A long list of what we do, and a short one for you.

We learn your practice. You send the documents you already have, and your practice manager spends 30 minutes with us.

Our business associate agreement with you, signed first.

A security risk assessment, and from it, your plan.

The most urgent gaps closed first, such as two-step verification for everyone, administrators who don’t need to be, and shared logins like frontdesk@ replaced with individual accounts.

Your evidence pack, started in your own Shared Drive on day one. It holds the proof an auditor or insurer asks for: your risk assessment, every policy with who signed it and when, staff training records, your vendor agreements, every access review and log review, a copy of your Google Workspace logs every quarter, your incident log (even when it’s empty), backup restore tests, and your setup and every change we make to it.

You always keep at least one administrator account of your own. We never hold the only keys.

Your policies. Drafted from what you already have, reviewed by our HIPAA Privacy and Security Officer before you see them, approved by you, and signed off by your staff.

Vendor agreements. Every outside company that handles patient information for you, with its business associate agreement requested, signed and reviewed.

Compliance training, tracked. You choose the courses, including free ones. We send your staff the links and record when each person completes them, on hire and every year.

Google Workspace, managed. All security settings, including whatever enterprise controls your edition affords, configured for HIPAA compliance according to your policies: two-step verification, session length and automatic logoff, sharing in Drive, and retention in Google Vault, with six years as the floor for your compliance documentation.

Email security. A full DNS review and fixes, with SPF, DKIM and DMARC taken to enforcement, plus MTA-STS. This is what stops someone sending email that looks like it came from you.

Devices, by policy. We shrink what reaches a phone or laptop rather than manage it: your EHR in a browser rather than an app, session limits, no offline Drive on phones, a passcode, blocking any device that shouldn’t reach your practice’s data, and the ability to wipe your practice account from a lost phone. You also get a signed BYOD policy with its written reasoning.

Your incident process. A written process and a register your Privacy Officer owns, plus a one-page after-hours guide for suspending an account.

The rest of your records. A map of which roles get which access, a record of where things started, a security posture report, and help with your cyber-insurance questionnaire.

Watching your logs and alerts, every business day.

Your Google Admin console, run for you: groups, settings, and any change your practice manager, your owner, or an IT lead they choose asks for.

DNS and email authentication changes.

Checking access: former employees who still have it, shared accounts nobody owns, and administrators who don’t need to be.

When someone joins, we create their account with the access their role needs.

When someone leaves, their access is removed the same business day, or within one business hour if the departure is for cause.

A security incident. Within one business hour we suspend the account, cut off its sessions, preserve the logs, and report what was actually accessed. Your Privacy Officer decides whether it is a breach and who must be told.

Alerts only when something needs you, saying what we already did about it. No alert means nothing needs you.

A written report to both the owner and the practice manager, in the body of the email: how many safeguards are in place, where your policies stand, what is next with an owner and a date on each, and what we did, with the evidence.

A check for new third-party apps connected to your Google Workspace.

Reminders for the checks your IT company performs, such as disk encryption still being on, and a record of whether they happened.

A written quarterly review for your practice manager and owner: what changed, what is open and who owns it, and what needs deciding, with our recommendation. Any quarter you would like to go through it together, we will meet with your leadership.

A formal access review, with its findings and actions written down.

A copy of your Google Workspace logs in your Shared Drive, saved before Google deletes them at six months.

A reminder to review your EHR’s access report, and a record of whether it was done. Your practice manager runs the report; we never go into your EHR.

Your evidence pack checked complete, so it is never more than 90 days from ready for an auditor.

A phishing simulation, with the results to your leadership. Follow-up training sits with your IT company or HR.

A review meeting with your leadership, owner included, alongside the policy review: the year’s work, and the decisions for the year ahead.

A review of all your policies, and everyone signs off again.

This year’s compliance training, tracked for everyone.

A documented test that your backups can actually be restored.

A Google Workspace vulnerability review, with a plan to fix what it finds.

A check that no business associate agreement has expired.

The security risk assessment is separate. The first one is part of setup, and each yearly renewal is its own line, at half price while you subscribe.