Railyard Row guides independent clinics through HIPAA security risk assessments, phishing-resilience training and written remediation roadmaps — each a fixed fee, invoiced only once the deliverable is in your hands.
Thirty minutes, no charge. Or call (650) 274-5766, weekdays 9am–5pm.
Built for independent practices with two to twenty-five on staff.
Scored, signed and written in plain language. Delivered in about three weeks.
Three deliverables. You approve each one before an invoice is sent — never an hourly meter, never a retainer ticking in the background.
A dated, documented analysis of how electronic patient information moves through your clinic — every workstation, vendor and login — scored and signed. The written report arrives in about three weeks.
A forty-five-minute session at your reception desk or by video, then four weeks of simulated messages that teach your staff to pause before they click. You receive a completion record for every name.
Findings turned into a calm, sequenced plan — what to mend first, who owns it, roughly what it costs — in language a practice manager can act on without a translator.
Assessment, training and roadmap booked together. Each part is still invoiced only when its own deliverable arrives.
A railyard works because nothing leaves a platform until it is ready. We keep to the same discipline: a stop is finished, you review it, and only then does an invoice follow.
One consultant stays with your practice from the first walk-through to the last page of the roadmap.
We spend a morning in your clinic — or on video — tracing where patient information lives: the front-desk PC, the shared drive, the fax line nobody admits to, each vendor with a login. By evening there is a single map.
Nothing invoiced yet.
Interviews, configuration reviews and a scored risk register. You receive the signed assessment report, with every finding explained in plain sentences rather than acronyms.
Invoice: $3,850, after you receive the report.
The roadmap is written and handed over; the training cohort is scheduled for the week that suits your clinic’s rhythm. Each is billed when it lands, not before.
Invoices: $2,240 roadmap · $1,275 training.
Policies were written once, signed, and shelved. The clinic has since changed its software, its staff and its front-desk routine — yet the binder describes a practice that no longer exists.
We replace it with a living risk register that reflects the clinic as it runs today.
A convincing email arrives at 4:50 on a Friday, addressed to the person who handles billing. Most breaches begin as a courtesy extended to a stranger, not as a feat of technical wizardry.
We train the whole team to pause, and prove it with four weeks of simulated messages.
HIPAA expects the analysis to be kept current, not filed away. When the last one predates your newest system, a regulator’s first question is also the hardest to answer.
We date, sign and calendar the next review so it never drifts again.
Curious what a report reads like? Ask for the table of contents.
A clinic doesn’t need a taller fence. It needs to know where its gates are.— Said on every first call
Thirty minutes, no slides, no charge. You describe the practice; we tell you honestly which stop to begin at — and whether you need us at all.
Call (650) 274-5766Thirty minutes · Complimentary · Weekdays 9am–5pm
Notes left here are answered within one working day.
Weekdays 9am–5pm. A person answers; leave a message and it is returned the same working day.
Send a clinic type and a headcount and we will reply with a clear scope and a fixed fee.
631 Ofarrell St Apt 1002
San Francisco, CA 94109
Weekdays 9am–5pm, by appointment. On-site visits across San Francisco.
