Public HIPAA infrastructure layer
The public HIPAA layer for independent healthcare.
Twenty-one production-grade tools, datasets, training modules, and reference materials — the diagnostic and educational layer that compliance vendors typically gate behind sales calls or $2,000-plus engagements. Given away because the practices that need HIPAA visibility most are the ones being priced out of it.
Free. No login. CC BY 4.0 on data and reference materials. MIT on code.
Unified Risk Assessment
A comprehensive HIPAA risk analysis combining compliance readiness, entity classification, practice profile, and ePHI data flow into a single risk score.
Democratizing access
The segment with the largest breach risk receives the least protection. This page starts to fix that.
Dental offices, medical practices, behavioral health clinics, chiropractic offices, physical therapy centers, optometry practices — the independent-healthcare segment operates under hospital-grade HIPAA obligations with a fraction of the budget. The compliance vendor market has responded by gating basic tools behind $2,000–$5,000 consultant engagements and hiding reference material behind sales calls. The result: the segment most exposed to breach is the segment least able to see the exposure.
We give it away. Twenty-one diagnostic tools, reference datasets, training modules, and open-source utilities — free, no login, no lead magnet, no stepping-stone to a demo call. If a solo dental practice needs to run a risk assessment tomorrow morning, this page is the answer. If a behavioral health clinic needs to check its ePHI data flow before an audit, this page is the answer. CC BY 4.0 on the data. MIT on the code. Public because it should be.
The paid Patient Protect platform is a fundamentally different offer.It runs the active security and infrastructure work most compliance vendors do not — continuous configuration monitoring, BAA scope enforcement, workforce access controls, breach simulation, incident response. That is where independent-practice compliance actually lives, and it is the work most often missing from vendors who charge multiples of what we do. The free tools show you where you stand. The platform closes the gaps. From $39/month, no contracts.
The full inventory
21 production-grade resources. No login. No lead magnets.
Most compliance vendors publish in two or three of these disciplines, behind a sales contact form. We publish across all ten, without one.
See where you stand
Assessments and classification tools that reveal your actual compliance standing.
AI
Ask PIPAA
An AI HIPAA compliance assistant that answers your questions about the Security Rule, Privacy Rule, breach response, risk analysis, and more — free, instant, no login required.
Diagnostics
HIPAA Readiness Scan
See what an OCR investigator would see when they look at your practice website. Checks for tracking pixels, security gaps, email vulnerabilities, and missing HIPAA documents — in 30 seconds.
Assessment
HIPAA Self-Assessment
A seven-question readiness check with action-oriented guidance and clear next steps.
Governance
Entity Determination Tool
Determine whether you operate as a covered entity, business associate, hybrid entity, or vendor.
Map your exposure
Trace how patient data moves and where your infrastructure breaks down.
Visibility
ePHI Data Flow Mapper
Map how patient data moves across vendors, devices, staff, and systems before something leaks.
Operations
HIPAA Compliance Roadmap
A step-by-step operational checklist designed to replace checkbox guidance with real work.
Infrastructure
Secure Infrastructure Checklist
A technical baseline for hardening storage, devices, networks, and recovery readiness.
Quantify the damage
Estimate what a breach would actually cost your practice.
Stay informed
Live breach intelligence, news, and security awareness.
Intelligence
Breach Dashboard
A crawlable breach intelligence view with trends, severity framing, and HHS-context storytelling.
Response
HIPAA Response
Operational responses paired with HIPAA Pulse breach reporting — controls, configurations, and platform actions for each story.
Mobile
Patient Protect Signal
The free iOS app that packages breach intelligence, tools, and awareness for small practices.
Newsletter
HIPAA Pulse Newsletter
Biweekly email digest of the most important breach, enforcement, and regulatory developments. Free, double opt-in, no upsell. Subscribe on any /hipaa-pulse page or in the footer.
Train your workforce
Role-specific HIPAA training that meets the §164.530(b) standard.
Reference the rules
Definitions, regulatory citations, and research you can cite.
Definitions
HIPAA Glossary — 203 Terms
203 HIPAA terms with definitions, regulatory citations, and cross-references. Schema.org DefinedTermSet markup for AI extraction. Bookmark for compliance reviews and BAA negotiations.
Research
Patient Protect Research
Two SSRN working papers on healthcare breach economics — The Cyber-Economic Stack and The Economics of ePHI Exposure — plus quarterly state-of-compliance reports.
Open data and open source
Citable datasets, reference data on GitHub, and an MIT-licensed browser extension. Free to fork, query, or cite.
Extension
HIPAA Shield — Browser Extension
Open-source Chromium extension that warns when PHI is being typed into a browser form — especially AI chat tools like ChatGPT, Claude, and Gemini. 100% client-side, MIT licensed, no telemetry.
Open Data
hipaa-toolkit on GitHub
Open-source HIPAA reference data under CC BY 4.0: 203-term glossary (CSV + JSON), 40+ acronyms, the 18 PHI identifiers, 50-state breach notification quick reference, and four operational templates (BAA, NPP, IRP, Risk Analysis).
Dataset
Healthcare Breach Dataset
Citable CC BY 4.0 dataset of US healthcare breaches sourced from the HHS OCR Breach Portal with editorial enrichment. CSV + JSON formats, Schema.org Dataset metadata, formal citation format. For researchers, journalists, and AI search engines.
From free tools to a running program
Ready to start the real work?
The 21 free resources above show you where you stand. The paid Patient Protect platform runs the active security and infrastructure work most compliance vendors don't — continuous configuration monitoring, BAA scope enforcement, workforce access controls, breach simulation, and incident response. That is the work that actually closes exposure. From $39/month.
14-day free trial · Credit card required · Cancel any time