HIPAA compliance & security
for dermatology practices
on Google Workspace
Continuous, hands-on protection, now that attackers use AI to write their scams and find the gaps.
We’re your security and HIPAA compliance partner. We lock down your practice’s email and Google Workspace, and watch them every business day, so an email forged in your name, or a stolen password, is much harder to use against you. Your cyber insurer will ask whether you have followed their security guidelines before paying out a claim. We make sure your answers are true and keep the records that prove it. And we carry most of the HIPAA load: your risk assessment, your policies, your vendor agreements and the yearly policy review. Of the Security Rule’s 27 safeguards, we handle 15 ourselves and follow up on the other 12 until they’re done and recorded. So if the worst happens, you can show exactly what you did to protect your patients.
Not ready to talk? Take the free HIPAA Checkup in six minutes.
Three plans, from your email records to your whole HIPAA program
Each plan includes everything in the one before it. Pick how much you want us to take on.
Email Security
Stop forged email in your practice’s name. Your email records set up and kept right, DMARC taken all the way to reject, your DMARC reports read every week, and an alert within a business day if something breaks.
See Email Security →Workspace Security
Your Google Workspace, run by experts every business day: on/offboarding, your security settings kept to a written standard, alerts and sharing watched, and incidents handled within one business hour.
See Workspace Security →HIPAA Compliance
Your whole HIPAA program, run with you: the risk assessment, your policies, vendor agreements, phishing tests, a written review every quarter, and the evidence pack in your own Shared Drive.
See HIPAA Compliance →HIPAA Compliance
We see every item through, whoever has to act
Of the 27 safeguards in the HIPAA Security Rule, we handle 15 ourselves. For the other 12, your leadership decides or your team acts. We tell them exactly what is needed, follow up until it is done, and record that it happened.
15we do
5your leadership decides
7your team does, and we follow up
Free, and a good place to start
The HIPAA Checkup
A short checkup on what HIPAA actually asks of a dermatology practice on Google Workspace: 27 questions, one for each safeguard in the Security Rule, that show you where yours stands.
Who is in charge
1 of 27
Is someone officially named our “Security Official”, and do staff know who it is?
45 CFR 164.308(a)(2) · Standard
What we don’t do
We configure device policy. We do not support devices.
- Support devices. Computers, phones, printers and anything in front of the user stay with your IT company.
- Help your staff with sign-ins or apps. A forgotten password or a question about Gmail goes to your IT company, and we give them what they need to reset passwords.
- Decide whether an incident is a breach. That is your Privacy Officer’s call. We bring the logs and the facts.
- Make your practice’s decisions. BYOD, retention and the rest are your leadership’s call, with our recommendation in front of them.
Who is this for?
We help derm practices in the U.S. become and stay secure and HIPAA compliant.
- On Google Workspace (Business Plus or higher for HIPAA Compliance). Why
- With an existing IT support function
Questions practices ask
All the questions →Who is responsible for our compliance?
Legally, your practice is, and that can’t be handed to anyone else. In practice, we carry most of the load, and your Security Official makes the decisions.
Do we still need our IT company?
Yes. We run your compliance program and your Google Admin console. Your IT company looks after your staff: their computers, phones, printers and sign-ins. We work alongside them.
Which plan do we need?
Email Security ($197 a month) stops email forged in your name. Workspace Security (from $497) adds your whole Google Workspace, run every business day. HIPAA Compliance (from $997) adds your HIPAA program, run with you. Compare the plans →
The call is with me.
Twenty minutes to see whether we are a good fit for your practice, and to answer your questions. If we are not the right fit, I will tell you, and point you somewhere better if I can.
Sam Roberts, Founder