Three plans, from your email records to your whole HIPAA program

Without DMARC, anyone can send email that looks like it came from your practice, to your patients, your staff or your bank. If patient records are ever stolen, the thieves can email each patient a ransom demand, pretending to be you.

List every service that sends email as you, from your DMARC reports and your records, and whether each one passes.

Correct SPF for each domain that sends email, within its limit of ten lookups.

Turn on Google’s DKIM, and publish the DKIM records your other senders give you.

Publish DMARC for each domain, asking for summary reports only, never copies of your messages.

Publish MTA-STS and TLS reporting, so other mail servers know to send to you encrypted.

Lock down the domains that never send email, so nobody can send as them.

Propose Gmail’s safety settings for attachments, links and spoofing, and turn them on once you agree.

Make sure Google’s business associate agreement is accepted for your Google Workspace. Your own super administrator accepts it, with us on the call, in about a minute.

Write down every record and setting as we set it, with the date.

Read your DMARC reports, and tell you when someone else is sending email as you.

Keep your records right when you start or stop using a service that sends email for you.

Propose each step of your DMARC policy, from none to quarantine to reject, once your real senders pass.

Check your email records, and tell you within one business day if one changes or stops working.

Watch your domain’s registration and your website’s security certificate, and tell you before either runs out. Renewing them stays with whoever holds them, usually your IT company or web host.

A short email by the 25th to the owner and the practice manager: who sent email as you, what passed and failed, where each domain’s DMARC policy stands, and what we changed.

Google Workspace, on any edition.

A login of our own to your DNS host, where it allows one. Where it doesn’t, your IT company makes the changes we send.

An administrator role in Google Workspace with the Gmail settings privilege, nothing broader, on an account of our own that takes no paid license. We don’t need, and won’t ask for, a super administrator. Your own super administrator generates Google’s DKIM key and accepts Google’s business associate agreement, which takes a few minutes.

It isn’t a HIPAA compliance program, and it doesn’t cover the rest of your Google Workspace. Help for your staff with sign-ins, devices and apps stays with your IT company.

$197 a month, one price that includes every domain on your order. No setup fee: the first month is paid at signing. A twelve-month first term, then month to month. Our business associate agreement, signed.

Workspace Security adds your whole Admin console run every business day: on/offboarding the same day, your settings kept to a written standard, incidents handled within an hour, your logs saved, and an access review every quarter. From $497 a month. See Workspace Security

HIPAA Compliance adds your whole HIPAA program run with you: the risk assessment, the full set of policies, vendor agreements, phishing tests, the evidence pack, and a written review every quarter. From $997 a month. See HIPAA Compliance

Moving up ends Email Security with no fee, even inside its first twelve months. Compare the plans

Many of Google Workspace’s security settings stay off until someone turns them on, and knowing which ones matter is a job of its own. There are also daily operations that require timely updates, including the removal of access when people leave. Unwatched and unmanaged, Google settings tend to drift. Google deletes your logs after six months. And Google’s security alerts are often sent to an inbox that nobody reads. Most practices have no one on staff who is responsible for watching any of it.

A few minutes of questions each week, one short section at a time, on how your practice works. Your answers decide the settings that are yours to choose, such as retention, phones and sharing outside the practice. We recommend, and then you decide.

Your settings brought to our written standard for Google Workspace, and to your own policies where you have them.

Extra administrators removed, and shared logins replaced with named accounts.

Your IT company given Google’s Help Desk Admin role, so it can reset staff passwords. As a best practice, you always keep a super administrator of your own.

2-Step Verification enforced, with any exceptions documented.

Drive sharing settings and defaults, and where your edition has them, session length, automatic logoff, data loss prevention and Context-Aware Access.

Phone policies: a passcode, blocking a device, removing your account from a lost phone, and no offline Drive files on phones.

Every outside app holding access to your Google Workspace, listed.

A map of each role’s access, so every later access review has something to check against.

A one-page runbook, so your own administrator can lock an account after hours in about a minute.

Your starting point measured, so you can see what changed.

Your Admin console run by us: on/offboarding within Google Workspace, and the changes your practice manager, owner or IT lead asks for.

Access removed the same business day someone leaves, or within one business hour when it’s urgent: signed out, app access revoked, the account suspended and its files handed over, with a written record.

Google’s security alerts read as they arrive, each explained in plain words: what happened, who it involved, whether it matters, and what to do. You hear from us when something needs you.

The day’s activity reviewed: sign-ins, admin changes, new accounts and apps. Anything unusual, such as 2-Step Verification turned off or a new administrator, is checked by us.

Files shared outside the practice listed from Google’s own logs, and sharing removed where it shouldn’t be.

An incident handled within one business hour: the account suspended, sessions and app access revoked, the logs preserved, and a report of what was accessed.

Your logs saved before Google deletes them after six months.

Every month: your report, in the body of an email to the owner and the practice manager: the month’s activity in plain words, what we did, and what’s next.

Every quarter: a documented access review against the role map.

Every year: a review of connected apps, admin roles and sharing, with a plan to fix what it finds.

