Industries · Medical and dental groups · Security edition
Patient data across locations, vendors and devices. Protected and provable.
A practice network holds protected health information in clinical systems, imaging and connected devices, billing and scheduling vendors, and the laptops of a distributed workforce. One breach is a regulatory event, a reputational event and a continuity event at once. We bring assurance, vendor oversight, HIPAA readiness and incident preparation to the whole network.
At stake
What can go wrong.
- A HIPAA risk analysis that has never been performed to the standard an investigator expects.
- Billing, scheduling and telehealth vendors with business associate agreements missing or outdated.
- Connected clinical and imaging devices on the same network as the front desk.
- A ransomware event that closes locations and triggers breach notification on a clock.
- Staff using AI tools with patient information and no policy.
What we do
The capabilities applied.
- HIPAA readiness the risk analysis and safeguards investigators ask for first
- Vendor data agreements and transfer review every vendor under agreement
- Network segmentation clinical devices contained
- Ransomware readiness review the scenario most likely to close a location
- Breach escalation procedures notification on the clock, rehearsed
- Acceptable-use and supervision policy AI use rules staff can follow
Evidence
What you can show.
- Documented HIPAA risk analysis and risk management plan.
- Vendor register with agreement status for every business associate.
- Segmentation and access evidence for clinical and administrative networks.
- Incident and breach procedures with exercise records.
- Authority plan for a regional group with 10 to 30 locations.
- Dominance plan where ad spend exceeds $100,000 a month.
- Foundation plan for a single specialist practice with a strong clinical reputation and a weak website.
Questions
Asked before engaging.
Do you handle breach notification?|We prepare the procedure and support execution with counsel. Determinations and notices are legal decisions made with counsel.
undefined
Can this be done across many locations without disrupting care?|Yes. Work is sequenced by location and risk, with clinical operations protected.
undefined
What about our managed IT provider?|The review includes what they operate and what evidence they can produce. Often the gaps are in the agreement, not the technology.
undefined
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days