Fixed-scope security for independent clinics · New York, NY
Rowan runs HIPAA security risk assessments, phishing-resilience drills, and email + endpoint hardening for independent medical and dental practices. Every engagement has a written scope, a fixed price between $400 and $1,500, and one invoice.
The materials
A security engagement is only as real as the settings it changes. These are the controls we open, edit, and verify inside your practice — each one written into the report with the before value, the after value, and the date it changed.
p=none → p=reject
Meet the engagements
Each one is scoped to a single-location practice with up to ten workstations. Pick one, stack two, or start with the assessment and let the findings decide.
$415
45-min session + one live campaign
$680
Remote · after hours
$1,140
Up to 10 workstations · one morning
$1,465
About three weeks to signed report
Two locations, or more than ten machines? We price it on the intake call, in writing, before anything is touched. The number on the invoice is the number you agreed to.
Before the first visit
Six things turn a walk-through from a guessing game into a two-hour morning. If any of these are missing, that’s already a finding — and we’ll write it down kindly.
Your network, charted
Subjective, objective, assessment, plan. A single-location practice typically runs about three weeks from intake call to signed report — and the price is fixed on day one.
You tell us what keeps the office manager up at night — the ex-hygienist who may still have a login, the fax line that quietly became email, the EHR vendor’s always-on remote tool. We agree the scope and the price before we hang up.
One morning on-site before first patient. Every device that touches PHI gets looked at in person — including the imaging PC in the operatory nobody remembers to patch. Microsoft 365 or Workspace, DNS, and backups are reviewed remotely.
Ranked findings, each tied to the control it misses — say, §164.312(a)(2)(iii), automatic logoff — with the evidence we saw and the exact setting that closes it. Written for the doctor, readable by your IT vendor.
In-scope fixes get done and verified on the machine. Anything outside scope gets a dated remediation plan your MSP can follow line by line. Then one invoice — ACH, check, or card.
There’s no federal HIPAA certification, and anyone selling one is selling a sticker. What the Security Rule requires under §164.308(a)(1)(ii)(A) is an accurate, thorough risk analysis — documented. That’s what the assessment produces, ready if OCR, a payer, or your malpractice carrier asks.
Your MSP keeps the printers and the EHR running. We check whether it’s all configured to the Security Rule, then hand findings over in their language — GPO names, DNS records, tenant settings — so they can implement, or we do it inside scope.
On-site work happens before first patient or over lunch; email and DNS changes are made remotely after 5:30pm. The phishing session runs 45 minutes and can be split across two staff meetings.
We stop, write it down, and quote it as its own fixed engagement. The invoice you agreed to doesn’t grow mid-job.
Tell us the practice type, roughly how many workstations, and who runs your IT today. We reply Mon–Fri 9am–5:30pm, or call (703) 835-0107.
your risk assessment should name the reception pc, the x-ray workstation and the doctor’s personal gmail — by name. if it reads like any practice in manhattan, it wasn’t written for yours.
— the Rowan house rule
the breach rarely starts in the server closet. it starts at the front desk, on a tuesday, with an invoice that looks like it came from your lab.”
— Rowan, on where we look first
The office