About Cipherling · Sayville, NY
a small clinic’s security, handled by people who’ll tell you the truth.
Cipherling exists for independent medical and dental practices that are too small for an enterprise security vendor and too busy to read the HIPAA Security Rule. You walk away with a ranked list of what’s actually wrong, what it costs to fix, and paperwork you can hand to an auditor.
Where we stand
four positions, stated before you ask.
- 01 / price
you see the number first
Every job is quoted at a fixed figure before kickoff. If scope grows, we tell you and you choose.
why it matters
An hourly meter rewards slow work. A fixed price rewards finishing.
- 02 / independence
we sell no software
No commissions, no preferred vendors. If a free Windows setting fixes it, that’s what the report says.
why it matters
A report written by someone with a product to push is a brochure.
- 03 / language
plain English, on purpose
Each finding names the room, the machine, the person it touches, and what the fix costs.
why it matters
If your practice manager can’t act on it Monday, it didn’t do its job.
- 04 / discretion
findings go to you only
Phishing results are reported to you as a group, never as names on a wall.
why it matters
People report mistakes faster when mistakes don’t get them shamed.
Why this practice exists
the clinics we meet aren’t careless. they’re unsupported.
A three-chair dental office has the same legal duty to analyze its risks as a hospital system, and about none of the staff. The security work usually falls to whoever is best with computers, which is often the office manager on top of everything else.
We started Cipherling in Sayville to take that job off their desk in ten business days, in a form they can keep. We’re a consultancy, not your IT desk. We find the problems, rank them, and hand you the map.
Sometimes the honest answer is “you’re in better shape than you think.” We’ll say that too.
The quiet part
what we’re not, so you hire the right people.
Being clear about our limits is part of the service. If you need something below, we’ll point you to it and give you the questions to ask before you sign.
- not your IT departmentWe don’t answer the “printer’s down” call.
- not a monitoring serviceNo 24/7 watch. We assess and harden, then step back.
- not a law firmIf a finding might be a reportable incident, we tell you that day so you can call your attorney.
- not a compliance guaranteeA risk assessment is the required analysis. What you do with it is the compliance.
The working terms
how we work with you, on one page.
kickoff to roadmap
Run late on our side and the invoice drops by $150.
per engagement
Jobs over $1,500 split in two: half at kickoff, half on delivery. ACH, check or card.
for anything heavy
Patching and encryption happen before 8am or after 6pm, so patients never wait.
Next step
send us two numbers: people and computers.
That’s enough for a fixed quote, usually back within one business day.