Security Audit
Find out where you stand.
We check your computers, network, email, and cloud. You get a plain-English report, a fix list in priority order, and your HIPAA risk analysis documentation.
Three sizes
The size depends on your setup, not your specialty.
Foundations
Cloud-first office. 1 site, up to 10 computers, no servers.
Standard
Your own server on site. 1 to 2 sites, up to 25 computers.
Advanced
On-site plus cloud servers, or several locations. Up to 50 computers.
Not sure? Answer six questions and we will suggest one.
The details
What we check
| Area | What we look at | Tiers |
|---|---|---|
| Computers | Updates, encryption, antivirus, admin rights, screen lock | 1, 2, 3 |
| Microsoft 365 or Google | MFA, admin accounts, sharing, email security | 1, 2, 3 |
| Network and Wi-Fi | Firewall, open ports, guest Wi-Fi, remote access | 1, 2, 3 |
| Your EHR vendor | BAA on file, access, MFA, backups | 1, 2, 3 |
| Office and paperwork | Policies, training records, incident plan | 1, 2, 3 |
| Servers | Updates, backups, test restores, logging | 2, 3 |
| Cloud servers | Permissions, exposed storage, encryption | 3 |
What you receive
- A one-page summary with your overall risk rating
- Your top 5 risks, explained in business terms
- A fix list with an owner and target date for each item
- A 30, 60, and 90-day plan
- Your completed HHS Security Risk Assessment file
- A signed Certificate of Data Destruction
How you get your results
- In your own folder. The full report and risk analysis are saved to a folder in your SharePoint, OneDrive, or Google Drive. You own it and keep it.
- In person. We walk you through the findings and leave a printed one or two page summary.
- Never as an email attachment. We email only to say your report is ready in your folder.
HIPAA expects you to keep risk analysis records for six years. A folder you own makes that easy.
The five phases
Kickoff
About 1 hour. With the paperwork signed, we confirm your tier and dates.
Discovery
About 2 hours. We talk with you and start the HHS risk assessment on your computer.
Assessment
Half a day to 1.5 days on site, checking systems with read-only access.
Report
Findings in plain English, rated by risk, with a fix plan.
Walkthrough
We go through the report, remove our access, and delete our working files.
Do you fix the problems too?
Not by default. We find and explain, so we never grade our own work. We can quote fixes separately or refer you to a trusted IT partner.
Questions? Talk to us, or start with a free exposure check.