Federal law requires every dental practice to keep a current, written Security Risk Analysis. ChairGuard performs it, writes the policies that go with it, and keeps the whole program current every quarter, so the answer is already in a binder before anyone asks for it.
Five minutes, no cost, no sales call unless you ask for one.
In late 2024 the HHS Office for Civil Rights opened an enforcement push built specifically around one failure: not conducting an accurate and thorough security risk analysis. Every settlement under it names that same gap. The practices involved were not careless outliers. Most had security products in place. What they did not have was the documented analysis behind them.
Sources: HHS Office for Civil Rights, Guidance on Risk Analysis and the OCR Audit Protocol, hhs.gov. Northeast Radiology resolution announced 2025-04-10. Penalty range from published 2025 OCR resolution agreements. Cited as public enforcement record, not as legal advice. Verified 2026-09-21.
A risk analysis is not a firewall, an antivirus subscription, or a certificate on the wall. It is a written, dated assessment with evidence behind it, refreshed as the practice changes. Four things go wrong, over and over.
A checklist somebody filled in years ago, or the one that came free with a software purchase. Neither one survives a real review.
A template binder, no training log, no device inventory, no signed BAAs. The policy says one thing, the practice does another.
The IT vendor assumes the office manager has it. The office manager assumes the IT vendor does. It sits untouched until something forces the issue.
New laptop, new hire, new imaging vendor, new cloud app. A document that was accurate in March is wrong by June and nobody updated it.
"We have compliance software" is the sentence that shows up most often right before a finding. Software collects answers. It does not perform the analysis, and it does not sign its name to the result.
Real files you can hand to an auditor, an insurer, an attorney, or a buyer. Not a portal login you will have forgotten by next spring. You keep everything, even if you leave.
We ask your office manager business questions. Technical questions go to whoever handles your IT, not to your front desk.
A twenty minute questionnaire in your portal. Your office manager can do it between patients. Nothing technical.
We gather the technical evidence remotely with your IT provider looped in. No disruption to patient hours.
Findings rated by likelihood and impact against the Security Rule safeguards, with evidence attached to each one.
Full document set lands in your portal with a recorded walkthrough of what matters, what it costs, and what to do first. Invite your team and their training starts the same day.
Inventory, training, BAAs, and evidence updated so the program never goes stale. New hires take the course the week they start.
A fresh analysis every year, which is the cadence regulators expect to see.
Forward it to us the day it arrives. We assemble the response package with you, pull the dated evidence, and sit on the call if you want us there. That is the day this program pays for itself several times over.
Most carriers now ask whether you have a current risk analysis, written policies, and tested backups. We give you the answers with documentation behind them, which is also what keeps a claim from being denied later.
We will tell you plainly where the cheaper options are genuinely fine, because in a few situations they are.
| Free template or software questionnaire | ChairGuard | General IT provider doing it as a favor | |
|---|---|---|---|
| Who performs the analysis | Your office manager, unassisted | A security team that does only this work | A technician between service calls |
| Evidence behind each finding | None. Self reported answers | Collected, dated, and attached | Usually informal notes |
| Written policies matched to your practice | Generic boilerplate | Tailored and reviewed each year | Often skipped entirely |
| Stays current after delivery | Only if someone remembers | Quarterly refresh, annual re-analysis | Rarely |
| Independent of who sells you IT | Yes | Yes, vendor neutral by design | No. They are grading their own work |
| Support the day a request letter arrives | None | Included in the monthly program | Billed hourly, if available |
| Typical cost | $0 to a few hundred | $1,450 setup, $189 per month | Absorbed, then hourly |
Where a free template really is enough: a brand new practice with one computer, no imaging, no email containing patient information, and a genuine plan to redo it properly within a year. If that is you, tell us and we will point you at the free HHS tool instead of selling you anything.
We do not sell a standalone risk analysis, because a snapshot goes stale the week a new laptop shows up. ChairGuard is one continuing program. Single location pricing below. Multi location and DSO pricing on request, and it is less per site.
ChairGuard performs and documents your risk analysis and compliance program. We are not a law firm, and we do not issue certifications. No consultant can make a practice "HIPAA certified," and you should be careful with anyone who tells you otherwise. What we can do is make sure that when someone asks for your analysis, it exists, it is current, and it is defensible.
Once your risk analysis is delivered, you get a badge for your website and a public verification page. Patients, referring offices, and insurers can click it and see, in plain language, that a written HIPAA Security Risk Analysis was performed and when.
The seal never says "HIPAA certified," because no such certification exists. It states only what was done and when, which is exactly what someone asking is entitled to see.
Onboarding and the first month are handled in one checkout. Your portal login arrives by email within minutes, with the intake questionnaire and your first evidence requests already waiting in it.
Card or bank debit, handled by Stripe. Have an invitation code? Enter it on the checkout page under "Add promotion code" and it applies before anything is charged.
Prefer to be invoiced, or running more than one location? Email hello@chairguardcompliance.com and we will send an agreement instead.
Ten questions, about five minutes of your office manager's time. You get back a written snapshot of where your practice stands, which gaps are most likely to cause a problem, and the rule behind each one. It is emailed to you automatically, no call required, no salesperson. If the honest answer is that you are in decent shape, it will say so.
Prefer to talk to a person? Email hello@chairguardcompliance.com.
No, and we would rather you did not switch on our account. ChairGuard is vendor neutral. We work alongside whoever supports your practice and hand them a clear, specific list of anything technical that needs fixing. If your IT provider is good, this makes them look good.
Yes. The HIPAA Security Rule requires a documented, current risk analysis from every covered entity that handles electronic patient information, including a single dentist practice. There is no small practice exemption, and it is the first item requested in most investigations and in a growing number of cyber insurance applications.
Your software vendor secures their software, and most of them do it well. The rule applies to your whole practice: workstations, imaging machines, phones, email, staff behavior, vendors, and physical access to the operatories and the server closet. That is what gets assessed, and no single vendor can do it for you.
About 45 minutes total for your office manager, split across intake and one follow up. Everything else is on us. We schedule around patient hours, not through them.
Good. That is the entire point, and finding it yourself is far better than an auditor or an attacker finding it for you. You get a prioritized plan with estimated costs, and you decide what to fix and in what order. Documented awareness plus a plan is a fundamentally different posture than not knowing.
No, because that does not exist. There is no government HIPAA certification for a dental practice, and any vendor offering you one is selling a logo. What we deliver is the analysis, the policies, and the evidence trail that the rule actually asks for.
Yes. The work is remote, so location is not a constraint. If you are in Georgia you will likely get an on-site visit as well.
You keep every document we produced. No hostage portals, no watermark, no export fee. The 12 month term on the monthly program exists because an annual cycle is what makes the program meaningful, not to trap anybody.
Five minutes now beats reconstructing three years of evidence under a deadline.