01
Executive readout
executive-readout.html and .pdf
A ten-minute read for the owner. Your risk level, the three actions that matter this month, and what I did and didn't review.
What you get
One sprint. Five files. One readout.
Five to seven business days after intake, you have files you own and a call that assigns the next 90 days of work.
$2,500Fixed fee
5–7 daysAfter intake
5 filesHTML and PDF
0 PHIBy design
The files
Five files, in HTML and PDF.
02
Review packet
review-packet.html and .pdf
The full report, with every map and review listed below. Print it when an insurer or auditor asks to see the work. A limitations appendix makes clear it isn't a certification.
03
30 / 60 / 90 roadmap
30-60-90-roadmap.html and .pdf
The sprint doesn't fix things. It puts them in order, with an owner and a proof for each task. Days 1 to 30 usually cover MFA, access, and a restore test.
04
MSP handoff
owner-msp-handoff.html and .pdf
Forward it to your IT person. It's written as tickets, like "Send an MFA enforcement export for EHR, billing, email, and remote access."
05
Evidence index
evidence-binder-index.html and .pdf
A list of your proof and its status: provided, missing, or stale. Insurance questionnaires get answered from it. It never holds patient names, screenshots of charts, or passwords.
Schedule
The week, day by day.
- Day 0
Scope and pay
Engagement letter, domain-check permission, invoice.
- Day 1
Intake
Your systems, vendors, AI features, and MSP.
- Day 2
Vendors and AI
BAAs, data terms, shadow tools, domain check.
- Day 3
Controls
MFA, offboarding, backups, logs, downtime.
- Day 4
Build
The five files and the full report.
- Day 5–7
Readout
An hour with you and your MSP. Tasks assigned.
Inside file 02
What's inside the review packet.
- Map
Readiness review
MFA, access reviews, backups, BAAs, downtime, and logs, each marked provided, partial, or missing.
- Map
Data outside the EHR
Every flow that skips the chart, and which ones need a BAA.
- Review
Vendor and BAA gaps
BAA status for each vendor, with questions you can send as written.
- Review
AI workflows
Each AI use marked allowed, restricted, or blocked, with who can switch it off.
- Draft
Staff AI rule
One page listing allowed and blocked tools, for staff to sign.
- Checklist
AI scribe routine
Monthly checks for practices that use a scribe.
- Review
Outside exposure
What the public internet shows about your email, portal, and forms.
- Starter
Downtime plan
A tabletop you can rerun with your MSP.
Sample map
Most of the risk is around the EHR, not in it.
This sample is made up. A real sprint draws the same picture for your practice.
The readout
The readout is included. It isn't a sales call.
What we cover
The top findings
Your data map
Vendor, BAA, and AI gaps
Tickets for your MSP
A name on every 30/60/90 task
Who should come
The owner or lead clinician, the practice manager, and your MSP if you have one. There's no need to invite your insurer or lawyer.
Limits
What the packet is not.
Not legal advice
Not a certification
Not a pen test
Not incident response
Not insurance underwriting
It's evidence and a plan. You still make the decisions, and your MSP still does the fixing.
Fit check
You'll know in fifteen minutes if it fits.
Bring your size, EHR, vendors, and MSP. If the sprint isn't right for you, I'll say so.