“An entire industry was charging $2,000 a month for annual assessments and generic templates. The practices were paying for a certificate, not protection.”
Alexander Perrin is the founder and Chief Executive Officer of Patient Protect. He assembled the team, designed the product architecture, and built the market positioning that separates Patient Protect from the documentation-first HIPAA compliance category — a decision grounded in the conviction that independent practices deserve real security infrastructure, not paperwork disguised as protection.
Before founding Patient Protect, he spent two decades in enterprise technology, with product and architecture responsibilities across SaaS, platform, and security categories. That background shaped the platform's design language: five connected systems, twenty operational workflows, and a compliance model that operates continuously rather than annually. The company's founding work began in 2015 under a DBA, with Patient Protect LLC formalized in 2018 out of Chicago, Illinois.
He is the primary author of Patient Protect's research program, published through the Secure Care Research Institute. His work includes The Economics of ePHI Exposure (SSRN #5257628) and the State of Compliance quarterly research series. The economics paper models the ten-year financial impact of healthcare data breaches on independent practices — including the finding that a 5,000-record breach at a mid-sized clinic with weak security generates between $4 million and $6 million in long-term impact when regulatory penalties, litigation, insurance changes, patient attrition, remediation, and downstream fraud are modeled together.
He writes and directs the Patient Protect editorial program, contributes to HIPAA Pulse coverage of OCR enforcement and breach economics, and represents the company in commentary on the structural disadvantage independent practices face against the same threat actors that target hospital systems.
Selected publications
The Economics of ePHI Exposure: A Long-Term Impact Model of Healthcare Data Breaches
The State of Compliance Q2 2026
Independent-practice HIPAA compliance: field research
HIPAA Pulse — daily healthcare breach and enforcement intelligence
Authored guides
35 guides on Patient Protect.
Direct primary care has a different HIPAA exposure profile — no third-party payer flow, membership-based patient relationships, longer continuous engagement, and concierge-style communication. The 5 features that distinguish DPC-fit compliance tools.
Compliance software helps you document. A compliance platform enforces. The technical and operational gap between the two is the difference between a binder and a working program — and it determines whether the practice survives an OCR audit.
The compliance industry sells completion percentages that answer one question: how much of a form did you fill out. The Patient Protect Score answers a different one — where does the practice actually stand.
Zoom for Healthcare, Doxy.me, Updox, SimplePractice, Spruce, Healthie — ranked for independent practices on BAA, encryption, EHR integration, and cost. The eight criteria that separate eligible from actually compliant.
HIPAA was designed for institutions with compliance departments, then applied unchanged to solo dentists and four-person therapy practices. The failure mode this produces is not dramatic — it accumulates quietly, and the industry has been solving the wrong problem.
Abridge offers a BAA and SOC 2 Type II controls — but that doesn't make your use of it compliant. The configuration gaps, ambient-recording consent issues, and what practices actually need to verify.
In June 2026 the DOJ charged 455 defendants across a $6.5B healthcare fraud takedown. In March, DOJ published a first-ever department-wide Corporate Enforcement Policy with a 120-day self-disclosure window. Together they change how an independent practice must handle an internal compliance report.
HIPAA compliance software ranges from $39/mo to $40,000/yr. The four pricing models, what's actually included at each tier, and the five red flags that hide the real total cost.
HIPAA risk assessments range from $0 (HHS SRA Tool) to $25,000 (full consultant engagement). The honest breakdown by tier, what you actually get, and how to evaluate quotes.
Patient Protect has released a public HIPAA infrastructure layer — 21 production-grade resources spanning compliance education, risk assessment, training, breach intelligence, public datasets, developer resources, AI-readiness, and a Chrome extension. Free. No login. Under permissive licenses where applicable.
The best HIPAA compliance software in 2026 is not a policy library — it is a security platform that enforces what the new Security Rule will require. Score yours with the Patient Protect Readiness Index (PPRI).
Ranked guide to the 7 patient communication platforms that sign BAAs and handle SMS, secure messaging, video, and email correctly. What each does well and the workflow gaps each one creates.
Ranked guide to the 10 cloud storage providers that offer HIPAA-eligible plans with a signed BAA, plus what each is suited for and the configuration traps independent practices miss.
Ranked guide to the 7 practice management platforms that sign BAAs and serve independent healthcare practices. What each does well, and the compliance work each one leaves to the practice.
The 10 most-cited HIPAA violation categories in OCR enforcement actions, ranked by frequency. What independent practices get wrong, and what to put in place before the audit.
Ranked guide to the 8 EHR platforms most commonly adopted by independent healthcare practices, with the HIPAA configuration responsibility each one transfers back to the practice.
What happens when you sign up for Patient Protect. A minute-by-minute breakdown showing how architecture, guided setup, and acknowledgments cover ~70% of HIPAA requirements in under 60 minutes.
All 5 standards and 9 specs under §164.312 — classified required vs. addressable with implementation steps for independent practices. Free checklist included.
OCR audits don't appear at random. They follow predictable triggers — patient complaints, breach reports, media coverage, referrals. These are the nine independent practices most often miss.
OpenAI signs BAAs for specific enterprise, healthcare, clinician, and API deployments — not for personal ChatGPT, ChatGPT Health, or ChatGPT Business. What that means for independent practices whose staff are already using it.
Eight recurring patterns across HHS OCR enforcement settlements that independent practices should treat as roadmap, not surprise. What each settlement tells the next practice in line.
HHS proposed major updates to the HIPAA Security Rule. MFA becomes mandatory, risk assessments get more specific, and incident response timelines tighten. Here is what independent practices need to know.
AI amplified the value of stolen medical records by 30%. How artificial intelligence is making healthcare breaches more damaging, more expensive, and harder to contain.
How AI lowered the cost of exploiting healthcare data, why stolen PHI trades like currency, and what independent practices can do about the information asymmetry.
Independent practices face a six-fold surge in cyberattacks and carry enterprise-grade compliance obligations with none of the infrastructure. Here is what that actually costs.
How to evaluate HIPAA compliance software as an independent practice. 6 platforms scored on active prevention, pricing, and small-practice fit.
Step 7: Provide PHI access, honor patient requests, track disclosures, and deliver Notice of Privacy Practices — the Privacy Rule in practice.
Step 4: Secure physical access to ePHI — manage devices, enforce encryption, and reduce HIPAA risk with documented controls.
Step 5: Protect ePHI at the device level — encrypt hardware, enforce mobile controls, and harden your HIPAA infrastructure.
Step 6: Implement HIPAA-compliant access controls — RBAC, vendor permissions, audit trails, and the minimum necessary standard.
Step 1 of our 17-step HIPAA compliance series. Determine whether you are a Covered Entity, Business Associate, Hybrid Entity, or Vendor — and what that means for your obligations.
Step 2: Conduct risk assessments, monitor threats, and document mitigation strategies to keep your practice secure and audit-ready.
Step 3: Assign Privacy and Security Officers, deliver required training, and document policies to protect your practice and meet HIPAA standards.
Some HIPAA compliance platforms are built on outdated technology that creates the very vulnerabilities they claim to prevent. Here is how to check yours.
A buyer's guide for independent practices evaluating HIPAA compliance platforms. What actually matters, what to skip, and why most tools deliver documentation exercises instead of operational security.
