HIPAA compliance is an ongoing job,
not a one-time setup.

DermHIPAA: HIPAA compliance for derm practices on Google Workspace. Continuous, hands-off protection.

HIPAA requires someone to regularly review your system activity, keep access current as staff come and go, and keep your written policies true in the tools your practice uses. Google Workspace and email security require an administrator. At most dermatology practices, nobody is doing this work. That's what we do.

Start with the free HIPAA Checkup

A short course on what HIPAA actually asks of a dermatology practice running on Google Workspace, and then 27 questions, one for each safeguard in the HIPAA Security Rule. You score yourself. At the end you know how many are in place and who would have to close each one that isn't.

No charge, no sales call, and we never see your answers unless you ask us to email you the results.

Take the HIPAA Checkup Check your email security

What we actually do

Three things, run continuously, for one predictable monthly price.

Google Workspace administration

Your environment configured to a written standard that matches your policies, and kept there as Google, your staff and your vendors change. Access that follows employment. Two-step verification enforced, not merely offered.

DNS and email security

SPF, DKIM and DMARC brought to enforcement at the pace your vendors' reports allow, so nothing you rely on stops sending, then monitored so nobody can send email as your practice.

Your HIPAA program, run

Policies built from our dermatology templates with your decisions filled in, training, an annual security risk assessment, and vendor agreement tracking, all documented in one system of record you own.

Evidence every month

Shared files reviewed, accounts reviewed, third-party app access reviewed, alerts reviewed, what we changed, and every remaining item with the name of whoever owns it. Ready to hand to an insurer or an auditor.

What we don't do

Desktops, laptops, printers, Wi-Fi, your EHR, password managers, spreadsheet help, or any other user-facing support. Your IT company keeps doing all of that, and we put the boundary in the contract so nobody has to guess. Our work is the admin console, your DNS, and your compliance program.

Who this is for

Dermatology practices already on Google Workspace, Business Plus or higher, that already have IT support, run standard practice software, and are willing to work from our policy templates. If that isn't you, we'll say so on the first call and tell you who to talk to instead.

Talk to us

We're taking on a small number of practices to start, so that every one of them gets the attention this work needs. If you'd like to be one of them, write to sam.roberts@dermhipaa.com and tell us a little about your practice.

There is no such thing as HIPAA certification, and no one, including us, can certify your practice as HIPAA compliant. The Department of Health and Human Services does not certify, endorse or approve anyone. What we do is bring your environment and your program to a written standard and keep them there, with evidence you can show.