Primary care & pediatrics
Two doctors, six staff, one shared login on the front-desk PC and a sticky note that knows the password. We start there, because attackers do.
HIPAA security for independent clinics · Forest Hills, NY
A finished HIPAA risk assessment in 21 days. One fixed fee.
Most small clinics are one clicked link from a reportable breach and one dusty binder from pretending they’re fine. Lantern Ferry carries your practice across — the assessment, the staff training, and a roadmap your office manager can actually run.
Fixed fee · by invoice
Quoted before we start
One invoice per crossingEach engagement is billed once, by invoice, at the price we quoted.
Read-only, alwaysWe look at your systems. We never write to your EHR or touch a chart.
Worst firstFindings ranked by what hurts patient privacy soonest — in plain English.
01 — Who we ferry across
For clinics too small for a CISO and too exposed to wing it.
You didn’t open a practice to become a compliance department. Fine. Neither did we — we’re here so you don’t have to.
PT, chiro & rehab
Tablets in treatment rooms, a billing vendor three states away, and a guest network that isn’t.
Dental & ortho
An imaging server running software nobody has patched since the installer left in 2019. We find it, name it, and tell you what it costs to fix.
Behavioral health
Session notes are the most private records in medicine. They deserve better than a shared drive.
Service area. On-site across Queens, Brooklyn, Manhattan and Nassau. Remote anywhere in New York State. Based at 104-20 Queens Blvd, Forest Hills, NY.
02 — The work
Three crossings. Priced before we leave the dock.
Take one, take all three. Every price below is the price on the invoice — no hourly meter running while you’re with a patient.
Day 21
Crossing 01 · Assessment
The HIPAA security risk assessment
The risk analysis the Security Rule requires — 45 CFR §164.308(a)(1)(ii)(A) — and the first document an auditor asks to see. Written by someone who has stood in your router closet.
- Inventory of every device, app and cloud account that touches patient data
- An on-site walk of the front desk, treatment rooms and server shelf
- Vendor and BAA review — billing, transcription, portal, IT
- Ranked findings report in plain English, ready to file
$3,480Fixed fee · delivered in 21 days
8 weeks
Crossing 02 · Training
Phishing-resilience for the whole front office
A once-a-year slideshow is theater. Staff learn to spot a bad email by getting fooled by a safe one — privately, repeatedly, and without a lecture.
- 45-minute live session at your clinic or on video
- Four simulated phishing waves across eight weeks
- A one-page “before you click” card for every desk
- A results summary for the doctors — no names, no shaming
$1,260Fixed fee · up to 25 staff
30 / 60 / 90
Crossing 03 · Roadmap
The remediation roadmap
Findings are only useful if somebody fixes them. This is the chart: every gap, who owns it, what it costs, and the day it’s done.
- 30/60/90-day schedule with a named owner for each fix
- Rough cost per item — we resell no software, so none of it is a sales pitch
- A “done when…” line for every task, so you can check our work
- 90-minute walkthrough with the doctors, then it’s yours to run
$2,140Fixed fee · after an assessment
All three crossings, one invoice.
Assessment, training and roadmap booked together: $6,350 instead of $6,880. Quoted in writing the same day you call.
03 — Before the first call
What to carry on board.
Don’t clean up first. Half the value is seeing the practice as it actually runs. Just gather what you can of this list — “we don’t have one” is a perfectly good answer.
Bring it messy
- Your last risk analysis — if there is oneA blank is fine. Tell us it’s blank.
- The name of your EHR and who hosts itCloud, local server, or “the guy set it up.”
- A headcount, locums and part-timers includedEveryone with a login counts.
- Every vendor that touches patient dataBilling, transcription, the portal, your IT contact.
- Last year’s incident log — or the story of the time something went wrongThe lost laptop, the misdirected fax, the odd email.
- A phone photo of your router closetWe won’t judge. We’ve seen worse.
104-20 Queens Blvd
Forest Hills, NY 11375 Find the dock on Queens Blvd
Forest Hills, NY 11375 Find the dock on Queens Blvd
Hours
By appointment — book a call
We schedule around your patient hours, not ours. Call (212) 717-1726
04 — Straight answers
Questions you’re afraid to ask your IT guy.
We’re nine people. Are we really a target?
Attackers don’t pick by size; they pick by how easy you are. Small clinics hold full patient identities and rarely have anyone watching the door. Being small isn’t a defense — it’s the reason they find you.
Is a risk assessment actually required?
Yes. The HIPAA Security Rule requires covered practices to conduct an accurate, thorough risk analysis — and an auditor will ask for it first. A binder from 2017 doesn’t count as current. We’ll tell you which of yours does.
What does it cost, and when do I pay?
The assessment is $3,480, training $1,260, the roadmap $2,140 — or $6,350 for all three. You get the number in writing before we start, and one invoice per engagement. No hourly meter, no surprise line items at the end.
Will you slow down my clinic or touch my EHR?
No. We work read-only and schedule the on-site walk before or after patient hours. We look at how your systems are set up; we don’t log into charts and we don’t change a thing.
Can you guarantee we’ll pass an audit?
Nobody honest can. We can hand you a current, documented risk analysis, a trained front desk, and a dated plan to close the gaps. That’s what an auditor wants to see — and it’s what protects your patients either way.
05 — From shore to shore
The crossing, in the order it happens.
Five stops, about three weeks to the first signed report. You’ll know what’s next at every one of them.
The 20-minute call
You tell us how many chairs, rooms and logins you have. We tell you, the same day and in writing, the fixed fee and the date we’d finish. If we’re not the right fit, we say so and point you elsewhere.
Walk the floor
One visit, two to three hours, before or after clinic. Front-desk monitors, the router closet, the fax line, the backup drive in the doctor’s bag. Read-only access; we change nothing.
Write it down
A ranked findings report in plain English: what could expose patient privacy first, what an auditor will ask for, what can wait. This is your documented risk analysis.
Teach the front desk
A live 45-minute session, then four simulated phishing waves over eight weeks. Nobody gets called out in front of the doctors.
Hand over the roadmap
30/60/90-day fixes, each with an owner, a rough cost and a “done when” line. We walk the doctors through it in 90 minutes — then the wheel is yours.