6:20 p.m., the closet behind reception: one router, one backup drive, and a box of nitrile gloves stacked on both.

What’s in it

The document 45 CFR §164.308(a)(1)(ii)(A) asks every covered practice to keep. Ours is written in sentences an office manager can read aloud to an auditor.

• An inventory of every device that touches patient data, including the fax and the label printer
• The physical side: closet lock, which monitors face the waiting room, where the shred bin lives
• User accounts in Dentrix, Eaglesoft, eClinicalWorks, or whatever you run, checked against who still works there
• Likelihood × impact ratings for each risk
• Signed, dated, formatted for the six-year retention file

Where it stops

• We note settings. We don’t change them — that’s line c.
• No phishing emails. Those are line b.
• We point out missing policies; we don’t write your policy manual.

Who needs to be there: whoever has the closet key, for the first 20 minutes.

What’s in it

Three emails written for a medical office, not a bank. They arrive on staggered days, at the times real ones do — mostly just before lunch.

• A supply-vendor invoice, an insurance-portal password reset, and a “voicemail from a patient” attachment
• We record who opened, who clicked, and who typed a password. The password itself is never stored.
• A one-page results sheet by role: front desk, clinical, billing
• A 15-minute debrief that ends before the first patient is seated

Where it stops

• Results by role, not by name, unless you ask for names in writing
• No text messages, no phone calls pretending to be the IT company
• Nothing is sent to patients, ever

Who needs to be there: nobody, which is the point. We need a list of staff email addresses.

What’s in it

This is the line where things actually change. Done alongside your IT person, or written up step by step so they can do it on their next visit.

• Firewall firmware updated; inbound rules cut to what you actually use
• Guest Wi‑Fi separated from the network the operatory PCs sit on
• Admin rights removed from the logins people use every day
• BitLocker or FileVault confirmed on every machine that leaves the building
• Screen lock at five minutes; old remote-access tools uninstalled; multi-factor on every email account

Where it stops

• We don’t sell or install hardware. If the firewall is past end-of-life, we write that down and quote nothing.
• No ongoing monitoring once the pass is done
• We don’t touch the imaging software’s vendor settings without the vendor on the phone

Who needs to be there: your IT person, in the room or reachable by phone that evening.

What’s in it

We come back about three months later and check the first ten findings against what changed. Then we reissue the report with a new date on the cover.

• Each of the top ten marked fixed, partly fixed, or still there
• A re-dated summary page for the retention file
• A paragraph you can paste into a cyber-insurance renewal form under “what have you done since”

Where it stops

• Only practices with a Cyvela report on file — we need our own baseline
• Findings 11 onward aren’t rechecked
• No new phishing round; book line b again if you want one

Who needs to be there: whoever fixed things, so they can show us.