Step 1 · Assessment
Find out where you actually stand.
Most practices can say they are compliant. Far fewer can show an inspector who is allowed to do what, under whose order — or hand someone the written program that proves patient information is protected. A fixed-fee assessment replaces the guesswork with a scored, evidence-based baseline and a costed plan to close the gaps.
Step1
Physician-led
Clinical & Medical Compliance Assessment
An on-site audit of how clinical care is actually delivered — against your licences, your state’s scope-of-practice and delegation rules, and the standards an inspector would apply. We check the evidence, not the answers: we open the drawers, the medication refrigerator and the emergency kit, pull charts at random, and ask your staff to walk us through the work.
- Licensure, and every service you offer matched to the licence, supervision and order it requires
- Credentialing, training and competency files
- Medical director oversight and standing orders
- Laser, IPL and energy-device safety; medication and product management
- Emergency preparedness and infection prevention
- Charting, informed consent, policies against actual practice, and quality review
You receive a scored checklist with the evidence for every item, a written report with findings ranked on the scale below, and a corrective action plan with an owner and a due date for each finding. State-specific checks are Massachusetts first; elsewhere we say plainly which parts are state-specific. All fifteen areas →
Step1
Privacy, Security & State Law Assessment
We review what a practice handling protected health information is expected to have in writing — against the Security, Privacy and Breach Notification Rules, and the Massachusetts written information security program rules where they apply — and report what is missing, partial or out of date, ranked by priority and costed to fix.
- A scored workbook: every requirement, its evidence, and its gap
- A written report with findings ranked on the scale below
- A documentation inventory — what exists, what is a draft, what is absent
- A readout with the owner, and a costed scope for Step 2
A gap analysis is not a risk analysis.
We say this before anyone asks. A gap analysis measures you against the rule's requirements; it does not assess every risk to the confidentiality, integrity and availability of electronic patient information, and it is not a substitute for the risk analysis the Security Rule requires. That risk analysis is part of Step 2, and we will not let you believe otherwise.
OCR Cybersecurity Newsletter, April 2018 · verified 10 Sep 2026One scale for every finding
Clinical and privacy findings are ranked the same way, so an owner can read one list in one order.
| Rank | What it means |
|---|---|
| P1 · Immediate | A patient-safety, scope-of-practice or licensure concern, or patient information actively exposed. Act now. |
| P2 · High | A significant deficiency an inspector, carrier or regulator would cite. |
| P3 · Corrective action | A process or documentation gap, closed on a plan with an owner and a date. |
| Verified | Evidence seen and satisfactory. |
| Unable to verify | Treated as a finding until the evidence is produced. |
Choose one, or both
Each assessment can be bought on its own. Together they run as one engagement: one scoping call, one site visit, one readout and one corrective action plan.
| Assessment | What it covers | Fee |
|---|---|---|
| Clinical & Medical Compliance | Physician-led on-site audit of scope, oversight, orders, devices, medications, emergency readiness, infection prevention and records | $3,500 – $9,500Quoted after the call |
| Privacy, Security & State Law | HIPAA Privacy, Security and Breach Notification; Massachusetts WISP; FTC; PCI DSS | $2,950 – $9,000Quoted after the call |
| Combined | Both, on one file, cross-reviewed, with a single readout and plan | $5,500 – $15,500Quoted after the call |
The combined assessment costs less than buying both separately. Any assessment fee is credited in full against a twelve-month vCCO program signed within sixty days of your report.
What we review
Clinical care and patient information are regulated by different bodies that do not coordinate. We review your practice against both, and the seam between them.
- HIPAA Security Rule
- HIPAA Privacy Rule
- Breach Notification Rule
- Massachusetts WISP (201 CMR 17.00)
- State scope of practice & delegation
- FTC advertising & Health Breach Notification
- PCI DSS for deposits & payments
- OSHA bloodborne pathogens
- FDA product sourcing
- Medical director oversight & standing orders
- Laser & IPL safety
- Medication management
- Emergency preparedness
- Infection prevention
- Informed consent & medical records
What sets the price
Two single-site practices are not the same engagement, so they are not the same fee. On the scoping call we score ten things and the tier follows from the score, in front of you.
| What we score | Why it moves the fee |
|---|---|
| Locations and states | Each site is its own walk-through; each state adds its own scope-of-practice and security-program rules. |
| Workforce size | Training, access reviews and sanctions scale with headcount. |
| Systems holding patient information | Every system is a vendor agreement, an access review and a backup question. |
| Medical services and devices | Each injectable, energy device and medication line is its own scope, order and competency check. |
| Service lines | Weight management, hormone therapy and photography-heavy work carry more records and more consent. |
| Insurance billing | Billing changes what the rules expect of you and how much of it applies. |
| IT environment | A managed Microsoft tenant is a different review from a mix of personal devices. |
| Ownership structure | An owner-operated practice decides faster than an investor-backed group. |
| Current documentation | If you already have some of it, you pay less. That is the whole point of measuring first. |
| A live event | A complaint, an incident, a carrier questionnaire or a sale under way changes the sequence. |
We publish what sets the price rather than a price list, because the honest number depends on the answers above. You get a fixed fee in writing after a 30-minute call — not a range that moves later.
Ready for an honest baseline?
Tell us your locations, your service lines and anything with a deadline on it. We will tell you what the assessment covers and what it costs, in writing, after a 30-minute call.