Built around outcomes, not tools.
Five ways SaberGuard helps practices prove they protect patient data, and the managed security catalog behind them.
SaberGuard assesses and advises; it does not warrant compliance.
HIPAA Security Risk Assessments
A signed HIPAA risk analysis you can hand to anyone who asks.
What it is
A Security Rule risk analysis performed by SaberGuard's compliance team with Ward: your Microsoft 365 or Google Workspace configuration, a short attestation for what software can't see, and a signed report where every finding points at its evidence.
Why it matters
45 CFR 164.308(a)(1)(ii)(A) requires it of every covered entity and business associate. It is the first document an auditor or insurer asks for, and the one most small practices cannot produce.
Includes
- Risk identification
- Gap analysis
- Compliance reporting
- Remediation planning
Who it's for
- Medical, dental, and behavioral health practices with 1 to 15 staff
- Business associates that handle ePHI for covered entities
- Practices whose only risk analysis is a questionnaire score
Expected outcomes
- A signed, defensible risk analysis with evidence behind every finding
- A gap analysis against the administrative, physical, and technical safeguards
- A remediation plan ordered by risk, and reporting you can hand to an auditor
- The Massachusetts WISP (201 CMR 17.00), included
Pricing
Fixed fee by practice size
Solo Practitioner $2,500–$3,500 · Small Group $4,500–$6,500
Not ready yet? Start with the free, open-source HIPAA SRA tool.
Ward Agent Continuous Compliance Monitoring
Compliance that keeps running after the report is signed.
What it is
Ward Agent re-collects your configuration on a schedule and checks every change against the same rules as your baseline. SaberGuard's compliance team reviews new findings before you hear about them. Nothing to install, no portal to log into.
Why it matters
A risk analysis is a photograph. A new hire gets admin rights, a policy gets switched off, a laptop leaves the building. Monitoring turns that drift into reviewed findings instead of next year's surprise.
Includes
- Continuous HIPAA monitoring
- Evidence collection
- Compliance visibility
- Risk tracking
- Executive reporting
Who it's for
- Practices with a SaberGuard baseline risk analysis
- Owners who want to know when something changes, not a year later
- Practices that answer to an insurer, hospital partner, or board
Expected outcomes
- Continuous monitoring of MFA, admin roles, sharing, mail security, and audit settings
- Evidence timestamped automatically, ready for an auditor
- Risk tracked from finding to fix to verified
- Plain-language executive reporting on your schedule
Pricing
Scoped with your assessment
Monitoring starts after the baseline risk analysis and is quoted on the scoping call.
Plainly: Not real-time alerting and not a 24/7 SOC. Collection runs on a schedule and a person reviews what changed.
Security Monitoring
Know what is running on your devices, and who is watching.
What it is
Endpoint protection, threat detection, and alerting for the devices and accounts that touch patient data, on NinjaOne and Guardz, managed by the person who signed your risk analysis.
Why it matters
Most small-practice findings trace back to the same controls: unmanaged devices, missing endpoint protection, stale accounts, alerts nobody reads. Managed monitoring keeps those gaps closed.
Includes
- Threat detection
- Endpoint monitoring
- Alerting
- Managed security visibility
Who it's for
- Practices without an IT provider, or with one that does not do security
- Practices whose risk analysis flagged endpoints, email, or identity
- Business associates asked to show managed security controls
Expected outcomes
- Threat detection and endpoint protection on every managed device
- Patch state, encryption, and device health in view
- Alerts routed to a person who knows your environment
Pricing
Scoped per client
Quoted after the risk analysis, when we know which systems need coverage.
Plainly: We tell you exactly what is watched, during which hours, and who responds. It is not a 24/7 SOC.
Security Consulting
A security professional in the room when a decision needs one.
What it is
Advisory from Jonathan DeLeon, CISM®, CCSP®: healthcare cybersecurity guidance, policy development, security roadmaps, and answers to the questionnaires insurers and hospital partners send you.
Why it matters
Small practices rarely need a full-time security officer. They need one when a questionnaire arrives, a vendor asks for a BAA, or an incident forces a notification decision.
