Services · four fixed scopes · New York, NY

not a compliance package — four engagements, each one a list of settings we change.

Every Rowan engagement carries a code, a written scope, a fixed price, and a before/after change log that goes into your HIPAA file. No hourly meter, no monthly plan. Read the itemized sheets below, or check the matrix to see which Security Rule controls each one actually touches.

scope it on a 30-minute call or ring (703) 835-0107

$415–$1,465 per engagement Invoiced on delivery, net 15 1 location, up to 10 workstations

Itemized

each engagement, opened up: the settings, the paperwork, the price

The “before” column is what we most often find in a single-location practice — not a promise about yours. The “after” column is what the scope commits us to deliver and verify.

$415

45-min session + one live campaign, about 14 days later

scope the drill

Dental practice staff around a break-room table reviewing a suspicious invoice email on a laptop before opening

phishing-resilience drill

A 45-minute session in your break room, then a simulated campaign about two weeks later built from the senders your staff actually hear from — your lab, your clearinghouse, your payroll provider. The number we care about isn’t who clicked. It’s whether the person who clicked also reported it, and how fast.

Change log · what we leave behind
Item	Typical before	After
Report-phish button	Not installed	In the Outlook or Gmail toolbar on every mailbox
Reporting path	“Tell the doctor”	One named inbox, written into your incident procedure
Training record, §164.308(a)(5)	Nothing dated	Signed attendance sheet + slide PDF, dated

you receive

Debrief split by role: front desk, clinical, billing
Campaign log with each click and each report timestamped
Attendance record ready for your HIPAA binder

we need

Staff list with roles and work emails
45 minutes at a staff meeting — or two 25-minute halves
Admin consent to allowlist the simulation sender

not in this scope

Monthly ongoing simulations
A follow-up campaign round is $185, whenever you want one

$680

Remote · two evenings after 5:30pm + a 14-day DMARC watch

scope the email fix

email hardening

Spoofed email is a DNS problem before it’s a training problem. We publish and align the records that let receiving servers reject mail pretending to be your domain, then lock the mailboxes so a stolen password on its own doesn’t open them. Microsoft 365 or Google Workspace, same scope, same price.

Change log · DNS and tenant
Item	Typical before	After
SPF	~all, over the 10-lookup limit	-all, within limit, every sender listed
DKIM	Unsigned	2048-bit key published, signing on
DMARC	Missing, or p=none	p=quarantine, then p=reject after 14 days of clean reports
MFA	SMS codes on some mailboxes	Number matching on all, shared front-desk inbox included
Legacy authentication	POP / IMAP basic auth open	Disabled tenant-wide
External auto-forward	Allowed	Blocked by outbound policy

you receive

DNS change log with old and new records, side by side
Tenant settings export, dated
A one-page “adding a new sender” note for whoever runs your mail

we need

Domain registrar login
Global Admin (M365) or Super Admin (Workspace)
Every service that sends as you — e-fax, reminders, billing

not in this scope

Migrating between mail platforms
Buying encryption licenses — if you already hold Microsoft Purview Message Encryption, configuring it is included

$1,140

Up to 10 workstations · one morning on-site, before first patient

scope the machines

A dental operatory workstation showing a lock screen beside an empty chair, with a ticked checklist on the counter

endpoint hardening

Every Windows or Mac machine that opens a chart, a ledger, or an X-ray gets the same baseline, checked by hand at the keyboard. Imaging and sensor PCs are touched only with your imaging vendor’s written sign-off — a driver update at 8:55am can cancel a morning of patients, and we won’t be the reason.

Change log · per machine
Item	Typical before	After
Disk encryption	Off	BitLocker XTS-AES 256 or FileVault, recovery keys escrowed
Local admin	Every user	One named break-glass account
Automatic lock, §164.312(a)(2)(iii)	Never	5 minutes
Patching	Manual, when someone remembers	Windows Update for Business rings, 7-day deferral
Defender ASR rules	Not configured	Office child processes and LSASS credential theft blocked
USB storage	Open	Read-only at the front desk

you receive

Per-machine checklist, signed off at the keyboard
Recovery-key escrow record
A flagged list of anything past end of support — Windows 10 included, since October 14, 2025

we need

One hour before first patient, chairs empty
Local or domain admin credentials
Your imaging vendor’s support contact

not in this scope

Hardware purchases and OS upgrades
Machine 11 and up: $95 each, agreed on the intake call

$1,465

About three weeks from walk-through to signed report

scope the assessment

hipaa security risk assessment

The document §164.308(a)(1)(ii)(A) actually asks for: an accurate and thorough assessment of the risks to the confidentiality, integrity, and availability of the ePHI your practice holds. Built room by room from your office — reception, operatories, the back-office PC under the stairs — not filled in from a vendor template.

