Services & fees · three fixed-fee engagements

pick the one that answers today’s worry. we’ll handle the rest.

An assessment if someone has asked for your risk analysis. A phishing campaign if an attachment gave you a fright. A hardening sprint if the laptops have never been locked down. Each is quoted in writing before we start, and each one ends the same way: a ranked list of what to fix, and an hour with your staff.

Book a readiness call Thirty minutes, at no charge. Not sure which one fits? That’s what the call is for — or ring (516) 381-0450.
Practices of 3 to 40 people, most often
  • independent dental offices
  • family & internal medicine
  • pediatrics
  • physical therapy
  • optometry
Fee schedule Fixed · 2026

Your exact figure arrives in writing within one business day of the call. It is the figure on your invoice.

The engagements, in full

everything each one includes, down to your small part in it

Written out the way we’d want it if we were the practice manager: what we look at, what lands on your desk afterwards, what we’ll ask of you, and how long it takes.

hipaa security risk assessment

$2,850 practices up to 15 staff · $3,640 for 16–40 staff
Reserve an assessment or ring (516) 381-0450

The one most practices start with — and the one to choose if an insurer, a vendor, or your own conscience has asked whether you’ve done a risk analysis lately.

What we look at
  • Every workstation, laptop, tablet, router, and printer-scanner — including the imaging PC in the back operatory
  • Who can sign in to what, and which accounts belong to people who left
  • Screens visible from the waiting room, the network closet, the shred bin
  • Your written policies, incident plan, and business associate agreements
What you receive
  • A dated, written risk analysis across the Security Rule’s administrative, physical, and technical safeguards
  • A device and account inventory, as a spreadsheet you can keep current
  • The ranked remediation report, with the free fixes at the top
  • A 45-minute walk-through of findings, then the 60-minute staff session
Your part
Leave a key with whoever opens, and have your list of software vendors to hand. If you can’t find your BAAs, tell us — finding them is part of the job.
Timing
Three to four weeks. Half a day on-site, booked before opening, over lunch, or after the last patient.

phishing simulation campaign

$1,375 per 90-day campaign · every staff member included
Schedule a phishing campaign or ring (516) 381-0450

For the office where someone has already clicked something, or where you’d simply rather find out in a drill than on a Monday morning.

What we send
  • Three test emails, staggered over the quarter so nobody sees them coming
  • Lures written for healthcare offices: an insurance remittance, a lab result, a “password expiring” notice
  • A landing page that explains what gave the email away — it teaches, it doesn’t scold
What you receive
  • Click and report rates by role — front desk, clinical, billing — never by name
  • A private five-minute coaching note for anyone who clicked
  • The ranked follow-up report and the 60-minute staff session
Your part
Send us a staff email list, and forward two pages of instructions to whoever manages your email so our tests reach the inbox. That’s all.
Timing
Ninety days, entirely remote. Nothing about your patient schedule changes.

endpoint hardening sprint

$1,960 up to 12 devices · $85 each additional
Book a hardening sprint or ring (516) 381-0450

The hands-on one. We tighten the machines themselves, so a lost laptop or a guessed password becomes an inconvenience rather than a breach notice.

What we change
  • Full-disk encryption on every laptop and workstation
  • Multi-factor sign-in for email and your EHR
  • Updates and patching set to run on their own
  • Shared front-desk logins and local-admin accounts retired
  • Screen-lock timers on every machine in an open area
  • A real restore from your backup, so you know it works
What you receive
  • A before-and-after sheet for every device
  • Encryption recovery keys, sealed and handed to the practice owner
  • The ranked report for anything left over, then the 60-minute staff session
Your part
Two evenings with the office closed, and a minute with each staff member the morning after to set up their sign-in app. We’ll stand beside them for it.
Timing
Two evenings, usually a Tuesday and Thursday after the last appointment.
Side by side

which engagement covers what

If you’re weighing two, this is usually where the choice makes itself. Anything marked with a dash is simply covered by one of the others.

