For medical & allied health practices · Michiana
HIPAA isn't just a hospital problem.
If your practice bills insurance, you're a covered entity — and the Security Rule applies to you the same way it applies to Beacon or Saint Joseph. The difference is they have a compliance department. You have an office manager with forty other things to do.
We work with independent primary care, chiropractic, physical therapy, optometry, dermatology, and behavioral health practices. Same annual requirement, far less attention from vendors.
What happens next
- A 20-minute callWe ask how the practice runs, what systems hold patient information, and what's already been done.
- A walkthroughThe EHR, imaging or diagnostic equipment, telehealth tools, backups, logins, and vendor agreements. We never open a chart.
- A report and a planFindings ranked by what matters, a 30/60/90-day fix list, and the documentation the rule requires you to keep.
Two to three weeks. Fixed fee, quoted before we start.
What we find in most small practices
Chiropractic, PT, optometry, and dermatology offices tend to have the same gaps as dental — plus a few of their own.
The specialty equipment nobody thinks of as a computer
Thermal scanners, retinal cameras, dermatology photo systems, and treatment-planning software all store patient information — often on a PC in the corner that's never been updated.
Telehealth and AI scribes
Video visit platforms and ambient documentation tools are Business Associates. Many practices adopted them in a hurry and never got the agreement or reviewed where recordings go.
Shared logins and no access review
Everyone signs in as the front desk. Staff who left last year still have accounts. There's no record of who looked at what.
Untested backups
The backup runs. Nobody has restored from it. That's the whole ransomware question.
No written policies, no training records
Both are required. Both are the first documents requested after a complaint.
Where to start
Fixed fee, quoted before we begin. No hardware to buy, no software to license.
HIPAA Security Risk Analysis
- Inventory of every system holding patient information — EHR, devices, telehealth, AI tools, cloud vendors
- Review of all 45 Security Rule implementation specifications
- Business Associate inventory, including telehealth and AI vendors
- Risk register in the format OCR guidance describes
- Plain-language report for regulators, insurers, or a practice buyer
- 30/60/90-day remediation plan with owners
- Optional: HIPAA security policy manual and AI use policy sized for a small practice
Retained six years, as required. Repeated annually under an ongoing plan.
Then, if you want it handled
Ongoing plans from $1,500 a month: the annual reassessment, policy upkeep, staff training, vendor agreements, and someone to call when something looks wrong. For offices that would rather not think about this again until we bring it up.
No long contract. Month to month after the first term, and we'll tell you if you've outgrown needing us.
Questions we hear
We're a small chiropractic / PT / eye care office. Does HIPAA really apply?
If you bill insurance electronically, yes — you're a covered entity and the Security Rule applies in full. Small practices are not exempt, and OCR has settled with practices well under ten staff.
Our EHR vendor says they're HIPAA compliant.
They may well be. That covers their system, not your practice. Your logins, your devices, your staff training, your other vendors, and your written policies are your responsibility, and the risk analysis is how you document that.
We use an AI scribe. Is that a problem?
Not necessarily — but it's a Business Associate, it needs an agreement, and you should know where recordings and transcripts are stored and for how long. We include AI tools in the inventory.
Do you need access to patient records?
No. Systems, settings, and paperwork only. Our agreement says so in writing.
How long does it take?
Two to three weeks. Your staff's involvement is a couple of hours total.
Start with a conversation
Twenty minutes, no charge. We'll tell you whether the rule applies to your practice the way you think it does, and what it would take to be in good shape.
- Pick a time for a 20-minute callChoose any open slot — no phone tag
- (574) 250-4475Call or text during business hours
- info@statelinedata.comWe answer within one business day
- South Bend, Mishawaka, Elkhart, Niles, and the surrounding areaOn site when it helps, remote when it doesn't