Index · Zephyrlatch

Get my fixed price Call (631) 275-9247

Spec A0 · About · Northport, NY

Zephyr latch

/ˈzef·ər·latʃ/ · noun · a HIPAA security shop with three services and one rule about invoices

We check whether the doors in your practice actually stay shut — then write it down in plain English and bill you after you’ve read it.

Zephyrlatch is a small security consultancy for dental offices and therapy practices that don’t have a security team and aren’t about to hire one. We do risk assessments, phishing simulations and remediation roadmaps — nothing else. This page is the reasoning behind the prices, the rules, and the things we deliberately refuse to sell you.

Price my practice Read the house rules
Technical drawing of a gate latch: a wind gust from the left, a bar pivoting on a door and resting in a keeper on the post, with the gap between door and post dimensioned. DWG-01 · LATCH, SIDE SCALE · NTS ZEPHYR → DOOR POST A B C

A latch won’t stop someone with a crowbar. It stops the door swinging open on its own. Most small-practice breaches are the second kind.

  1. AThe bar — the fix you actually make. Usually small, often dull.
  2. BThe keeper — the policy that holds the fix in place after we’ve gone.
  3. CThe gap — what we measure. That measurement is the risk assessment.

Spec A1 · Why it exists

Because “has anyone checked?” kept getting a shrug.

Small practices get sold security the way they get sold extended warranties: a monthly fee, a dashboard nobody logs into, and a vague sense of being covered. Ask the office manager whether anyone has actually looked at the front-desk logins and the answer is usually a pause. Zephyrlatch exists to fill that pause — once, properly, for a number you know before we start.

Decision 01 · Pricing

Why every job has a fixed fee

Hourly billing pays a consultant to find more things to talk about. A fixed fee pays us to be efficient and clear, which is what you wanted in the first place. The trade-off sits on our side of the table: if your office takes longer to assess than we guessed, that’s our problem, not a surprise line on your invoice.

The one exception, stated plainly: if the job turns into a different job — a second location, forty staff instead of twelve — we stop and re-quote in writing before going further. You say yes or no. Nothing gets discovered on the invoice.

Margin noteThe SRA is $1,740 per location up to 15 staff. It was $1,740 before you filled in a form and it stays $1,740 after.

Decision 02 · Method

Why we work over video

Driving to every practice would roughly double the price and add very little a phone camera can’t show us. So someone on your staff walks us through the office for thirty minutes — server closet, X-ray PC, front desk, the fax machine everyone pretends is decommissioned.

The honest cost: we can’t catch what nobody points the camera at. That’s why you get a shot list before the walkthrough, not a cheerful “just show us around.”

Margin noteTherapy practices that are entirely telehealth often skip the walkthrough and just screenshare their setup.

Decision 03 · Billing

Why the invoice arrives last

You shouldn’t pay for a report you haven’t read. Deliver first, invoice second, net 30 — that order doesn’t change for anyone, including practices we’ve never met.

It also keeps us honest in a way a contract clause can’t. If the readout call goes badly, we haven’t been paid yet, and we’d very much like to be. Corrections happen before billing, not in a dispute afterward.

Margin noteInvoices are payable by card, ACH or paper check. Yes, people still mail checks. We cash them.

Decision 04 · Focus

Why only dental and therapy

Narrow on purpose. Dental offices and therapy practices share the same shape of risk: a handful of staff, a practice-management system, imaging or telehealth software, a part-time IT helper, and patient records that are deeply personal. Knowing that shape well is what makes a fixed price possible.

A hospital, a multi-site group or anyone with an in-house security team would be better served by someone else. We’ll tell you so on the first email.

Margin noteDentrix, Eaglesoft, Open Dental, SimplePractice, TherapyNotes — we already know where those keep their settings.

Spec A2 · House rules

The rules, and what each one costs us

Anyone can publish values. We’d rather publish the rules and the price tag attached to keeping them. If a rule didn’t cost us anything, it wouldn’t be worth writing down.

Ledger · Operating rules Rev. Oct 2026 · applies to every engagement
Zephyrlatch house rules, the reason for each, and the trade-off we accept by keeping it
RefRuleWhyWhat it costs us
HR-01 BAA signed before we see a single login. We will see screens with patient data on them. That needs paper first, not a handshake. A few days at the start of most jobs, waiting on signatures and the occasional attorney.
HR-02 The invoice follows the report. You judge the work before you pay for it. We carry every job for weeks before seeing a dollar.
HR-03 We resell nothing. A roadmap that recommends a firewall we earn commission on is a sales pitch with a cover page. All referral and reseller income. Vendors do ask. We say no.
HR-04 We don’t do the fixes. Grading our own homework would make every finding suspicious. The recurring IT work — which is where the steady money in this field lives.
HR-05 Phishing results by role, not by name. The goal is staff who spot the next one, not staff who hide that they clicked. Some owners want names. They can have them — but they have to ask in writing.
HR-06 We say so when you don’t need us. The free HHS SRA Tool is genuinely fine for some practices with time on their hands. Jobs. Obviously.
HR-07 No “HIPAA certified” badge. There’s no such certification. Anyone selling you one sold you a PDF. Nothing to frame for your waiting room, which apparently some people really want.

If we ever break one of these on your job, point at this page. That’s what it’s here for.

Spec A3 · Get a number

Read enough? Ask for the price.

Three fields and a sentence. You’ll get one email back within one business day: a fixed price, what it covers, what it doesn’t — or a polite note saying the free tool will do.

  • SRA · $1,740
  • Phishing · $685
  • Roadmap · $1,190
  • SRA + Roadmap · $2,380
Form · Quote request · about.html Reply within 1 business day
No patient information, please. We never need it to quote you.

Sending this commits you to nothing. It starts an email thread, not a sales sequence.

Spec A4 · The office

One desk on Sound Road. Zero patient files.

Overhead view of a minimal desk by a window: a laptop with a webcam on a video call, a legal pad with a checklist, and a locked filing cabinet

Data handling · in writing

We keep notes. You keep the data.

  • We never copy your patient records, export a chart, or ask for a database backup.
  • Any screenshot that catches PHI on screen gets deleted the day your final report ships.
  • Temporary access you grant for the assessment gets revoked at the readout — we’ll watch you do it.
  • Working files sit on encrypted drives at 15 Sound Road, Northport, NY 11768. Nowhere else.

Spec A5 · Fit check

What we are. And the longer list of what we aren’t.

The short list is why you might hire us. The long list is why you might not — and we’d rather you find that out here than three weeks in.

Column A · Is

Zephyrlatch is

  • A HIPAA risk-assessment shop for practices of up to 15 staff per location
  • Remote, by video and screenshare, from Northport, NY
  • Three services, each with a fixed price you see before saying yes
  • Reachable Mon–Fri, 9:30am–4:30pm, at (631) 275-9247

Column B · Isn’t

Zephyrlatch isn’t

  • Your IT companyWe write the fix list. Someone else holds the screwdriver.

  • A compliance-software subscriptionNo portal, no login, no monthly charge quietly renewing in March.

  • LawyersSecurity assessments, not legal advice. For breach notification questions, call counsel.

  • Penetration testersIf you genuinely need a pen test, we’ll say so and point you to the kind of firm that does them.

  • An after-hours hotlineMon–Fri, 9:30am–4:30pm, by design. If you’re mid-incident at 10pm, call your IT provider and your cyber insurer first.

Still reading? You’re probably exactly who this is for.

Get my fixed price See all three services