Includes
- Strategic advisory
- Healthcare cybersecurity guidance
- Policy development
- Security roadmaps
Who it's for
- Owners and office managers who are the de facto security officer
- Practices writing or rewriting HIPAA policies and procedures
- Groups planning a merger, new location, or EHR migration
Expected outcomes
- Advisory tied to your actual risk analysis, not a template
- HIPAA policies and procedures, WISP, acceptable use, incident response
- A 12 to 24 month roadmap with sequenced priorities and budgets
Pricing
$150 per hour
Billed hourly. No retainer required.
Risk Management
Turn findings into a program your practice can actually run.
What it is
Vendor and business associate reviews, periodic reassessment, security planning, and the governance that keeps the work moving after the first report.
Why it matters
HIPAA requires risk management, not just a risk analysis (45 CFR 164.308(a)(1)(ii)(B)). Regulators and insurers look for a program with owners, dates, and evidence.
Includes
- Vendor risk management
- Risk assessments
- Security planning
- Governance support
Who it's for
- Practices with vendors that touch ePHI: billing, transcription, IT, SaaS
- Groups that want a repeatable annual cycle instead of a scramble
- Covered entities and business associates preparing for due diligence
Expected outcomes
- A business associate inventory with agreements on file and a review cadence
- An annual refresh of your baseline
- Security planning with budgets, sequencing, and owners
Pricing
Annual refresh and hourly advisory
Annual Refresh at 40 to 50% of the initial fee for existing clients; advisory at $150 per hour.
Healthcare Compliance First, Security Built Around ePHI
Risk analysis is the front door. Everything here is managed security and IT that exists because a finding pointed at it, implemented on the systems the assessment flagged.
HIPAA Security Risk Assessment
The annual SRA for covered entities and business associates: ePHI workflows, threats, likelihood, impact, prioritized remediation.
Audit Readiness & Evidence
Documentation you can defend: policies, procedures, risk register, remediation plan, vendor artifacts, executive reporting.
Security Rule Safeguards
Administrative, physical, and technical safeguard reviews mapped to practical controls for clinics and practices.
Incident Response for ePHI
Breach triage, containment, tabletop exercises, notification decision support, post-incident hardening.
Secure Healthcare Email
Phishing defense, spoofing protection, account-takeover monitoring, and encrypted delivery for patient communications.
Identity & Access Reviews
MFA, role-based access, risky sign-in review, credential exposure monitoring, workforce access processes.
Endpoint & EHR Workflow Protection
Endpoint detection, device hardening, patch visibility, and controls around EHR workstations.
M365, SaaS & Cloud Hardening
Tenant configuration, sharing controls, backup readiness, SaaS permissions, cloud exposure reduction.
Clinic Network Segmentation
Firewall, Wi-Fi, VPN, DNS filtering, and segmentation between clinical, guest, and administrative networks.
HIPAA Security Awareness
Short workforce training, phishing simulations, and completion records kept as evidence.
AI Governance for Patient Data
Approved-tool policies, data-handling guidance, and shadow-AI controls so staff never paste PHI into unsafe systems.
Multi-Framework Compliance
One control set mapped across regulators: SEC Regulation S-P, FINRA, and CMMC / NIST SP 800-171 readiness beside HIPAA.
Match your situation to a starting point
We have never had a risk analysis, or ours is a questionnaire score.
Start with HIPAA Risk AssessmentsWe have a signed baseline and want to know when something changes.
Start with Ward Agent MonitoringOur findings pointed at devices, email, or identity and nobody is watching them.
Start with Security MonitoringA questionnaire, policy rewrite, or partner request needs a security professional.
Start with Security ConsultingWe have vendors touching ePHI and no repeatable annual cycle.
Start with Risk Management
SaberGuard assesses and advises. It does not warrant or certify compliance, and nobody honest will promise you an audit outcome. What you get is a defensible analysis, a plan, and a person who answers the phone.
Start with a thirty-minute scoping call.
Tell us what prompted the search, how many people and locations you have, and which platform you run. You leave with a fixed fee and a start date.
SaberGuard assesses and advises; it does not warrant compliance.