Is the risk assessment only for HIPAA?
No. It is a general-purpose cyber risk assessment. It is especially helpful for HIPAA readiness. When patient information is in scope, the work includes a HIPAA Security Risk Analysis aligned to 45 CFR §164.308(a)(1)(ii)(A).
Is the risk assessment a legal certification?
No. It is advisory. You receive a written report and a remediation roadmap. When patient information is in scope, that includes a HIPAA Security Risk Analysis aligned to 45 CFR §164.308(a)(1)(ii)(A). That is not a legal certification, a legal opinion, or a guarantee that an organization is compliant.
Do you sign a business associate agreement?
Yes. Telos Technologies signs BAAs when the work involves protected health information.
Is the fee fixed?
The cyber risk assessment is a fixed fee, set after a 30-minute discovery call, using the published schedule for organization size and tier. It is general purpose, and especially helpful for HIPAA readiness. Essentials is $3,500, $6,500, or $11,500. Premium is $7,500, $13,500, or $22,000. Monitoring is separate: a custom quote, priced by environment size. No monitoring price is published.
How long does an assessment take?
About four to eight weeks, depending on practice size and tier. Small practices on Essentials are about 4 weeks. Mid-size practices are about 5 weeks on Essentials and about 7 weeks on Premium. Larger practices are about 6 weeks on Essentials and about 8 weeks on Premium. Timelines are approximate and start once the scope is agreed.
What is the difference between Essentials and Premium?
Essentials is the risk analysis, the written report, and a remediation roadmap. Premium adds hands-on remediation help, a policy package, staff training, vendor and BAA review, and an audit-ready evidence package.
Who is this for?
Independent healthcare practices and other businesses in Southern California, mainly Temecula, Murrieta, the Inland Empire, and North County San Diego. The practices we plan around are dental, behavioral health, med spa, primary care, billing companies, and health-tech, typically with about 10–150 staff. The published schedule also includes offices of 1–15 staff.
Why is there no price for monitoring?
There is no published price for 24/7 monitoring. It is a custom quote, priced by environment size, and it is written after the 30-minute discovery call.