See the state
Understand where the practice stands today.
Current compliance score, unresolved risks, overdue requirements, vendor status, and workforce obligations — visible in one place, updated as the practice changes.
HIPAA compliance operating system
$6.64M
What a healthcare breach costs on average — highest of any industry for 13 years.1
HIPAA compliance software for independent practices.
HIPAA compliance should do more than prepare you for an audit. It should help prevent a breach.
Patient Protect brings HIPAA compliance, security safeguards, and everyday practice operations into one connected operating system. Manage risk assessments, policies, workforce training, secure communications, and ongoing compliance — with clear next steps and the evidence to support them.
Why we built Patient Protect
Independent practices carry hospital-grade obligations without hospital-grade resources.
Small healthcare practices are responsible for protecting the same sensitive patient information as major health systems, but rarely have the dedicated security teams, budgets, or infrastructure to manage that responsibility. We built Patient Protect to close that gap — making comprehensive HIPAA compliance and practical security tools accessible to the offices that need them most.
Patient data moves through employees, vendors, devices, inboxes, forms, referrals, cloud applications, and physical workflows. Most practices have no central system for seeing the full surface — until something fails.
Ongoing tracking of breach reports, enforcement actions, and compliance updates runs in HIPAA Response — our regulatory and breach intelligence tracker.
Small practices aren’t too small to be targeted.
Patient information is valuable regardless of the size of the organization holding it. Independent practices and the vendors they depend on face many of the same threats as major health systems, often without comparable resources to detect, contain, or recover from an incident. Read the research
Smaller healthcare breaches, tracked over time.
Filtered to breaches under 50,000 individuals affected · updated daily
Where the breach surface hides.
Patient data exposure rarely comes from a single obvious failure. It builds through everyday handoffs, changes in people and technology, and compliance records that gradually fall out of sync with how the practice actually operates.
Patient data moves through more places than most practices can see.
Inbox. Personal phone. SaaS vendor. Paper intake. Fax. Integration. Every handoff creates another ePHI pathway — and another place for visibility to disappear.
Patient Protect maps where sensitive data actually moves — ePHI pathways, vendor connections, and the gaps between them.
HIPAA compliance requires more than written policies.
Creating a policy is one step. Putting it into practice is what protects patient information. Patient Protect connects compliance requirements to the safeguards and everyday workflows behind them — from access controls and secure messaging to vendor agreements, staff responsibilities, and audit evidence.
The moment
01A login from an unrecognized device.
Documentation says
Restrict access to authorized devices.
Patient Protect does
01Prompts re-authentication.
02Captures device fingerprint.
03Notifies the security officer.
The moment
02A vendor's BAA expires.
Documentation says
Maintain current BAAs.
Patient Protect does
01Raises it as an open issue.
02Blocks Secure Messaging with that vendor.
The moment
03New hire gets full admin.
Documentation says
Apply minimum necessary access.
Patient Protect does
01Access follows the roles on their record, not a default.
The moment
04A required policy passes its adoption deadline.
Documentation says
Reassess annually.
Patient Protect does
01Surfaces it as an open issue.
02Closes itself when adopted.
Security safeguards are built in from day one.
Unlike starting a compliance program from a blank checklist, Patient Protect begins with important protections built into the platform. Encryption, role-based access controls, audit logging, and BAA-gated secure messaging are part of the environment from the start. Guided setup then helps your practice establish the people, policies, and workflows needed to operate its compliance program.
See the implementation methodologyBased on internal review of platform architecture and guided onboarding.
Account creation
Baseline structural safeguards
Encryption, role-based access, audit logging, and BAA-gated messaging in place before your first click.
Guided setup
Compliance workflow initialized
One guided hour establishes the platform's compliance workflow — before you write your first practice-specific policy.
See where your practice stands before you pay for anything.
Understand your exposure through free tools that require no account. Move into the platform when you are ready to close the gaps and keep them closed.
1Free
See your risk
Take the free assessment and get a real compliance score.
Five minutes. No login required. You will see exactly where your practice stands — and where it does not.
2FreeUnderstand your exposure
Map how patient data moves across your practice.
The ePHI Data Flow Mapper traces every vendor, device, and workflow that touches patient information.
3FreeQuantify the cost
See what a breach would actually cost you.
The Risk Calculator converts practice size, record volume, and operational complexity into dollar exposure.
4PlatformFix it
Move to the platform and close the gaps at the system level.
