(914) 714-4312 Book a call Get an assessment
Compliance & HIPAA

HIPAA safeguards and a signed BAA, handled for your practice.

We put HIPAA safeguards in place for medical and dental practices, sign a business associate agreement, and keep the records, and we handle our part start to finish. Your practice stays responsible under the law, and we do not certify compliance. The rest of the practice IT can be on Managed IT, and one written-up project is a medical office in Paramus, NJ.

  • Annual security risk assessment
  • Encryption, access controls and two-step sign-in
  • Staff training records
  • Backups tested so they restore
  • A BAA signed before we touch your systems

Sold only with Managed IT, and priced separately. From $1,250 a month plus a one-time build from $6,500.

An example HIPAA program for a medical office. Through the year the risk assessment is done, the business associate agreement is signed, all 15 laptops are encrypted, all 15 staff finish training, access is reviewed and policies are signed. When the insurer asks for the risk assessment and proof of encryption, both are attached and sent the same morning.

A HIPAA program, kept current all year

Ready when someone asks.Evidence kept current, not rebuilt for an audit.
What counts as patient data (ePHI)

ePHI is any patient information kept on a computer or phone: charts, appointment notes, scanned insurance cards, emailed referrals, voicemails, X-rays, even the billing spreadsheet. If your practice keeps or sends it electronically, the HIPAA Security Rule applies. It requires safeguards for your people, your building and your computers.

What we handle

The technical side of HIPAA, run for you.

Your practice stays responsible under the law. We put the safeguards in place, keep them running and keep the records that prove it. We run the program, with training and policy tools from a compliance platform we license.

Security risk assessment

The annual risk assessment the Security Rule requires. We check your whole setup and write down every gap.

Technical safeguards

Access controls, encryption (data scrambled so a lost laptop is unreadable), MFA (a second check at sign-in) and activity logs. All standard in our setup.

Evidence and log monitoring

We watch the system logs and keep the records, so you can show your safeguards are in place.

Computer protection (MDR)

Security software on every computer and server that spots attacks and stops them early.

Account takeover protection (ITDR)

Watches your Microsoft 365 or Google sign-ins and mailboxes for signs that an account was taken over.

Backup and disaster recovery

Backups of computers, servers, email and drives, tested to make sure they restore, plus a tested recovery plan. New Jersey offices can start with backup in New Jersey.

Staff training

Short HIPAA training for staff, with records of who finished it, so your team can spot fake emails.

We sign your BAA

A business associate agreement sets out how we must protect your patient data. We sign it before we touch your systems, and the vendors we use for your data sign one with us.

Policies and templates

HIPAA policies set up for your practice, including your Notice of Privacy Practices, privacy and security officer roles, and breach procedures.

HIPAA also covers the physical side: cameras and door access on records areas, screen privacy, and certified destruction of old drives and copiers. We install and document those too. See Surveillance & Access Control and Medical & Dental Offices.

HIPAA safeguard help in New York City, Westchester and North Jersey

Practices in all three places get the same safeguard work. We sign a BAA. We do not certify compliance. Your practice stays responsible under the law.

North Jersey

A medical office in Paramus was set up from an empty suite: network, cameras, computers, phones and email with the safeguards HIPAA expects. The work ran about five weeks in May and June 2026.

Westchester

Medical offices in White Plains and New Rochelle can put day-to-day IT on a Managed IT plan, with this safeguard program priced separately. We come from Pelham.

New York City

Medical and dental practices in New York City can get the same safeguard help. See IT for small medical and dental offices in NYC, medical office IT, New York City, Westchester and North Jersey.

Common questions

HIPAA questions.

Who is this service for?

Medical and dental offices, behavioral health, physical therapy, chiropractic, home health, labs, and the vendors that serve them. For practice IT in general, see the Medical & Dental Offices page.

Will this make my practice HIPAA compliant?

No vendor can promise that, because the law keeps the responsibility with your practice. We do most of the work: safeguards, monitoring, records, policies, training and the yearly risk assessment.

What happens in the free assessment?

We look over your setup, list the gaps against the Security Rule and give you a clear plan.

Can you make us HIPAA certified?

No. HHS, the federal health department, does not recognize any HIPAA certification. If the Office for Civil Rights investigates, it asks for proof: your risk analysis, policies, training records and logs.

What does the HIPAA program cost?

It is only sold with Managed IT and priced separately. For up to 5 people on a standard setup it is $1,250 a month plus a one-time build of $6,500. Larger practices cost more. Legal advice, breach notification mailings and forensic investigation are not included.

Do you work with practices in New York City, Westchester and North Jersey?

Yes. The safeguard work is the same in New York City, Westchester and North Jersey. We come from Pelham. A medical office in Paramus, NJ is written up, with the network, cameras, computers, phones and email set up with the safeguards HIPAA expects. We sign a BAA. We do not certify compliance.

Book a 30-minute call.

We look at your setup and tell you what it would cost.

For offices of 5 to 50 people in NY, NJ and CT.

Book a call Get an assessment

Rated 5 stars on Google. Pelham, NY, since 2021. (914) 714-4312