Change log · your compliance file
Item	Typical before	After
Risk analysis	EHR vendor template, undated	Signed, dated, specific to your rooms and devices
ePHI inventory	In the office manager’s head	Every device, app, and data flow, listed
BAA folder	Partial	Every vendor mapped, missing agreements named
Backups, §164.308(a)(7)	“It runs nightly”	One restore tested and recorded
Remediation	None written	Ranked plan with owners and target dates

you receive

The report — PDF, signed and dated
Risk register scored threat × vulnerability × likelihood × impact
A 30-minute readout with the doctor and office manager

we need

The six items on the first-visit checklist
One walk-through morning
Your MSP or IT contractor on one call

not in this scope

The fixes themselves — RX-02 and RX-03 cover most of what it finds
Annual refresh: $520

Mapped to the Security Rule

which engagement touches which control

Ten Security Rule standards small practices get asked about most, against the four codes. “Changed” means we alter the setting and verify it. “Reviewed” means we examine it and write up what we find.

Changed and verified
Reviewed and documented
Outside this engagement

Control	RX-01Phishing drill	RX-02Email	RX-03Endpoints	RX-04Risk assessment
Risk analysis§164.308(a)(1)(ii)(A)	Not covered	Not covered	Not covered	Changed
Security awareness training§164.308(a)(5)(i)	Changed	Not covered	Not covered	Reviewed
Password management§164.308(a)(5)(ii)(D)	Not covered	Changed	Changed	Reviewed
Security incident procedures§164.308(a)(6)(i)	Changed	Not covered	Not covered	Reviewed
Data backup plan§164.308(a)(7)(ii)(A)	Not covered	Not covered	Not covered	Reviewed
Business associate contracts§164.308(b)(1)	Not covered	Not covered	Not covered	Reviewed
Device and media controls§164.310(d)(1)	Not covered	Not covered	Changed	Reviewed
Automatic logoff§164.312(a)(2)(iii)	Not covered	Not covered	Changed	Reviewed
Encryption and decryption§164.312(a)(2)(iv)	Not covered	Not covered	Changed	Reviewed
Person or entity authentication§164.312(d)	Not covered	Changed	Not covered	Reviewed
Transmission security§164.312(e)(1)	Not covered	Changed	Not covered	Reviewed

Read down the RX-04 column. It’s the only engagement with a mark in every row — which is why it’s the one we suggest first, and why its findings usually decide whether RX-02 or RX-03 comes next.

Common orders

three situations we hear on intake calls — and the codes that fit them

These are sums of the fixed prices above, billed as separate invoices in the order shown. Nothing here is a bundle discount; it’s just the sequence that tends to work.

Order A

a payer or carrier asked for your risk analysis

A credentialing packet, a malpractice renewal, or an OCR letter wants the document. Start with the document.

RX-04Risk assessment$1,465

Total$1,465

order the assessment

Order B

someone paid a fake lab invoice

Fix the domain that let the spoof land, then train the people who’ll see the next one.

RX-02Email hardening$680
RX-01Phishing drill$415

Total$1,095

order the email + drill pair

Order C

opening a new office, or adding operatories

New machines, new mailboxes, new staff — set the baseline before the first chart is opened on them.

RX-04Risk assessment$1,465
RX-03Endpoint hardening$1,140
RX-02Email hardening$680

Total$3,285

order the opening set

None of these sound like you? Describe the practice on the intake call. We’ll write the order — one code or four — and send the scope by email before you commit to anything.

Terms

the fine print, set at reading size

Eight clauses cover every engagement. If something on your intake call doesn’t fit them, we say so before quoting.

A printed scope document with its fixed price circled in red marker beside a pen and a clipped stack of agreements

One location, up to ten workstations.
That’s what each listed price assumes. A second location is quoted on the intake call, in writing.
Invoiced on delivery, net 15.
No deposit. The invoice arrives with the report or the signed-off checklist — ACH, check, Visa, Mastercard, or Amex.
The quoted price is the invoiced price.
If a fix turns out bigger than the scope, we stop, document it, and quote it as its own engagement.
On-site within New York, NY.
Walk-throughs and endpoint mornings happen at your office; email and DNS work happens remotely after 5:30pm.
Clinical hours stay clinical.
On-site work is scheduled before first patient or over lunch. We don’t restart a machine with a chart open on it.
Vendor systems need vendor sign-off.
Imaging, sensor, and EHR servers are changed only with the vendor’s written approval — we arrange the call.
We sign your BAA before we see ePHI.
Or you sign ours. Either way it’s dated and filed before the walk-through starts.
What we don’t sell.
24/7 monitoring, managed IT, hardware, and “HIPAA certification” — no such federal certificate exists.

Not sure which code?

that’s exactly what the 30-minute intake call decides

We ask how many workstations you run, which EHR, who holds the admin keys, and what prompted the call. You get a written scope by email — one of the four codes, or an order of them — with the price on it before anything is touched.

book the 30-minute intake call