HIPAA Security Risk Assessment
A documented risk analysis of your systems, a prioritized remediation plan, and a summary you can hand an auditor or insurer.
Lancaster County, PA
Fractional IT leadership and HIPAA compliance for independent medical practices.
You run the practice. I make sure your technology is secure, compliant, and working for you, without the cost of a full-time IT executive.
No sales pitch. You get a short, plain-language list of where you stand, whether or not we work together.
The gap
Your IT company keeps things running. Who owns the bigger picture?
Independent practices hold the same patient data as hospitals, with a fraction of the IT staff. Most rely on an IT support company for day-to-day help, but no one is responsible for strategy, compliance, and planning.
- When was your last documented HIPAA security risk assessment?
- Could you hand an auditor or cyber insurer your security documentation today?
- Is anyone checking that your IT vendors and contracts are a good deal and include Business Associate Agreements?
- Do you have a plan and budget for replacing aging computers and equipment?
- Does your staff know which AI tools are safe to use around patient information?
Services
What I do
Start with a fixed-price risk assessment, then add ongoing support only if it makes sense for your practice.
Fractional vCIO
A monthly strategy meeting, IT roadmap and budget, oversight of your IT support company and vendors, and policy upkeep.
Annual Compliance
A yearly risk assessment update plus quarterly check-ins, so your HIPAA documentation never goes stale.
Microsoft 365 and AI Readiness
A security baseline check, license cleanup, and a safe plan for using AI tools around patient data.
Vendor and Contract Review
Review of EHR, phone, IT support, and other technology contracts, including Business Associate Agreements.
Technology Planning
Vendor-neutral refresh plans, equipment specs and budgets, a second opinion on quotes, and security standards for devices and backups.
How it works
Simple, low-risk first steps
Free check-in
A 30-minute conversation about your systems, vendors, and compliance. You leave with a short list of where you stand.
Risk assessment
A fixed-price HIPAA Security Risk Assessment with a clear, prioritized action plan. No long-term commitment.
Ongoing support
If it helps, a monthly vCIO retainer keeps your plan on track and your IT support company accountable.
About
Hi, I'm Carl.
For more than 10 years I've served as the part-time CIO for a Lancaster County medical practice, owning their IT strategy, security, HIPAA compliance, and technology vendor decisions. Red Rose IT Advisory brings that same experience to other independent practices.
- Healthcare experience10+ years leading IT for a local medical practice.
- Works with your IT companyI complement your current support provider, not replace it.
- Vendor-neutralI don't resell hardware or software, so my advice is unbiased.
- Local and in personBased in Lititz and available on-site across Lancaster County.
- Microsoft certifiedA broad Microsoft certification portfolio, plus AI and cloud credentials.
- Plain languageClear recommendations your team can act on, without the jargon.
Get started
Book a free 30-minute check-in
Find out where your practice stands on security and HIPAA, with no obligation.
Schedule a check-inPlease don't include patient information in emails or booking notes.
- carl@redroseit.com
- Based in
- Lititz, PA