Step 2 · Remediation
We close the gaps the assessment found.
The missing documents and controls, drafted for your practice and adopted by it — not a template pack emailed as a zip file. Scoped from your assessment, so you buy only what you are actually missing.
Step2
What we close
The missing documents, drafted for your practice — not a template pack emailed as a zip file. We write them, you adopt them, and we keep the evidence that you did.
Clinical
- Clinical policies for each service and device you offer
- Protocols and standing orders, reviewed with your medical director
- Procedure-specific informed consent and a separate photography authorization
- Emergency protocols: anaphylaxis, vascular occlusion, syncope, local anesthetic toxicity, laser burns and ocular injury
- Credential files, competency validation, and a licence and permit tracker
- Laser and energy-device safety program and device inventory
- Medication, product and expiration controls
- Infection prevention and bloodborne pathogen exposure control plan
- Chart audit, quality review, and an approval gate for new services and devices
Privacy, security & state law
- Privacy, security and administrative policy set
- Security risk analysis under the Security Rule
- Vendor and business associate register, with the agreements executed
- Incident response plan and breach decision tree
- Workforce privacy and security training with completion records
- Written information security program (Massachusetts, and other states as needed)
Components are scoped from the assessment, so you buy what you are actually missing. We write the technical specification; your IT provider implements it and we hold them to it. Clinical protocols and orders are adopted by your medical director.
Scoped from evidence
Every component traces to a finding in your assessment, ranked by risk and by effort to fix.
Written for your practice
Fitted to your state, service lines, devices and technology. Your name on it, your workflow in it.
Held to the specification
Your medical director adopts the clinical protocols; your IT provider implements the technical controls. We write the specification and hold both to it. We do not become either.
Already have an assessment?
If someone else assessed you, send us the report. We will tell you which findings we can close, in what order, and what each component costs.