Google Workspace, on any edition. Some settings need a higher one: session length and Google Vault retention come with Business Plus, and DLP (data loss prevention) rules that stop patient information leaving by email or Drive come with Enterprise. On Starter or Standard we tell you in writing which settings your edition doesn’t have.

An IT company, for your staff’s sign-ins, devices and apps.

Already have a compliance company? Keep it. We’ll run your Google Workspace to the policies it wrote.

It isn’t a HIPAA compliance program. We configure device policy; we don’t support devices. Help for your staff with sign-ins, devices and apps stays with your IT company.

$497 a month for up to 50 Google Workspace users, then $5 for each user above 50. Setup from $1,997, quoted on the call and paid at signing. A twelve-month first term, then month to month. Our business associate agreement, signed.

HIPAA Compliance adds your whole HIPAA program run with you: the risk assessment, the full set of policies, vendor agreements, phishing tests, the evidence pack in your own Shared Drive, and a written review every quarter. It needs Google Workspace Business Plus or above. From $997 a month. See HIPAA Compliance

Moving up ends Workspace Security with no fee, even inside its first twelve months. Compare the plans

We learn your practice. You send the documents you already have, and your practice manager spends 30 minutes with us.

Our business associate agreement with you, signed first.

A security risk assessment, and from it, your plan.

The most urgent gaps closed first, such as two-step verification for everyone, administrators who don’t need to be, and shared logins like frontdesk@ replaced with individual accounts.

Your evidence pack, started in your own Shared Drive on day one. It holds the proof an auditor or insurer asks for: your risk assessment, every policy with who signed it and when, staff training records, your vendor agreements, every access review and log review, a copy of your Google Workspace logs every quarter, your incident log (even when it’s empty), backup restore tests, and your setup and every change we make to it.

You always keep at least one administrator account of your own. We never hold the only keys.

Your policies. Drafted from what you already have, reviewed by our HIPAA Privacy and Security Officer before you see them, approved by you, and signed off by your staff.

Vendor agreements. Every outside company that handles patient information for you, with its business associate agreement requested, signed and reviewed.

Compliance training, tracked. You choose the courses, including free ones. We send your staff the links and record when each person completes them, on hire and every year.

Google Workspace, managed. All security settings, including whatever enterprise controls your edition affords, configured for HIPAA compliance according to your policies: two-step verification, session length and automatic logoff, sharing in Drive, and retention in Google Vault, with six years as the floor for your compliance documentation.

Email security. A full DNS review and fixes, with SPF, DKIM and DMARC taken to enforcement, plus MTA-STS. This is what stops someone sending email that looks like it came from you.

Devices, by policy. We shrink what reaches a phone or laptop rather than manage it: your EHR in a browser rather than an app, session limits, no offline Drive on phones, a passcode, blocking any device that shouldn’t reach your practice’s data, and the ability to wipe your practice account from a lost phone. You also get a signed BYOD policy with its written reasoning.

Your incident process. A written process and a register your Privacy Officer owns, plus a one-page after-hours guide for suspending an account.

The rest of your records. A map of which roles get which access, a record of where things started, a security posture report, and help with your cyber-insurance questionnaire.

Watching your logs and alerts, every business day.

Your Google Admin console, run for you: groups, settings, and any change your practice manager, your owner, or an IT lead they choose asks for.

DNS and email authentication changes.

Checking access: former employees who still have it, shared accounts nobody owns, and administrators who don’t need to be.

When someone joins, we create their account with the access their role needs.

When someone leaves, their access is removed the same business day, or within one business hour if the departure is for cause.

A security incident. Within one business hour we suspend the account, cut off its sessions, preserve the logs, and report what was actually accessed. Your Privacy Officer decides whether it is a breach and who must be told.

Alerts only when something needs you, saying what we already did about it. No alert means nothing needs you.

A written report to both the owner and the practice manager, in the body of the email: how many safeguards are in place, where your policies stand, what is next with an owner and a date on each, and what we did, with the evidence.

A check for new third-party apps connected to your Google Workspace.

Reminders for the checks your IT company performs, such as disk encryption still being on, and a record of whether they happened.

A written quarterly review for your practice manager and owner: what changed, what is open and who owns it, and what needs deciding, with our recommendation. Any quarter you would like to go through it together, we will meet with your leadership.

A formal access review, with its findings and actions written down.

A copy of your Google Workspace logs in your Shared Drive, saved before Google deletes them at six months.

A reminder to review your EHR’s access report, and a record of whether it was done. Your practice manager runs the report; we never go into your EHR.

Your evidence pack checked complete, so it is never more than 90 days from ready for an auditor.

A phishing simulation, with the results to your leadership. Follow-up training sits with your IT company or HR.

A review meeting with your leadership, owner included, alongside the policy review: the year’s work, and the decisions for the year ahead.

A review of all your policies, and everyone signs off again.

This year’s compliance training, tracked for everyone.

A documented test that your backups can actually be restored.

A Google Workspace vulnerability review, with a plan to fix what it finds.

A check that no business associate agreement has expired.

The security risk assessment is separate. The first one is part of setup, and each yearly renewal is its own line, at half price while you subscribe.