About Rowan · 312 E 51St St, New York, NY
Rowan is a small security consultancy for independent medical and dental practices. We do one narrow job: read the HIPAA Security Rule against your actual front desk, operatory, and inbox — then change the setting, verify it on the machine, and sign the page.
We don’t replace your IT vendor or your EHR support line. We’re the second set of eyes that checks how it was all configured, and leaves a dated record of what changed.
Why Rowan exists
Ask an independent practice about HIPAA security and, often enough, someone points at a binder. It came from a template site or a previous consultant, it says “risk assessment” on the spine, and nobody in the building could tell you which computer page fourteen is talking about. A document that can’t be traced to a device isn’t a control. It’s paperwork.
Meanwhile the real exposure sits in plain sight: one Windows login shared across the front desk, an EHR session left open overnight, a domain with no DMARC record so anyone can send mail as the practice, a former hygienist whose Microsoft 365 account was never disabled. None of it is exotic. Most of it is fixable in an afternoon by someone who knows exactly which setting to open.
Rowan was set up to close that gap. Not to run your IT — your MSP or part-time contractor already does that — but to read the Security Rule against your specific rooms and machines, write down what’s missing by hostname, and fix whatever fits inside the scope we agreed on the intake call. What doesn’t fit becomes a remediation plan your IT vendor can follow line by line.
We price by engagement, not by the hour, because a two-chair dental office can’t budget around an open meter. And we work in New York, NY, from a small office on East 51st Street in Midtown East — close enough to be at your door before first patient, and to come back if a fix needs checking on the machine.
Scope, in writing
Knowing what a consultant won’t touch is as useful as knowing what they will. This is the line we draw on every intake call, so your IT vendor, your EHR vendor, and your counsel each know exactly where Rowan stops.
| Area | Rowan does | Rowan doesn’t — and who does |
|---|---|---|
| Publish and align SPF, DKIM and DMARC; enforce MFA with number matching; block external auto-forwarding in Microsoft 365 or Google Workspace. | Host your mail or resell licences. Your tenant stays yours, billed by Microsoft or Google. | |
| endpoints | Turn on BitLocker or FileVault and escrow the keys, remove local admin, set a 5-minute lock, define a patch baseline. | Sell, lease, or image hardware. New PCs come from your MSP or vendor of choice. |
| ehr | Review user roles against least privilege, find orphaned accounts, and document how the vendor’s remote-support tool connects. | Administer the EHR day to day or migrate data. That stays with Dentrix, Open Dental, athenaOne — whoever you license. |
| help desk | Hand findings to your IT vendor in their vocabulary: GPO names, DNS records, tenant setting paths. | Answer the 8am “printer’s offline” call. That’s your MSP’s job, and they’re better placed to do it. |
| compliance | Produce the documented risk analysis required by §164.308(a)(1)(ii)(A), signed and dated. |
Issue a “HIPAA certificate.” No federal certification exists; we won’t print one. |
| legal | Map each technical control to the section of the Security Rule it satisfies. | Give legal advice or decide breach notification. For that, call your healthcare counsel. |
House rules
They apply to every engagement, from the $415 phishing drill to the full risk assessment. If we break one, you should tell us.
01Rule
Every finding points to something you can walk up to: a hostname, a mailbox, a DNS record, a user account. “RECEPTION-02 has no auto-lock” — never “some workstations may lack controls.”
Why: a finding nobody can locate never gets fixed.
02Rule
Each setting we change is logged three ways: what it was, what it is now, and when it changed. DMARC p=none → p=reject, 14:20, by Rowan.
Why: it’s the evidence §164.316 asks you to keep.
03Rule
On-site work happens before first patient, over lunch, or after the last appointment. We don’t lean over a front-desk screen while a chart is open, and we don’t reboot an operatory PC mid-procedure.
Why: patient time belongs to patients.
04Rule
Findings go to the doctor and the IT vendor together, written so both can act. No surprise audits of someone else’s work, no blame paragraphs — just the setting and the path to it.
Why: they’re the ones who keep it fixed next year.
05Rule
If we find something bigger than the agreed scope, we stop, write it down, and quote it as its own fixed engagement. You decide whether it happens; the original invoice doesn’t move.
Why: small practices budget in fixed amounts.
06Rule
Evidence screenshots are taken with patient fields closed or blurred. A missing lock screen, an open RDP port, or an unsigned BAA can all be documented without a single patient name.
Why: a security review shouldn’t create its own PHI exposure.
In the bag
Nothing exotic — that’s the point. The walk-through is about looking closely at what’s already in the room, not plugging new boxes into your network.
The next appointment
Tell us the practice type, how many workstations, which EHR, and who handles IT today. By the end of the call you’ll know which engagement fits, what it costs to the dollar, and which morning we’d walk the office.
Rowan
312 E 51St St, New York, NY 10022
(703) 835-0107 · Mon–Fri 9am–5:30pm
The office manager, the practice owner, or whoever holds the admin password.
One 30-minute intake call, phone or video. Scope and price agreed before hanging up.
As findings require — each one quoted in writing, between $400 and $1,500.