Completion Is Not Protection: Why We Built the Patient Protect Score
The compliance industry sells completion percentages that answer one question: how much of a form did you fill out. The Patient Protect Score answers a different one — where does the practice actually stand.
The compliance industry sells completion percentages that answer one question: how much of a form did you fill out. The Patient Protect Score answers a different one — where does the practice actually stand.
Every HIPAA compliance vendor sells the same metric.
It looks like this: 87% complete.
The practice sees a green bar creeping toward 100. The vendor sees a happy customer. Everyone celebrates a number that answers exactly one question — how much of a form did you fill out — and none of the questions a practice owner actually needs answered.
We built the Patient Protect Score because completion and protection are two different things, and only one of them is the one that matters when OCR shows up.
The lie hidden in every completion percentage
Here is what a completion percentage does not tell you.
It does not tell you whether the practice provided enough information for the assessment to be meaningful. Someone rushing through a form with vague answers hits the same 100% as someone who mapped every workforce member, every system, and every vendor.
It does not tell you whether the completed work produced a strong or weak security result. A finished Security Risk Assessment can reveal three critical vulnerabilities and still count as done. Green bar. Full credit.
It does not distinguish a program with unfinished work from a completed program with serious unresolved findings. Both look identical on the dashboard.
The industry has trained healthcare practices to feel accomplished at the wrong moment. Practices celebrate completion when they should be asking what did completion actually give us?
That's the question we set out to answer.
One score, three distinct questions
The Patient Protect Score is a live diagnostic. It combines three component scores, each answering a question the industry has quietly stopped asking.
1. Is the practice mapped?
The Setup Score measures whether Patient Protect has the operational information required to understand the practice. Workforce. IT systems. Risk analytics. Administrative structure. The foundational inputs that make every downstream assessment possible.
A compliance system cannot evaluate what the practice has not represented inside it.
That sentence should be tattooed on every vendor's marketing site. Instead, most platforms let a practice run a Security Risk Assessment against a dangerously incomplete picture of itself and hand back a green score. Setup Score is our refusal to do that.
2. Has the work been completed?
The Compliance Score measures progress through the Security Risk Assessment and the related compliance work performed within Patient Protect.
This is the piece other platforms call "your compliance score" — the completion percentage. It matters. It just does not matter enough to carry the whole diagnostic on its own.
3. What did the work reveal?
The Security Score reflects the outcome. The vulnerabilities. The unresolved findings. The security conditions the assessment surfaced.
This is the part most compliance software either hides or averages into obscurity. A completed SRA can be a concerning SRA. A green Compliance Score can sit on top of a red Security result. Patient Protect keeps those separate on purpose.
Why we combine them
Each component tells a partial story.
A practice with strong Setup but no assessment progress has visibility without execution. It knows itself well enough to be evaluated but hasn't done the evaluation.
A practice with completed assessment work but a weak Security Score has knowledge without remediation. It knows exactly what's wrong and hasn't fixed it.
A practice with a promising Security Score but incomplete Setup may still have material blind spots. It looks fine because the parts it hasn't shown you don't count against it yet.
The total Patient Protect Score brings those conditions into one current view. The total is the headline. The component scores explain the diagnosis.
A low total caused by incomplete Setup is a different problem from a low total caused by unresolved Security findings. One needs better visibility. The other needs remediation. If a score doesn't show that difference, it's noise.
The snapshot and the live score
The free Patient Protect risk assessment produces a Score Snapshot based on the information supplied during the five-minute diagnostic.
The Snapshot is deliberately honest about what it is: an informed estimate from self-reported answers. It helps a practice see its likely posture, understand its exposure, and identify where to begin. It is not the same instrument as what runs inside the platform, and we say so.
Inside Patient Protect, the score becomes operational.
The Live Patient Protect Score reflects the practice's actual setup, real assessment progress, and the security findings identified through the platform. As the workforce changes, as vendors get added or reviewed, as risks close or open, the Live Score changes with them. That's the whole point of live.
A five-minute assessment can tell a practice where to start. A live score can tell it what changed.
We built both because both matter. The Snapshot is the invitation. The Live Score is the operating instrument.
