations and workstations you have, and who supports your IT.
Usually half a day, scheduled outside patient hours if you prefer. We review your office, network, and devices.
Controlled vulnerability scan and review of your findings against the HIPAA Security Rule.
You receive the risk analysis, the risk register, and a clear plan, and we walk through it together.
Starting prices for a typical small office. Your written quote sets the final price after the free call.
Yes. The HIPAA Security Rule requires every covered entity that handles electronic patient information, whatever its size, to conduct an accurate and thorough risk analysis and to act on its findings.
HIPAA requires you to review it periodically and whenever your environment changes, for example a new practice management system, a new location, or a security incident. Most practices update it every year.
The HHS Security Risk Assessment Tool is a helpful questionnaire, but it relies on your own answers. We verify your systems directly, scan your network, and turn the results into a documented, prioritized plan.
Yes. We sign a HIPAA Business Associate Agreement before any work that could involve protected health information.
No. The walkthrough can be scheduled outside patient hours, and our scans use controlled techniques designed not to interrupt your systems.
Yes. We check your practice against the current rule and flag what the proposed update would add, such as multi-factor authentication, encryption, and an asset inventory, so you can plan ahead.
This page is general information about regulatory requirements, not legal advice.