Solo practitioner
1–3 staff, one location
$2,000–$3,000
Annual refresh $800–$1,200
For healthcare practices
HIPAA security for small medical, dental, and behavioral health practices
A signed HIPAA Security Rule risk analysis with the evidence behind every finding, the Massachusetts written information security program, and managed security to fix what the analysis finds.
For practices with 1 to 40 staff in Massachusetts. Run an advisory firm instead? See the page for investment advisers.
What the law asks
A risk analysis, the security measures it calls for, and a WISP
A risk analysis is required by 45 CFR 164.308(a)(1)(ii)(A). This isn't best practice. It's the law.
HIPAA Security Rule
45 CFR 164.308(a)(1)(ii)(A)
Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. This is the risk analysis.
HIPAA Security Rule
45 CFR 164.308(a)(1)(ii)(B)
Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. This is risk management: the ongoing part.
HIPAA Security Rule
45 CFR 164.308, 164.310, 164.312
The administrative, physical, and technical safeguards a risk analysis is measured against. Findings in a SaberGuard report cite the specific paragraph.
Massachusetts data security regulation
201 CMR 17.03
Every person that owns or licenses personal information about a Massachusetts resident must develop, implement, and maintain a comprehensive written information security program (WISP).
HHS proposed changes to the Security Rule in January 2025. They are not final, and the current rule applies.
What you receive
A signed report with the evidence behind every finding
- Signed HIPAA Security Rule risk analysis report
- Each finding with its citation, severity, and the evidence that produced it
- Prioritized remediation roadmap
- Massachusetts written information security program (WISP) under 201 CMR 17.00
- A one-time Ward Agent baseline of your Microsoft 365 or Google Workspace security settings and mail domain, through read-only access that can stay in place if you add monitoring
- A call to walk through the findings
What Ward Agent reads
- MFA registration state
- Conditional access and security defaults
- Admin role assignments
- Stale and unused accounts
- External sharing settings
- App consent and guest access
- Audit logging settings
- Licensing
- Device compliance on managed devices
- Mail-domain SPF, DKIM, and DMARC
What it never reads
- Files
- Calendars
- Chat
- Patient records
- Anything a patient wrote
- What is stored on your devices
- Device serial numbers or IP addresses
Your administrator grants the read-only access and can revoke it at any time. How Ward Agent works
How the analysis runs
Four steps from read-only access to a signed report
Step 1
Collect
You grant read-only access to your Microsoft 365 or Google Workspace security settings and answer a short attestation about what software can't see: physical safeguards, business associate agreements, and how staff use the EHR.
Step 2
Evaluate
Ward Agent checks the settings against hand-written rules, each mapped to a Security Rule citation. A rule, not an AI, decides whether a control is met.
Step 3
Review and sign
A credentialed reviewer reads every finding, rejects what doesn't hold up, and signs the report.
Step 4
Fix and keep watching
Findings become a remediation plan ordered by risk. Monitoring, on its own or in the Managed Security and Fully Managed tiers, keeps the analysis current.
What it costs
A fixed fee, set by the size of your practice
The scoping call fixes the number inside the range, and it does not change afterward.
Small group
4–15 staff
$3,500–$5,500
Annual refresh $1,400–$2,200
Multi-provider
16–40 staff, or two locations
$5,500–$9,000
Annual refresh $2,200–$3,600
Practices with more than 40 staff or three or more locations are quoted after a scoping call.
The findings name specific settings, accounts, and devices. SaberGuard can fix them through managed security, from $50 per user per month with a $150 monthly minimum, or hand the remediation plan to your IT provider. Practices that keep their own provider can add Ward Agent monitoring from $150 a month.
Full pricingHow managed security works
SaberGuard assesses and advises. It does not warrant or certify compliance or promise an audit or exam outcome.
Questions
What practices ask before the first call
Find out where your practice stands.
A thirty-minute scoping call covers your people, locations, EHR, and platform. You leave with a fixed fee and a start date.
SaberGuard assesses and advises; it does not warrant compliance.