Question 1

Is this an audit?

Accepted Answer

No. It is the risk analysis that the Security Rule requires every covered entity and business associate to perform (45 CFR 164.308(a)(1)(ii)(A)). It is also the document an auditor asks for first.

Question 2

Do you need access to patient records?

Accepted Answer

No. Ward reads security configuration only. The access is read-only, scoped to settings, and your administrator grants and can revoke it. The attestation asks about safeguards and processes, never about patients.

Question 3

Will we pass an audit?

Accepted Answer

No one can promise that, and you should be wary of anyone who does. What you get is a signed analysis, evidence behind every finding, and a prioritized plan to close the gaps that matter.

Question 4

How is this different from compliance software?

Accepted Answer

Software gives you a questionnaire and a score. This gives you a compliance expert who collects real configuration, writes and signs the findings, and stays available while you fix them.

Question 5

What happens after the report?

Accepted Answer

You get a remediation plan ordered by risk. SaberGuard can do the work on NinjaOne, Guardz, and Microsoft 365, or hand the plan to your IT provider. Continuous monitoring is optional and starts after the baseline.

Question 6

What is Ward Agent, and do we log into it?

Accepted Answer

Ward Agent is SaberGuard's assessment platform. It collects security configuration from your Microsoft 365 or Google Workspace tenant, evaluates it against the Security Rule, and keeps doing so on a schedule if you choose monitoring. You never log into it; you receive signed findings and an executive summary.

Question 7

What does it cost?

Accepted Answer

Risk analysis fees are fixed by practice size and published on the pricing page. Remediation is quoted per project after the analysis. Senior advisory is billed at $150 per hour with no retainer. Monitoring is scoped with your assessment.

Question 8

How long does a risk analysis take?

Accepted Answer

Scope is fixed on the scoping call. Read-only access and the attestation take your team under two hours; collection, evaluation, and review follow, and the findings call is scheduled when the report is signed. Exact timing depends on practice size and platforms.

Question 9

We're not in healthcare. Does Massachusetts law still apply to us?

Accepted Answer

If you hold personal information about a Massachusetts resident (name plus SSN, driver's license, or financial account number), 201 CMR 17.03 requires a written information security program whether or not HIPAA applies. SaberGuard writes them.

Question 10

Do you replace legal counsel for breach notification decisions?

Accepted Answer

No. We provide technical findings, timeline support, containment guidance, and remediation evidence. Notification decisions belong with qualified healthcare privacy counsel.

Question 11

Can you implement the safeguards you recommend?

Accepted Answer

Yes. Microsoft 365 hardening, identity and MFA rollout, endpoint management and protection on NinjaOne and Guardz, email security, backup and recovery, security awareness training, and incident response planning, done by the same person who signed the report.

Question 12

Where are you located, and who do you work with?

Accepted Answer

SaberGuard is based in Central Massachusetts and works with medical, dental, and behavioral health practices and their business associates across the Commonwealth. Everything runs remotely; on-site visits are scheduled when a finding calls for one.

Questions we get before the first call

Still have a question?