A consultant's desk with a short printed report, a pencil and a closed laptop in morning light

About Kelp · Broadview Heights, OH

For clinics too small for a security department: a consultancy that writes short.

Kelp exists because the people running independent practices are asked to meet the same Security Rule as a hospital system, with an office manager and a free afternoon. We do the assessment, shorten the findings until they can be finished, and hand you a document that stands up to scrutiny.

Book the walk-through See the engagements

The reason we started

A sixty-page binder is not a plan.

The pattern was always the same. A small practice paid for a HIPAA risk analysis, received a thick PDF, held one good meeting, and by spring nothing on the page had changed. The binder went on a shelf next to the last one. Nobody had been negligent. The document was simply written for an auditor, not for the person who also orders the gloves.

So we turned the work around. Kelp starts in your building, at the front desk, in the closet where the router lives, and ends with a list short enough to finish. Each finding is ranked, given an owner in your office, an estimate, and a plain reason it matters. The formal report still exists, dated and signed, but it is the record of a plan, not a substitute for one.

Security advice that nobody acts on is just a more expensive way of feeling behind.

We are a small consultancy and we have chosen to stay one. The person who walks through your clinic is the person who scores the assessment and sits across from you at the roadmap session. That is the whole organisational chart you need to understand.

If your last risk analysis lives in a drawer, we should talk before the next one is due.

Open the conversation

Working principles

Four rules we hold ourselves to.

  1. Short beats thorough-looking

    If a finding cannot be explained in a paragraph to the person who will fix it, we have not understood it yet. We keep rewriting until it can.

  2. Assess what is actually there

    Policies are read, but the evidence is the machine on the desk. Where the binder and the building disagree, the building wins and we write down why.

  3. Patients first, schedule second

    We work before the first appointment or over lunch, and nobody touches a clinical workstation without your office manager beside them.

  4. Say the price before the work

    One number on the proposal, two invoices, and a conversation before anything is added. If the scope changes, you hear it from us first.

What arrives with us

The contents of a walk-through bag.

A security visit is quieter than people expect. This is what we carry through your door, and what you can have ready.

A one-page scope

Agreed in advance: which rooms, which systems, who we will want to talk to, and how long each stretch should take.

A blank inventory sheet

Every laptop, tablet, printer and outside vendor that touches patient data, filled in beside you. Likely the first time it has been in one place.

Your EHR login, not ours

You can have the vendor’s admin contact, the router password and the last backup date on hand. We never need a patient record to do the work.

Time with the office manager

The person who knows why the fax machine scans to email. We ask them more questions than anyone else, and it shows in the report.

Where we stand

What we do, and what we leave to others.

Ours

  • HIPAA Security Rule risk analysis, documented and signed.
  • Phishing baselines and live training sized for a clinic team.
  • Hands-on endpoint hardening on the devices in your building.
  • A ranked roadmap with an owner for every line.

Not ours

  • Legal advice. We work alongside your attorney on interpretation.
  • Monthly retainers or open-ended managed services.
  • Clinical software selection or EHR configuration.
  • Scare-driven sales. The findings are the findings, nothing more.

Send us the headcount and the EHR. We will send back a price and two dates.

Ask for the fixed price