HIPAA compliance and
Google Workspace admin
for derm practices.
Continuous, hands-on protection, because compliance is an ongoing job, not a one-time setup.
We are your HIPAA compliance partner. We run your compliance program with you, from the risk assessment and policies to staff training and vendor agreements. We also run your Google Admin console every business day: new accounts and departures, groups, your email records, and the security settings that make your Google Workspace match your policies. Your IT company keeps helping your staff with their sign-ins, devices and apps. You make the decisions. We make sure nothing gets dropped.
Not ready to talk? Take the free HIPAA Checkup in six minutes.
What we do
The hard part of HIPAA isn’t knowing the requirements. It’s doing them, and then keeping (and proving) them done. That part is ours.
A risk assessment, and a plan
We start with a security risk assessment of your practice, then work through what it finds, in order, until it is done.
Your policies, written and signed
Drafted from what you already have, reviewed by our HIPAA Privacy and Security Officer before you see them, and signed off by your staff.
Compliance training, tracked
We track staff completion of the compliance trainings of your choice (including free resources), both on hire and every year.
Vendor agreements, chased and kept
Every outside company that handles patient information for you, with its business associate agreement requested, signed and reviewed.
Google Workspace, managed
All security settings, including whatever enterprise controls your edition affords, configured for HIPAA compliance according to your policies. The part compliance software can’t do for you.
Proof, in writing
A written report each month, a written review each quarter, and your records in your own Shared Drive, yours to keep. That includes your Google Workspace logs, which Google deletes after six months. We save them before Google deletes them, and put a copy in your Shared Drive every quarter.
How it works
The first month
We learn your practice
You send the documents you already have, and your practice manager spends 30 minutes with us. We sign our business associate agreement with you, run the risk assessment, and close the most urgent gaps first.
Across the year
We structure your compliance
Policies written and signed, staff trained, vendor agreements collected, and your Google Workspace set to match, in the order your risk assessment sets. Each decision comes with our recommendation and the reasoning already written. You agree, or tell us otherwise.
From then on
We keep it that way
- Your logs and alerts watched every business day, and admin requests handled
- Access removed the day someone leaves, and incidents answered within one business hour
- New staff given your policies and training, and new vendors their agreements
- A written report every month, an access review every quarter, and a meeting with your leadership every year
- Phishing tests, a backup restore test and a vulnerability review
- Your policies reviewed each year, then a new risk assessment, at half price while you subscribe
We see every item through, whoever has to act
Of the 27 safeguards in the HIPAA Security Rule, we handle 15 ourselves. For the other 12, your leadership decides or your team acts. We tell them exactly what is needed, follow up until it is done, and record that it happened.
15we do
5your leadership decides
7your team does, and we follow up
Free, and a good place to start
The HIPAA Checkup
A short checkup on what HIPAA actually asks of a dermatology practice on Google Workspace: 27 questions, one for each safeguard in the Security Rule, that show you where yours stands.
Who is in charge
1 of 27
Is someone officially named our “Security Official”, and do staff know who it is?
45 CFR 164.308(a)(2) · Standard
What we don’t do
We configure device policy. We do not support devices.
- Support devices. Computers, phones, printers and anything in front of the user stay with your IT company.
- Help your staff with sign-ins or apps. A forgotten password or a question about Gmail goes to your IT company, and we give them what they need to reset passwords.
- Decide whether an incident is a breach. That is your Privacy Officer’s call. We bring the logs and the facts.
- Make your practice’s decisions. BYOD, retention and the rest are your leadership’s call, with our recommendation in front of them.
Who is this for?
We help derm practices in the U.S. become and stay HIPAA compliant.
- On Google Workspace Business Plus or higher (or willing to upgrade). Why
- With an existing IT support function
Questions practices ask
All the questions →Who is responsible for our compliance?
Legally, your practice is, and that can’t be handed to anyone else. In practice, we carry most of the load, and your Security Official makes the decisions.
Do we still need our IT company?
Yes. We run your compliance program and your Google Admin console. Your IT company looks after your staff: their computers, phones, printers and sign-ins. We work alongside them.
What does it cost?
$997 a month for up to 50 Google Workspace seats, then $10 a month for each seat above 50. Setup is a one-time fee starting at $4,997, quoted once we have seen your setup.
The call is with me.
Twenty minutes to see whether we are a good fit for your practice, and to answer your questions. If we are not the right fit, I will tell you, and point you somewhere better if I can.
Sam Roberts, Founder