Security for independent clinics · Broadview Heights, OH

For independent clinics: a HIPAA risk review you can finish.

Eight to twenty people, one EHR, and a front-desk computer everybody shares. That is the real shape of a small practice, and we assess it as it stands: on site, in person, ending in a remediation roadmap and a report built to be put in front of an auditor.

Book the assessment Call (440) 829-5727

One fixed fee, billed by invoice. Assessments start at $3,150.

A sunlit, symmetrical clinic reception with a pale oak desk and a single monitor

Who we work for

Five chairs, two doctors, one office manager who is also IT.

Large health systems have a security department. You have a Tuesday. These are two versions of the same Monday morning at the same front desk.

Monday, 8:05 a.m. — before

The shared front-desk login

  • One password, taped beneath the keyboard, used by everyone who sits at reception.
  • A risk analysis last touched when the EHR was installed.
  • A “fax delivered” email that looks right, and nobody is sure whether to click.
  • A backup drive in a drawer, whose last restore test was never.

Monday, 8:05 a.m. — after

The same desk, on a roadmap

  • A named login for each person, with a second factor on anything that touches patient records.
  • A dated, signed risk analysis and a ranked list of what is being fixed, by whom, by when.
  • A habit of reporting odd email in one click, rehearsed on simulated phish before the real ones arrive.
  • Encrypted laptops, patched workstations, and a backup restore someone has actually watched work.

Dental/Primary care/Physical therapy/Behavioral health/Optometry/Dermatology/Chiropractic

An overdue risk analysis is a finding waiting for an auditor to write it.

Put a date on it
A long, symmetrical clinic corridor with repeating arches and daylight on the floor

Straight answers

Before you sign

What does the fixed fee actually cover?

The on-site walk-through, the asset inventory, the assessment itself, the ranked remediation roadmap and the compliance-ready report. One number on the proposal, invoiced half at kickoff and half at delivery. If scope grows, we say so before the work, not after.

Will you disrupt patient care?

We schedule around your book. On-site work happens before the first patient or over lunch, and we never touch a clinical workstation without your office manager standing beside us.

We’re only eleven people. Does HIPAA really apply?

Yes. The Security Rule applies to covered entities of every size, and it asks for a documented risk analysis, not a large budget. Small is simply the reason ours is short.

How long until we have the report?

Roughly two to three weeks from the walk-through for a practice up to thirty staff. The roadmap arrives first, in a working session, so you can start on the urgent items before the formal report is signed.

Is this legal advice?

No. We are security consultants: we assess, document and fix technical and procedural gaps. For legal interpretation we work alongside your attorney.

What we do

Three jobs, two deliverables.

An arched doorway looking into a calm, daylit exam room
On site, in your rooms

HIPAA security risk assessment

The Security Rule, read against your actual office. Administrative, physical and technical safeguards, scored against what we see rather than what a policy binder claims.

Phishing resilience

A baseline simulated phish, a 40-minute session in your break room, and two follow-up simulations. Built for people who answer phones all day, not for a security team.

Endpoint hardening

Disk encryption, patch cadence, screen locks and MFA, set up on the machines in your building.

Short lists get finished.

Remediation roadmap

Every finding ranked: this month, this quarter, this year. Each with an owner, an estimate and the reason it matters.

Compliance-ready report

A dated, signed document written to be handed to an auditor, a cyber insurer, or a buyer doing diligence on your practice.

A note on how we work

From first call to signed report

Most security work for small practices fails the same way: a sixty-page document, a good meeting, and nothing changed by spring. We write short. Every finding is ranked, named, and given an owner in your office, even when the owner is you.
— The Kelp team, Broadview Heights

  1. The walk-through

    One morning in your clinic: front desk, exam rooms, the closet where the router lives. We watch how work really moves, then ask about the parts that happen off the screen.

    Week 1

  2. The inventory

    Every laptop, tablet, printer, EHR connection and outside vendor that touches patient data, written down in one place for what may be the first time.

    Week 1–2

  3. The assessment

    Each safeguard scored against the evidence, with photographs, screenshots and the names of the people who told us how it works.

    Week 2

  4. The roadmap session

    A working hour with the practice owner and office manager. We sort what to fix this month from what can wait a year, and agree who owns each item.

    Week 2–3

  5. The signed report

    A dated, compliance-ready document you can file, show an insurer, or hand to an auditor. The second invoice follows its delivery.

    Week 3

Your next audit should not be the first time anyone reads your risk analysis.

Ask for a scope and a price

Engagements & fixed fees

Priced like a project, not a retainer.

A tidy front-desk workstation in morning light

Engagement 01

HIPAA security risk assessment

The foundation. A full, documented analysis of how electronic patient information is created, stored and moved in your practice, ending in the two things you need: a ranked roadmap and a report.

  • On-site walk-through and asset inventory
  • Safeguard-by-safeguard scoring
  • Roadmap session, then a signed report

From $3,150Up to 12 staff · $4,640 for 13–30

Request this assessment
A clinic break room with a long table, ready for a training session

Engagement 02

Phishing-resilience training

Training that fits a clinic day. We start with a quiet baseline, teach over a lunch hour, then test again, so you can see the change in your own team rather than take our word for it.

  • Baseline simulated phish before anyone is told
  • One 40-minute live session in your break room
  • Two follow-up simulations over 90 days

$1,240Up to 25 staff · fixed

Schedule the session
A tidy network cabinet in a clinic utility room, cables neatly bundled

Engagement 03

Endpoint hardening project

The fixes from your roadmap that live on devices, done for you over a scheduled week: the machines at the desk, in the exam rooms and in the doctors’ bags brought to a consistent, defensible baseline.

  • Full-disk encryption and screen-lock policy
  • Patch cadence, MFA and endpoint protection set up
  • Documented baseline for every device

From $2,460Up to 15 devices · fixed

Scope my devices

The full cycle: assessment, training and hardening scheduled as one engagement. $6,380 instead of $6,850 when booked together, with two invoices all the same.

Book the full cycle

Next step

Bring us the front desk.

Tell us how many staff, which EHR, and where the router lives. We reply with a fixed price and two possible walk-through dates, usually within a working day.

Book the walk-through Email us
Password on a sticky noteFront-desk PC left unlockedOne login for the whole officeLaptop with no disk encryptionFax machine that scans to email
Backups in a supply-closet drawerGuest Wi-Fi beside the EHRA former employee’s account, still activeRouter on its factory passwordExam-room tablet with no screen lock

What we look for in the first hour of a walk-through. You may find yours here already.