Swipe the table sideways to see all three.

What each Zelvio engagement includes, with fees
What’s included risk assessment3–4 weeks phishing campaign90 days hardening sprint2 evenings
Fixed quote in writing within one business day Included Included Included
Time at your practice Half a day None — remote Two evenings
Dated HIPAA risk analysis for your files Included Not included Not included
Device & account inventory Full inventory Not included Before/after sheet
Policy & BAA review Included Not included Not included
Simulated phishing emails Not included Three sends Not included
Changes made to your machines Not included — recommended in the report Not included Included
Ranked remediation report Included Included Included
60-minute staff session Included Included Included
Fixed fee $2,850up to 15 staff · $3,640 for 16–40 $1,375per 90-day campaign $1,960up to 12 devices · $85 each after

Planning the whole year? All three within twelve months come to $5,690 rather than $6,185. We usually run the assessment first, harden the machines it flags, then test your team once everything is tidy.

Ask about the full year
A printed remediation report with red tab dividers beside a security key and a sealed envelope of recovery keys on a clinic desk.
What a hardening sprint leaves on the practice owner’s desk: the report, the keys, and nothing you have to decipher.
Smaller requests

the extras practices ask for, priced one at a time

Added to any engagement, or booked within a year of one. If you need something that isn’t here, ask — we’ll say plainly whether it’s ours to do.

  • additional devices in a hardening sprint$85 each

    For the thirteenth laptop, the hygienist’s tablet, the spare PC in the sterilization room.

  • an extra phishing send$240

    A fourth email inside your 90-day campaign, written around something your office actually receives.

  • second staff session$295

    For practices with split shifts or a second site, so nobody misses the hour.

  • new-hire security orientation$165

    Thirty minutes over video for someone who joined after your staff session.

  • policy & procedure set, edited for you$340

    Access, device, incident-response, and sanction policies — rewritten in your practice’s name and routines.

  • business associate agreements past the first ten$45 each

    The assessment checks ten vendors; this covers the lab, the shredding company, and the rest.

  • re-check after remediation$640

    We come back, confirm the fixes held, and add a dated note to your risk analysis saying so.

Extras are listed on your quote alongside the engagement fee, so the total you see before we start is the total you pay.

Add one to your quote
Included with every engagement

the hour your whole team spends with us

Every engagement closes in your break room or over video. Nothing generic: the examples come from your own office, so the lesson sticks on Monday.

A consultant talking a seated dental team through a flagged email in their break room, coffee in hand.
In person, we bring the coffee. Over video, we keep it to the hour.

  1. what we found here

    Three or four findings from your own office, told without naming anyone — the sticky note, the shared login, the unlocked screen.

  2. emails that look like work

    Fake remittances, lab results, and password resets, taken apart line by line so your team knows what to pause on.

  3. your desk, your screen, your sign-in

    Locking screens between patients, setting up the sign-in app, and the five-second habits that matter most at the front desk.

  4. if you do click

    Who to tell, what to unplug, and why speaking up in the first ten minutes matters more than anything else.

  5. anything you’ve wondered

    Home Wi-Fi, texting patients, the strange call last week. No question is too small; most are asked by someone else too.

We schedule it before opening or over a long lunch, whichever keeps the chairs full.

Book your readiness call
Before you book

if we’re not the right call, we’ll tell you on the first one.

We’d rather point you somewhere better than sell you the wrong engagement. A few times we’ll suggest someone else:

  • Your organization has more than about 40 staff, or several sites under one IT department.
  • You need round-the-clock monitoring or help-desk support — that’s a managed service provider’s work, and we’ll help you choose one.
  • A contract calls for a formal penetration test or a certification audit by a named standard.

Thirty minutes, no charge. Tell us your headcount and the software that runs your schedule; a fixed quote follows in writing within one business day.

Book the courtesy call or ring (516) 381-0450 · contact@zelvioagency.com