Services

Find out where you actually stand

Most practices are not starting from a clean site. There is a network that grew over time, equipment of unknown origin, and often a prior adviser who said a firewall and antivirus made the office compliant. Both are real controls. Neither is close to enough.

We examine the environment against the same structure the risk analysis will use, honestly and without blame. Often we find better technology than documentation — encryption or MFA already in place with nothing written down. We record what was done well alongside what is missing.

What we look at

• Workstations: encryption, local admin rights, patching, remote-access tools left behind
• Network: firewall, Wi-Fi, guest separation, remote access, who holds the admin passwords
• Accounts: Microsoft 365 or Google Workspace admins, EHR admins, shared logins, MFA coverage
• Prior administrator access: dashboards, registrar and DNS, cloud accounts and portals registered under someone else's email
• Vendors: who touches patient data and whether a business associate agreement is on file
• Paper and physical: the server closet, front-desk screens, fax output, disposal

The document everything else hangs from

The Security Rule requires an accurate and thorough assessment of risks to the confidentiality, integrity and availability of all electronic patient data — at rest and in transit, on every device, in every location, including what your vendors hold.

A vendor checklist, a scan report or a questionnaire from your EHR company is not a risk analysis. Those are inputs. A risk analysis says which threats could exploit which weaknesses to harm which assets, how likely and how serious that is, and what you will do about it.

Our method

We follow the process described in OCR guidance and NIST SP 800-66 Revision 2, using the free HHS Security Risk Assessment Tool where it fits:

• Define the scope: all patient data, all media, all locations
• Inventory assets and map how data flows between them
• Identify threats and vulnerabilities
• Assess the safeguards already in place
• Rate likelihood and impact to set a risk level
• Document results and a treatment decision for each risk
• Set the review schedule

We never backdate anything. A first risk analysis dated today, with an honest account of what it found, is stronger than a reconstructed history.

An architecture sized to a ten-person office

The common mistakes are enterprise gear nobody can administer, or consumer gear that cannot log what it sees. We design with proven open-source components on standardized business hardware, so the cost goes to what protects you rather than to licenses.

A typical design includes

• OPNsense firewalls, optionally as a high-availability pair, with intrusion detection, DNS filtering and outbound controls
• A physically separate guest Wi-Fi network for patients
• Secure remote access with multi-factor sign-in
• A Wazuh security monitoring server collecting logs from firewalls and workstations
• TrueNAS encrypted storage for logs, configurations and workstation images
• Long-term log retention in a locked, encrypted cloud archive in two regions
• Identical hardware with a cold spare, so a failure becomes a same-day restore

Budget ranges

Hardware for a practice of about ten people typically runs in the low thousands of dollars, with recurring infrastructure costs in the tens of dollars a month. A high-availability design costs more and removes more failure modes. We give you options and the trade-offs in writing.

Hardware estimates as of 2026; prices drift. Professional services are quoted separately after the evaluation.

Built, tested, documented, handed over

We build outside clinic hours, keep the old router configured and on the shelf, and only retire it after a full clinical day on the new network. Every configuration is recorded as it is made.

What we put in place

• Firewalls, DNS filtering, intrusion detection and secure remote access
• Security monitoring with a short list of alerts a person will actually read
• File integrity monitoring and vulnerability detection on workstations
• Six-year log retention, encrypted storage, backup and disaster recovery
• Workstation standard: full-disk encryption, no local admin, automatic lock
• Unique accounts and multi-factor sign-in for everyone; joiner, mover and leaver procedures
• Email authentication (SPF, DKIM, DMARC), phishing protection and secure patient email
• Physical safeguards: the server closet, screen placement, visitor log, device disposal
• A password manager with a documented break-glass procedure

Keep it running, keep it current

A monitoring system nobody reads is worse than none: it is evidence you were warned and did nothing. We run the operational calendar with your Security Official, or alongside a staff member who does the day-to-day work, so someone outside the office always knows your environment.

We also help when something changes: a new hire or departure, a new vendor, a new device, a move or a second location. And if an incident happens, we help you work out whether it is a reportable breach and document the decision.