Inside the EHR
Scribes now come bundled with the EHR. Turning one on takes a click. Reading the vendor's terms takes an afternoon nobody has.
Who approved it, and what did they check?
Cyber and AI readiness for small practices
AI is already inside the tools your practice uses.
Your EHR offers a scribe. Your phones answer with AI. Staff paste notes into free chatbots. Each one is a patient-data decision that nobody wrote down. In one week I find them all and give you the paper trail.
AI inventory
8 features found · 0 of 8 decided
FeatureWhereWhat it seesDefaultDecision
✦AI scribeEHRVisit audioOnUndecidedRestrict
✦Summarize visitEHRChart notesOnUndecidedRestrict
✦AI answeringPhoneCaller voiceOnUndecidedApprove
✦Draft replyPortalPatient messagesOnUndecidedRestrict
✦Ask the chatbotBrowserWhatever is pastedStaffUndecidedBlock
✦Smart remindersTextingName, visit timeOnUndecidedApprove
✦Transcribe callPhoneCall audioOnUndecidedBlock
✦Suggest codesBillingDiagnosesOnUndecidedRestrict
Small practices rarely buy AI. It arrives in a routine update, often switched on. When someone asks who approved it and what they checked, you want an answer.
Where it hides
Three doors AI walks through.
None of them needed a purchase order. All of them touch patient data.
Inside your vendors
Phone, messaging, and scheduling vendors ship AI features as routine updates. Most arrive switched on. Nobody rereads the contract.
Does your BAA cover the feature they added?
In the browser
Staff paste visit notes into free chatbots because it saves ten minutes. Without a written rule, each paste is an unrecorded disclosure.
What can staff paste, and where is that written?
The sprint
One week. Six areas. One fixed fee.
I work from interviews, your vendor list, and paperwork you already have. I don't open charts or install anything.
Area 01 of 06
AI tools
Every AI tool and feature in the practice, where its data goes, and a written approve, restrict, or block decision for each.
You keepAI inventory and decisions
Area 02 of 06
Data outside the EHR
Email, forms, billing exports, drives, texting, and backups, mapped so you can say where any leak happened.
You keepData-flow map
Area 03 of 06
Vendors and BAAs
Which vendors touch patient data, what their paperwork covers, and the email to send each one that falls short.
You keepVendor gap list
Area 04 of 06
Access and MFA
Who can reach what, which accounts should be closed, and whether your logs would hold up in an investigation.
You keepAccess review
Area 05 of 06
Outside exposure
A passive look at your domain, email security, and website. It's the first thing an attacker or insurer checks.
You keepExposure summary
Area 06 of 06
Downtime
A short tabletop. The EHR goes down on a Tuesday. Who does what, and how do you keep seeing patients?
You keepDowntime one-pager
Five to seven business days
Six areas, one packet.
Everything lands in files you own, with an owner and a date on every open item.
Fixed fee$2,500
Data map
Where patient data goes.
The EHR is usually your best-protected system. The risk is in the email, forms, drives, and vendors around it. Every flow gets an owner.
Vendors
Every vendor, checked against its contract.
Where a BAA falls short, you get a ready-to-send email asking the vendor to fix it.
Sample review · 12 vendors · 3 gapsEach gap gets an owner and a due date.
EHR platform
BAA, incident terms, subcontractors
CurrentPayments vendor
New AI answering feature
Terms unclearText reminders
Message content and BAA coverage
Needs reviewFormer contractor
Still has EHR, email, and billing access
OffboardWhat you get
Five files you can hand to anyone.
Your MSP, your insurer, an auditor, or the next owner. Each comes as HTML and PDF. No portal, no login.
File 02 · HTML · PDF
Review packet
Maps, vendors, AI review, limitations. Print-ready.
File 01 · HTML · PDF
Readout
Ten minutes for the owner: risk level and next actions.
File 03 · HTML · PDF
30 / 60 / 90
Sequenced actions with owners and dates.
File 04 · HTML · PDF
MSP handoff
Ticket language for the IT person.
File 05 · HTML · PDF
Evidence index
What exists, what is missing, what closes it.
The film
The whole sprint in thirty seconds.
Intake formSAMPLE RECORD
- PatientJordan Ellis
- Date of birth03 / 14 / 1986
- Phone(314) 555-0142
- Insurance IDBCX 448 219 07
- Visit reasonMedication follow-up
Fictional record. This is the part I never see.
The one rule
Private for your patients. Safe for your practice.
I never see a chart, a note, or a patient's name. The Security Rule is about how your systems and vendors handle data, so that's what I review.
- Patient records stay private
- Staff know what's safe to share
- Every vendor checked for a BAA
- Proof ready when an insurer asks
How it works
Three steps, one week.
- Step one
15-minute fit check
Your size, systems, vendors, and what prompted the email. If the sprint isn't the right fix, I'll say so.
- Step two
One week of review
Intake, the data map, vendor and AI review, access and backup checks, and a downtime tabletop.
- Step three
Readout and handoff
A plain-English walkthrough, the five files, and a 30/60/90 plan with a name on every task.
Who it's for
Owner-led practices with one to eight locations and no security hire.
Questions
Short answers.
Do you need access to our systems or patient data?
No. I work from interviews, your vendor and system list, documents you already have, and passive outside checks. No charts, no uploads, no software, no passwords.
Is this a HIPAA certification?
No, and be wary of anyone who sells one. There's no official HIPAA certification. You get organized evidence and a prioritized plan. It isn't legal advice, a penetration test, or a formal risk analysis opinion.
We already have an MSP. Why do we need this?
Your MSP runs the systems. Almost nobody watches the gaps between them, like vendor AI features, BAAs, and staff chatbot use. I map those and hand your MSP a list of tickets.
How does $2,500 compare?
A standalone third-party risk assessment usually runs $2,000 to $10,000. The sprint includes risk analysis support plus the vendor, AI, and staff work. For scale, IBM puts the average healthcare breach at $6.64M in 2026. No packet prevents a breach, but it shortens the list of unknowns.
Can I see your work first?
Yes. The tools behind the sprint are public on GitHub with sanitized examples. Start with the Small Practice Security Kit.
What happens after the sprint?
You keep the files. Most practices work through the 30/60/90 plan with their MSP. An optional monthly plan exists, described on the pricing page.
Start here
Start with fifteen minutes.
Tell me your size, systems, and vendors. I'll tell you whether the sprint fits. If it doesn't, you still get a free checklist.
I reply to every email myself.