Security assessments for practices with 2–40 staff
6:42 p.m. the last patient is gone, and the wi‑fi password is still taped to the fax.
Cyvela walks your practice after hours, sends your staff three fake emails, tightens the firewall, and hands you a remediation report ranked by what to fix first. The fee is written down before we arrive. The full assessment runs ten business days, walk-through to readout.
Engagements from $540. The scoping call costs nothing and takes 25 minutes.
What we check for, among other things
The paperwork, specifically
one line of federal law, and the document it asks you to keep
Left margin
fixed fee, in writing, first
After a 25-minute call we email one number. It covers the walk-through, the phishing week, the hardening pass, and the report. It does not grow if the server closet turns out to be a bathroom.
§164.308
45 CFR §164.308(a)(1)(ii)(A) asks every covered practice to conduct an accurate and thorough assessment of the potential risks and vulnerabilities
to electronic patient data. A Cyvela risk analysis is that assessment — dated, signed, and filed where you can find it during an audit.
Right margin
ranked for monday morning
Findings arrive numbered in the order we’d fix them, each with the fix, a rough cost, and whether your IT person, your office manager, or nobody at all needs to do it.
Who we work with
practices where the office manager also keeps every password
“We have antivirus. And the IT guy comes in on Thursdays.”
Independent practices of 2 to 40 staff, in and around Decatur, TN. One location or three. One server closet, or a server under the reception desk next to the label printer.
- Family medicine
- Pediatrics
- General dentistry
- Orthodontics
- Oral surgery
- Physical therapy
- Optometry
- Behavioral health
The terms we work under
we don’t resell firewalls. we don’t take a cut of the software we recommend. we write down what we found, what it costs to fix, and which one to fix first.
- One assessor walks your office and writes your report. The same one.
- We bring our own laptop. It never touches your patient database.
- Phishing results reported by role, not by name, unless you ask for names.
- The fee is agreed in writing before anyone parks outside.
From the first call to the binder
what the ten business days actually look like
Nothing on your network changes while a patient is in the chair. The walk-through starts after your last appointment, and the hardening happens with your IT person in the room or in writing for them.
-
Day 0 · 25 minutes · phone
the scoping call
We ask how many workstations you have, which practice software you run — Dentrix, Eaglesoft, athenahealth, eClinicalWorks — and who knows the router password. You get a written fixed fee the same day.
-
Day 1 · after 6:15 p.m. · on site
the after-hours walk-through
Two to three hours in your empty office. Every workstation, the server closet, the Wi‑Fi, the fax, the printer that emails scans, and wherever the backup drive currently lives.
-
Days 2–6 · five business days
phishing week
Three simulated emails: an invoice from a supply vendor, an insurance-portal password reset, and a “voicemail from a patient” attachment. We record who opened, clicked, and typed. Nobody gets called out at the morning huddle.
-
Days 3–7 · remote and on site
the hardening pass
Firewall rules, admin rights off daily logins, disk encryption confirmed, screen lock at five minutes, multi-factor on email. Changed alongside your IT person, or documented so they can change it on Thursday.
-
Day 10 · 60 minutes
report and readout
The remediation report lands, ranked. We walk the office manager and the lead doctor through it at your office or on a call — whichever comes with fewer interruptions.
Billed per engagement
five line items, each priced before we park outside
Every number below is the whole number. Open a line to see exactly what it covers and where it stops.
The document 45 CFR §164.308 asks for. Covers up to 10 workstations; $95 for each one after that.
- An inventory of every device that touches patient data, including the fax
- Threats and vulnerabilities mapped to the administrative, physical, and technical safeguards
- Likelihood × impact ratings for each risk, in plain sentences
- Signed and dated, formatted for the six-year retention file
Up to 25 staff; $18 per person after that. Written for a medical office, not a bank.
- Three emails over five business days: vendor invoice, insurance-portal reset, patient voicemail
- A one-page results sheet by role — front desk, clinical, billing
- A 15-minute debrief, delivered at your morning huddle
One firewall and up to 15 endpoints. Additional endpoints $64 each.
- Admin rights removed from the logins people use every day
- BitLocker or FileVault confirmed on every machine that leaves the building
- Screen lock at five minutes; unused ports and old remote-access tools closed
- Multi-factor authentication turned on for every email account
a, b, and c as one ten-day engagement, plus the ranked remediation report and a 60-minute readout. Booked separately those three come to $4,805, so this is $845 less.
- Everything listed under a, b, and c
- The remediation report as a PDF and one printed, tabbed binder
- A technical appendix your IT person can work from directly
We come back about three months later, check your top ten findings against what changed, and reissue the report with a new date. Useful when your cyber-insurance renewal form asks what you’ve done since.
On-site visits anywhere within 90 miles of Decatur, TN carry no travel charge. Farther than that, mileage is quoted on the scoping call.
Invoiced after the readout, net 30. Visa, Mastercard, Amex, ACH, or a check.
The deliverable
what lands on your desk on day ten
A report you can hand to an auditor, an insurer, or your IT person, and each of them finds the page they need.
Tab 01 of the binder
the remediation report
A PDF and one printed binder. The tabs are numbered, naturally.
- i.A signed HIPAA risk analysis, dated, for the six-year file
- ii.Every finding ranked, with the fix, a rough cost, and an owner
- iii.Phishing results by role, with all three emails reproduced
- iv.A technical appendix written for whoever comes in on Thursdays
6:47 p.m. · walk-through
Asked on the scoping call
questions office managers ask before saying yes
- We already have an IT company. Do we need this?
- Usually. Your IT company sets things up; HIPAA expects someone to assess whether that setup protects patient data. We work alongside them and send them the technical appendix.
- Will anything go down during patient hours?
- No. The walk-through starts after your last appointment and no setting changes while a patient is in the chair. The phishing emails do arrive during the day — that’s the point of them.
- Is the fee really fixed?
- Yes. It’s quoted in writing from your workstation count. If we find more machines than you mentioned, the first five extra are on us.
- What if we can’t afford to fix everything?
- That’s what the ranking is for. Fix items 1 through 5 first. Several of those tend to cost an afternoon and nothing else.
Next step
the scoping call is 25 minutes and costs nothing
Have your workstation count and the name of your practice software nearby. You get a written fixed fee the same day if you call before 3 p.m.; the next morning if after.
- Mon–Fri
- 8:30am–7pm
- Sat–Sun
- Closed. Walk-throughs are booked on weekday evenings.
Accepted, invoiced after the readout