Manage HIPAA compliance across your healthcare clients.
Patient Protect gives a managed service provider somewhere to put the recurring compliance work for every healthcare location it supports: onboarding an office, assigning and evidencing workforce training, publishing policies, working remediation as a queue, tracking business associates, and producing evidence when somebody asks for it.
The recurring work, per location.
Onboarding a location
Stand up the office, inventory what touches patient information, and establish where it actually stands rather than where the last binder said it stood.
Workforce training
Assign, track and evidence training for every person at the office, including the ones who joined after the annual session.
Policies and acknowledgements
Publish the policies the office operates under and capture who read them and when.
Risk and remediation
Work the findings as a queue with owners and dates, so remediation is a record rather than a recollection.
Vendor oversight
Track the business associates an office depends on and what agreement covers each of them.
Evidence and reviews
Produce what the office would need if somebody asked, and revisit it on a cadence instead of at renewal.
Your obligations as a business associate are a separate matter from the work you perform for a client. The glossary covers where that line falls, and the BAA red flags piece covers what the agreement has to carry.
Three ways providers package it.
Illustrative, and deliberately without figures. What you charge is yours to decide; what follows is how the components fit together.
Readiness and onboarding
One engagement per location
- Baseline assessment of the office
- Systems and vendor inventory
- Policy set published and acknowledged
- Initial workforce training assigned
Office subscription + your onboarding fee
Managed compliance
Monthly, per location
- Training assignments and completion tracking
- Remediation queue worked with owners
- Vendor and agreement changes recorded
- Recurring office review with evidence
Office subscription + portfolio administration
Partner-enhanced program
Monthly, per participating location
- Everything in managed compliance
- Your own training curriculum published to the office
- Your policies and recommendations
- Your intake and referral forms
Office subscription + administration + your paid offering
Partner customization requires an approved paid offering for each participating office. Administration access alone does not include these capabilities.
Every physical location keeps its own Patient Protect subscription. Shared ownership, a single covered entity or centralized administration does not make six locations one subscription.
What providers ask first.
- Do I need a separate subscription for every client location?
- Yes. Every physical location keeps its own Patient Protect subscription, its own account and its own direct relationship with us. Shared ownership or centralized administration does not combine them. Multi-location arrangements are quoted individually.
- Can one company be both an MSP and a reseller?
- Yes, and most are. Managed service provider and value-added reseller are overlapping business roles rather than account types. Reseller status by itself grants no access to patient information and no administrative rights — access comes from the authorization an office gives you.
- Can I publish my own training, policies and forms into client offices?
- Yes, through partner customization. It requires an approved paid offering for each participating office; administration access alone does not include it. The office's own plan still applies underneath — digital forms need Pro, and customization does not upgrade an office on Basic.
- What happens to the office if the partner arrangement ends?
- The office keeps its account, its completed records, prior form submissions and the document copies it adopted, under its own terms with us. What stops is future authoring, publishing and distribution of your customized material into it. Your own reusable library remains yours.
- Who is responsible for the client's compliance?
- The practice is. It is the covered entity, and the obligations are its own. What you provide is the service that carries the work; what we provide is the platform that records and organizes it. Your own obligations as a business associate are separate from the work you perform for the client.
Start with one client office.
Put a single location through it and the shape of the recurring work becomes obvious. Tell us what you manage and we will scope the arrangement around it.