From zero security posture to fully compliant in 90 days — LevoySec
A 12-person dental practice in the Southeast with two locations, running a mix of cloud-based practice management software and on-premise imaging systems. No dedicated IT staff — security was managed ad hoc by the office manager.
The practice faced a HIPAA audit notification and realized they had significant gaps:
Conducted a comprehensive risk assessment across both locations. Documented all systems, data flows, and existing controls. Identified 23 gaps requiring remediation.
Deployed MFA across all accounts, eliminated shared credentials, enabled disk encryption, and replaced the aging firewall with a managed security appliance.
Developed HIPAA-compliant security policies, deployed endpoint detection and response (EDR), configured 24/7 monitoring, and implemented automated patch management.
Delivered security awareness training to all staff with role-specific modules for front desk, clinical, and administrative teams. Included phishing simulation baseline.
Conducted internal audit, vulnerability scan, and tabletop incident response exercise. Compiled audit-ready documentation package.