The direction matters more than the number
A single score shows where a practice stands right now. The trend shows whether it is improving, stalled, or slipping.
That distinction is where compliance programs succeed or fail in the long run.
A practice at Score 62 improving steadily over 90 days is in a better place than a practice at Score 78 that has been stuck for a year. The point-in-time number tells you nothing about whether the work being performed is actually moving the program forward.
Patient Protect records that movement continuously. Every state change — a resolved risk, a completed training, an expired BAA, a new workforce member — updates the score in real time. The history is preserved with full granularity so a practice can see the effect of the work, not merely a checklist of completed tasks.
That's not a small technical distinction. It's the difference between HIPAA as an annual event and HIPAA as an operating discipline.
What the Score is not
We do not believe a proprietary score can certify a healthcare practice as HIPAA compliant.
HHS does not endorse private organizations' HIPAA Security Rule certifications. Private certification does not discharge an organization's legal obligations. And no dashboard, no matter how sophisticated, can guarantee that an incident or a violation cannot occur.
The Patient Protect Score is a diagnostic. It's the sharpest one we know how to build. It is not a shield, and it is not a promise. The obligations still belong to the practice. The score exists to help the practice see them clearly and act on them faster.
Anyone who tells you their proprietary score means you're safe is selling you a completion percentage in a different wrapper.
Why any of this matters
HIPAA is not going to get simpler. The obligations will keep multiplying. Vendors will keep selling completion percentages because they're easy to build and easy to sell. Threat actors will keep innovating faster than any annual assessment can capture. Independent practices — the ones without compliance departments, without dedicated IT staff, without internal counsel — will keep carrying the same regulatory weight as hospital systems and getting a fraction of the tooling to manage it.
The Patient Protect Score is our answer to that mismatch.
It gives an overwhelmed practice owner or office manager a useful operating signal. It compresses an enormous body of interconnected obligations into one number without erasing the reasons behind that number. It replaces how far through the form are we with where does the practice actually stand.
That is not a tagline. It is the whole thesis of the company distilled into a single instrument.
Know it. Raise it. Keep it current.
Related reading
If you have not read the companion essay, start with The Quiet Failure of HIPAA in Independent Practices. It describes the specific failure mode the Patient Protect Score is built to expose — work that lives in memory, binders, and email threads until something goes wrong. This piece is the instrument. That one is the diagnosis.
The full technical breakdown of the Score sits on the Patient Protect Score product page, including the three-component logic, snapshot vs. live distinction, trend visualization, and the guardrails on what the Score is and is not.
Frequently Asked Questions
What is the Patient Protect Score?
The Patient Protect Score is a live composite diagnostic of a healthcare practice's HIPAA program. It combines three component scores — Setup (visibility), Compliance (execution), and Security (exposure) — into one live operating signal for the current condition of the program.
How is the Snapshot different from the Live Score?
The Snapshot is the free public assessment result — an informed estimate based on self-reported answers, delivered in about five minutes. The Live Patient Protect Score runs inside the platform and reflects actual practice setup, assessment progress, and security findings, updating continuously as the workforce, systems, vendors, and risks change.
Is the Patient Protect Score a HIPAA certification?
No. It is a live diagnostic — a signal for the current condition of the program, not a legal opinion or a government-issued rating. HHS does not endorse private HIPAA compliance certifications, and no score can substitute for the legal obligations a practice carries under the Security Rule.
Why does Setup Score matter as much as Compliance and Security?
A compliance system cannot evaluate what the practice has not represented inside it. If the workforce, systems, vendors, or administrative structure are incomplete inside Patient Protect, then Compliance and Security scores derived from that incomplete picture are less meaningful. Setup Score answers whether the practice is visible enough for the rest of the evaluation to be trustworthy.
What should I do with a low Patient Protect Score?
Read the composition. A low score caused by incomplete Setup is a different problem from a low score caused by unresolved Security findings — one requires better visibility into the practice, the other requires remediation. The three-component breakdown tells you which lever to pull first.
Alexander Perrin is the founder and CEO of Patient Protect, a security-first HIPAA compliance platform built for independent healthcare practices. He writes about the operational reality of HIPAA compliance for practices that don't have compliance departments.