Secure messaging, access management, audit trails, training, and daily compliance tasks — all in one place.
5PlatformStay protected
Continuous monitoring keeps compliance current as the office changes.
Live scoring, daily diagnostics, breach intelligence, and automated task generation keep you ahead of drift.
Evaluating HIPAA compliance platforms?
Before choosing HIPAA compliance software, ask these ten questions.
Not every compliance platform operates the same way. Understand which tools document requirements, which help put safeguards into practice, and what your office will still need to manage on its own.
One HIPAA compliance operating system. Every part of your practice, connected.
Risk assessments, policies, staff training, vendor agreements, access management, secure communication, and audit evidence in one connected environment — instead of managing compliance across disconnected systems.
Compliance
Manage regulatory responsibilities, assessments, policies, training, and documentation.
Security
Put appropriate safeguards and governed workflows around sensitive patient information.
Operations
Reduce fragmented administration and coordinate recurring responsibilities.
Assess → Act → Document → Monitor → Improve
Your SRA generates your risk queue. Your risk queue gates your BAAs. Your BAAs control your messaging. Your messaging generates your audit trail. Your audit trail feeds your next SRA. Compliance, as a closed loop.
SystemDefenseOperationsNetworkIntelligence
Watch the platform tour — 5 min
Know where you stand. Know what needs work. Prove what’s been done.
Patient Protect gives your office a current view of its HIPAA compliance program — what’s complete, what needs attention, who’s responsible, and what evidence is available when it’s requested.
Change the state
Assign, remediate, and keep recurring work moving.
Every finding gets an owner, a deadline, and a workflow. Recurring compliance work runs on schedule instead of surfacing during an audit.
Prove the state
Produce evidence when it is asked for.
Training records, acknowledgments, vendor documentation, risk decisions, access activity, and completed remediation — preserved as the record OCR would request.
“
Exactly what small clinics like ours need to stay safe without hiring an IT team.
Dr. Thomas E MurrayD.D.S. · Patient Protect Member Since 2017
HIPAA Foundation
The HIPAA Foundation, free to use, cite and build on.
19 tools, an open breach dataset, an iOS app, a Chrome extension, and research — the public knowledge layer that sits underneath the product, free to use without an account and free to cite without asking us. It is the part we publish.
Read the announcement →Free · CC BY 4.0 / MIT / CC0
Free · proprietary
Risk Assessment
A unified risk and readiness assessment combining compliance readiness, entity classification, practice profile, and ePHI data flow into a single Patient Protect Score. Not a full HIPAA Security Risk Analysis — see the platform's guided SRA for that.
Open →
Free · proprietaryThe Naughty List
Check whether a specific technology your practice runs — an EHR or practice-management system, imaging or PACS, a clinical device, an interface engine, an operating system, firewall or remote-access tool — has a documented security risk. Every finding carries the vendor, maintainer or government advisory it rests on, and the answer states how much of the product was actually checked.
Open →
MITHIPAA Shield — Browser Extension
Chrome Web Store extension that warns when PHI is typed or pasted into a browser form — especially consumer AI chat tools like ChatGPT, Claude, and Gemini. Detection runs inside the browser. Zero network requests, no telemetry, MIT licensed.
Open →
CC BY 4.0Healthcare Breach Dataset
Citable CC BY 4.0 dataset of US healthcare breaches sourced from the HHS Office for Civil Rights Breach Portal. Severity scoring, editorial enrichment, no AI-modeled projections. CSV + JSON. License and attribution metadata included in the download body. For researchers, journalists, and AI-search engines.
Open →
Free · proprietaryPatient Protect Signal
The free iOS app that packages breach intelligence, tools, and awareness for small practices.
Open →
Free · proprietaryAsk PIPAA
An AI HIPAA compliance assistant that answers your questions about the Security Rule, Privacy Rule, breach response, risk analysis, and more — free, instant, no login required.
Open →
Free · proprietaryHIPAA Readiness Scan
See what your practice website exposes from the outside. Checks tracking technologies, security configuration, email protection, and required privacy notices — in about 30 seconds.
Open →
From the blog
What independent practices are reading right now.
Practice OperationsOctober 19, 2026
Secure Healthcare Referrals Without Requiring the Receiving Practice to Buy Software
Referral records leave most practices by fax or email because the alternative has always required the other end to adopt your software. That barrier is the problem.
