HIPAA Risk Assessment: What It Costs and Why You Can't Skip It
Every dental office handling PHI must complete a HIPAA Security Risk Assessment (SRA) yearly — OCR fines start at $50K and require an SRA on audit. Yet most Brooklyn/Queens offices we audit have never done one. This is your pricing and checklist. Deep dive: HIPAA Compliance & Security.
What an SRA Must Cover (HHS SRA Tool)
- Inventory all ePHI: Dentrix/Eaglesoft/Open Dental DB, imaging, backups, email, laptops
- Threat + vulnerability scan: patch level, MFA, encryption, firewall — see Network & Server
- Risk rating + remediation plan with owner + dates
- Documentation you can hand an auditor — we deliver a signed PDF
What It Costs in NYC (2026)
- DIY with HHS tool: free but 15+ hours, easy to miss — auditors reject thin reports.
- IT vendor SRA: $800-$2,500 depending on ops and findings. Ours is $950 flat for up to 8 ops — includes scan, report, remediation roadmap.
- Remediation: encryption + MFA + firewall + 3-2-1 backups — typically $1.5K-$4K one-time, then covered under $650/mo Managed.
Top 5 Fixes We Find Every Time
- No encryption on server or laptops — BitLocker in 20 mins.
- No MFA on email/practice management — we enforce.
- Firewall = ISP router — we drop business firewall + IPS.
- Backups never tested — we run verified restores.
- No BAA chain — we track all vendors.
Same-day in Brooklyn, Manhattan, Queens, Bronx, Staten Island. Flat-fee, no hourly.
FAQ
How long? 2-3 hours on-site + report next day.
Does it satisfy OCR? Yes — HHS SRA Tool format, signed and dated, with remediation plan.