Illustrative exampleHealth & Wellness / Physical Therapy

A physical therapy group, ready for the security questionnaire it used to dread

A hospital partner sent four clinics a ninety-one-question security questionnaire. They could answer about twenty. A virtual CISO ran the HIPAA risk assessment they had never done.

This shows the kind of work we do. It is not a client engagement, and the business in it is invented.

Where it started

The problem

Four clinics, a patient portal, a texting app the front desk loved, and no written risk assessment. HIPAA requires one, and the owners learned that from the questionnaire.

Of the ninety-one questions, they could answer about twenty with any confidence.

What changed

What we did

A virtual CISO from our team ran the risk assessment, walking each clinic and interviewing everyone from the front desk to the billing contractor.

The texting app was the biggest problem. It had no business associate agreement, and messages sat on staff's personal phones. We replaced it with a service that signs one and keeps messages off the handset.

Policies came next, written to describe what the practice actually does rather than a template promising things nobody would do. Laptops got full-disk encryption, and the shared front-desk login became individual accounts.

The questionnaire went back complete, with evidence attached wherever it was asked for. The vCISO now meets the owners every quarter to keep the assessment current.

Built with

  • Microsoft 365
  • Microsoft Intune
  • BitLocker
  • Spruce Health

Services in this job

More on physical therapy

Got a job like this one?

Tell us what's slow, fragile or stuck.

We'll tell you whether it's work we should be doing and what it would involve. Every quote is written for the job in front of us.

Talk to usMore work
  • What we arePlan, create, launch, maintain
  • What we areSentrello Premier Partner
  • What we areEvery quote written for you