The sprint & pricing

One fixed fee. One week. Everything in writing.

The sprint exists so a practice owner can make one clean decision instead of signing an open-ended retainer. Here's the full scope, what each engagement costs, and the ground rules the work never breaks.

Engagements

Start with the sprint. Add the rest only if it earns it.

Every practice starts with the same fixed-fee sprint. It's the fastest way to a complete picture. The other two exist for what comes after, and neither is required.

Start here

Readiness Sprint

Your first full picture: AI tools, vendors, data flows, and evidence, in one week.

$2,500 fixed fee · 5–7 business days

AI tool inventory with per-tool risk cards and data flows
Patient-data-outside-the-EHR map: email, forms, billing, texting, drives, backups
Vendor & BAA evidence review with ready-to-send gap requests
Access, MFA & logging review; passive outside-in exposure summary
Downtime tabletop + first-hours one-pager
Staff AI attestation draft, evidence index, 30/60/90 roadmap, owner–MSP handoff, executive readout

Book the fit check

After the sprint

Ongoing readiness

For practices that want the record to stay current as vendors ship and staff change.

$1,200 per month · cancel anytime

Quarterly review of the risk register and evidence freshness
Review of new AI features and vendor changes before they're switched on
Annual downtime tabletop refresh
Cyber-insurance questionnaire and vendor security-request support
A named, healthcare-literate contact for "is this legit?" moments

Ask about ongoing

Add-on

Policy & training pack

When the gap is people and habits: AI use, phishing, and payment fraud at the front desk.

$800 one-time · with any sprint

AI & acceptable-use policy matched to your actual tool stack
Phishing and wire-fraud playbooks for scheduling and billing roles
Ten-minute huddle scripts instead of a 45-minute video nobody watches
Onboarding and annual-refresh content you own and reuse

Ask about the pack

Multi-location groups and practices with unusual stacks get a scope adjustment quoted in writing at the fit check, before anything starts and never after.

Ground rules

Four rules the work never breaks.

No patient data, full stop

No charts, no note contents, no PHI uploads, no credentials collected. The Security Rule is about how systems and vendors behave; that's what gets examined. If a task would require patient data, it's out of scope by design.

External checks are passive

The outside-in review reads what the public internet already shows about your domain, email configuration, and web presence. Nothing is probed, scanned intrusively, or touched. It's the view an insurer or attacker gets for free. You should have it too.

Plain English, two audiences

Owners get findings they can read in ten minutes and act on in one meeting. Your MSP or IT contact gets the specific, prioritized technical asks. One roadmap, two languages, no jargon tax.

You own every artifact

The packet is files, not a platform login. Keep it, hand it to your MSP, give it to the next owner. If Velari disappeared tomorrow, the evidence would still be yours and still be useful.

Next step

The fit check costs nothing but the fifteen minutes.

Practice size, systems, vendors, AI tools in play, and a straight answer on whether the sprint fits. If it doesn't, you'll hear that directly.

Email itsnmills@gmail.com See the risks it covers

Replies come from me, Noah, not from a sequence.