Weeks 1–3
Assess
Walk-through, inventory, scoring, roadmap session, signed report.
Services · Fixed fees · Billed by invoice
For clinics with no security department: three engagements, each with a price.
Every Kelp engagement has a stated scope, a calendar and a document at the end of it. There is no hourly meter and no monthly retainer. You see the number before anything starts, and you can finish the work in one season.
The Security Rule asks every covered entity for a documented, current risk analysis. Most small practices have one that predates their current EHR, or none at all. This is the full analysis, done on site and written to be read by someone who is not a security professional.
What happens
- A morning on site: front desk, exam rooms, the router closet
- An inventory of every device, system and vendor that touches patient data
- Administrative, physical and technical safeguards scored against evidence
- A working roadmap session with the owner and office manager
What you keep
- Asset inventory
- Scored safeguards
- Ranked roadmap
- Signed, dated report
Typically two to three weeks from walk-through to signed report.
| Up to 12 staff | From $3,150 | One site, one EHR |
|---|---|---|
| 13–30 staff | $4,640 | One site, one EHR |
| Second location | Quoted per site | Scoped after the first call |
Half invoiced at kickoff, half when the report is delivered.
A finding you have already read is cheaper than one an auditor hands you.
Get a fixed price this weekThe people who answer the phones also open the email. This training is built for that reality: forty minutes over lunch, with real examples from health care, and a measured result you can see in your own team.
The sequence
- A baseline simulated phish before anyone is told
- One 40-minute live session in your break room
- Two follow-up simulations across 90 days
- A one-page result for the owner after each round
What changes
The goal is not a perfect score. It is a team that reports a strange email in one click instead of deleting it, forwarding it, or clicking it. We show you the report rate at baseline and again at day 90.
Larger than 25 staff? Ask us; we quote a second session rather than stretch the first.
The roadmap tells you what to fix. This is the part of it that lives on devices, done for you across a scheduled week, so the desk, the exam rooms and the laptops in doctors’ bags reach the same defensible baseline.
On every device
- Full-disk encryption and a screen-lock policy
- Patch cadence, set and documented
- Multi-factor sign-in on anything holding patient records
- Endpoint protection installed and checked
What you keep
- Device baseline
- Per-machine checklist
- Restore test, witnessed
Each machine is worked on with your office manager beside us, outside patient hours.
| Up to 15 devices | From $2,460 | Workstations, laptops, tablets |
|---|---|---|
| 16–30 devices | $3,880 | Scheduled over two weeks |
The full cycle
All three, in order, in one season.
Assessment first, so the roadmap decides what the hardening covers. Training lands in the middle, so the follow-up simulations fall inside your 90 days.
- One scope, one calendar, two invoices
- Same people on site from the first morning to the signed report
$6,850 separately$6,380
For a practice of up to 12 staff and 15 devices.
The calendar
What a full cycle looks like by the week.
Weeks 3–4
Harden
Devices brought to baseline in a single scheduled week, outside patient hours.
Weeks 4–16
Train and re-test
Baseline phish, the lunch-hour session, and two follow-up simulations.
Not sure which one you need? Describe your office and we will say so plainly.
Describe your officeFine print, in plain words
Where the fixed fee ends.
Not includedLegal interpretation (we work alongside your attorney), ongoing monitoring, and replacement hardware if a device cannot be encrypted or patched.
Why is the price a fixed fee and not hourly?
A small practice should be able to approve a number once. We scope from your staff count, device count and EHR, state the price on the proposal, and carry the risk of the estimate ourselves.
What if the walk-through turns up more than we expected?
The fee holds for the scope we wrote down. If something meaningfully outside it appears, we tell you before doing the work and you decide. Fixes that are not in your scope become roadmap items, not surprise invoices.
Do we need the assessment before the other two?
Almost always, yes. The roadmap is how we decide what hardening to do and whom to train on what. If you already have a current analysis, bring it and we will scope the other two from it.
How and when do we pay?
By invoice, in two halves: at kickoff and at delivery of the report. Training is invoiced at the session. Nothing is billed monthly.
Can you work around our patient schedule?
That is the default. On-site work is booked before the first patient or over lunch, and our hours are Monday to Thursday 8am–5pm and Friday until 3pm.