HIPAA ComplianceOctober 19, 2026
HIPAA Availability Is a Patient-Care Problem: Your Practice's Downtime Plan
When the EHR goes down, the immediate problem is not the regulation — it is the patients in the waiting room. Availability is a care problem before it is a compliance one.
ResearchOctober 19, 2026
State of Compliance Q3 2026: What 161 Federal Disclosures Actually Show
161 disclosures. 42.7 million affected individuals. Four upstream vendors carried three-quarters of the impact. The Q3 breach record is the first full quarter the series could compile end to end.
Latest from HIPAA Response
All responses- BREACHSep 11
Hawaii Family Dental: Hacking Incident Reported Affecting 45,853 Patients
HHS OCR Breach Portal
- BREACHAug 19
CareCloud breach filing: what a revised scope means for vendor oversight
Security Week
- BREACHAug 4
Madera Community Hospital breach filing: 150,000 individuals and exfiltration-scoped risk analysis
Security Week
- BREACHAug 5
Brown Health Medical Group breach filing: 311,760 individuals and server-side safeguards
Security Week
The evidence base behind everything we build.
Secure Care Research Institute publishes the working papers and dataset methodology behind Patient Protect’s market thesis on independent-practice exposure.
SSRN
The Economics of ePHI Exposure
Long-tail breach economics for healthcare organizations, with emphasis on the compounding cost structure that hits small practices hardest.
Read on SSRNSSRN
The Cyber-Economic Stack
Research referenced throughout the site’s AI-risk argument, focused on how healthcare data becomes a financialized attack asset.
Read on SSRNSix questions we get a lot.
01
What is Patient Protect?
Patient Protect is a security-first HIPAA compliance operating system built for independent healthcare providers. It brings risk assessments, policies, workforce training, vendor agreements, secure communications, and audit evidence into one connected environment — without enterprise pricing or complexity.
02
How much does Patient Protect cost?
Patient Protect offers two plans, priced per office: Basic at $39/month per office (up to 25 office personnel) is the complete core compliance and security platform, secure messaging included. Pro at $99/month per office (up to 50 office personnel) adds the patient workspace, digital forms and expanded PIPAA usage. Larger single-office practices scale predictably with per-5-personnel add-ons published on the pricing page. Multi-office practice networks — DSOs, MSOs, and specialty groups — use custom pricing that reflects the office count, vendor surface, and HIPAA-specific coordination each network requires. Contact us for a network quote. Both plans start with a 14-day trial of the full Basic plan; Pro workflows are not part of the trial (credit card required for identity verification — no charge until trial ends). A free risk assessment is also available with no account required.
03
Is Patient Protect priced per office or per organization?
Per office. Each office instance covers the personnel and workflows for a single location — because each office has its own workforce roster, its own vendor set, its own BAAs, its own physical safeguards, and its own PHI-flow surface, even when several offices roll up to the same covered entity. A multi-office practice with three offices runs three Patient Protect instances at their tier's per-office rate; consolidated reporting is available across them. Practice networks with more than a handful of offices — DSOs, MSOs, therapy groups, specialty consolidators — should request a network quote so the price reflects office count, cross-office workflows, centralized oversight, and any shared-vendor coordination the network requires.
04
Who is Patient Protect designed for?
Independent healthcare providers including dental practices, medical offices, behavioral health and therapy practices, chiropractic offices, physical therapy centers, optometry practices, and dermatology clinics. It is not designed for large hospital systems or enterprise organizations with dedicated IT departments.
05
Does Patient Protect help with the HIPAA Security Risk Assessment?
Yes. Patient Protect includes an automated Security Risk Assessment (SRA) tool mapped to the NIST Cybersecurity Framework. It identifies vulnerabilities, scores risk, and generates documentation required by the HIPAA Security Rule.
06
What free HIPAA tools does Patient Protect offer?
More than 20 free tools and resources with no login required — including Ask PIPAA (AI HIPAA compliance assistant), the Unified Risk Assessment, the HIPAA Readiness Scan, the ePHI Data Flow Mapper, the HIPAA Breach Dashboard, and the HIPAA Risk Calculator. See the complete catalog at /free-tools.
See your compliance state. Close the gaps. Preserve the evidence.
See where your practice stands today. Then use Patient Protect to close the gaps and keep them closed. Plans start at $39/month. The 14-day free trial requires a credit card for verification — no charge until it ends.