Independent guidance for the moments a bigger firm can't reach.
Fractional advisory, subject-matter consulting, and ready-to-use compliance templates for healthcare and health-tech organizations working through HITRUST, SOC 2, HIPAA, and the frameworks around them.
Coverage determination, risk analysis, policies and patient documents for medspas, hormone and weight-loss clinics, direct primary care and independent NP practices.
From $3,500, with a $750 entry session
Compliance Templates
Downloadable operational templates: trackers, logs, and response tools built to plug into whatever program you're already running.
See the Templates page
Free download
HIPAA Readiness Checklist
Thirty yes-or-no questions that show where a small practice, medspa or health-tech team stands, and which gaps regulators and insurers ask about first. Two pages, about 15 minutes, with a scoring guide.
Check your inbox
The checklist is on its way. You can also download it now.
Medspas, hormone and weight-loss clinics, direct primary care and independent NP practices all keep clinical records, and most have no compliance staff. Empyric builds the privacy and security program around them: a clear answer on which laws apply, a written risk analysis, right-sized policies, and a remediation plan your team can finish.
HIPAA applies to a health care provider that conducts standard electronic transactions with health plans, such as claims or eligibility checks. A strictly cash-pay clinic may fall outside it.
Wisconsin's patient records law applies either way. Under Wis. Stat. 146.82, records prepared by or under the supervision of a licensed nurse, nurse practitioner, physician assistant or physician are confidential, and patients can recover damages and attorney fees when that confidentiality is breached.
Every engagement begins by settling which rules apply to your clinic. The program is then built to the HIPAA Security Rule, the standard regulators, insurers and courts already recognize.
Self-test: does HIPAA apply to your clinic?
Six questions. A screening tool, not a legal determination.
General information for screening purposes, not legal advice. Coverage questions that remain unclear should go to your healthcare attorney.
Where patient data leaks in a typical small practice
Most clinics run on tools chosen for booking, payments and marketing. These are the places a risk analysis finds trouble first.
Booking and intake apps
Health questionnaires collected in a consumer booking platform with no business associate agreement.
Email and texting
Lab results, photos and visit details sent from personal accounts and cell phones.
Before-and-after photos
Full-face images on personal phones, synced to personal cloud storage, posted without written authorization.
Hormone and weight-loss labs
Results arriving by fax, email or vendor portal and saved to desktops outside the chart.
Prescribing and pharmacy portals
Shared logins, including for controlled substances such as testosterone.
Staff turnover
Accounts left active after an injector or front desk employee leaves, with no training record on file.
Packages
Fixed fees, defined deliverables, and documents you keep. Start with the entry session or go straight to a build.
Start here: Coverage and Exposure Check
A 90-minute working session with the owner and lead clinician, then a two-page summary of which laws apply, your five largest exposures, and the right next step. The fee is credited toward any package below if you continue within 60 days.
$750Summary within 5 business days
Solo Practice
From $3,500
One clinician and up to 3 staff: an independent NP or PA, or a nurse injector working under a medical director
Coverage memo for HIPAA and Wisconsin law
Short-form risk analysis and system inventory
Ten essential policies
Photo consent and messaging consent, plus a Notice of Privacy Practices where HIPAA applies
Vendor and business associate agreement checklist
One-page incident card and a 90-day action list
Training for up to 3 people
2 to 3 weeks
Foundation
From $6,500
One location with more than one clinician, up to about 10 staff
Coverage memo for HIPAA and Wisconsin law
Inventory and data flow map of every system, device and vendor
Written security risk analysis with a scored risk register
About 20 policies sized for a small clinic
Notice of Privacy Practices, photo consent and messaging consent
Staff training with a signed attestation log
Breach playbook and a 30, 60 and 90-day remediation roadmap
4 to 6 weeks
Program Build
From $14,000
Multiple locations, 10 to 40 staff, or any clinic that bills insurance
Everything in Foundation
Technical safeguards review alongside your IT provider
Microsoft 365 or Google Workspace configuration review
External vulnerability scan and phishing simulation
Website, tracking pixel and online booking review
Tabletop exercise and an organized evidence binder
8 to 12 weeks
Outsourced privacy and security officer
From $750 a month
After any build package
Annual risk analysis refresh
Quarterly access and vendor reviews
Policy updates when rules change, including the pending Security Rule update
Review of new apps before staff adopt them
Incident line with a same-business-day response
12-month term
Fees within each range depend on locations, staff, systems and existing documentation. Payment plans are available for Solo Practice and Foundation. Nurse practitioners opening an independent practice under Wisconsin's APRN Modernization Act usually start with Solo Practice.
How an engagement runs
Kickoff and coverage call
Week 1. We confirm whether HIPAA, Wisconsin law or both apply, and who on your team owns what.
Inventory and data flow map
Weeks 1 to 2. Every system, device and vendor that touches patient information, including photos and labs.
Risk analysis and scoring
Weeks 2 to 4. A scored risk register that records what was considered, what was accepted, and why.
Policies, patient documents and training
Weeks 3 to 5. Documents written for how your clinic works, and a live session for staff.
Readout and remediation roadmap
Week 6. A prioritized plan with owners and cost estimates, delivered with every document in one place.
Built for
Medical spasNP-led aesthetics and wellness clinicsHormone and TRT clinicsWeight-loss and GLP-1 programsDirect primary care and concierge practicesIV therapy and integrative clinicsSolo injectors working under a medical directorPractices opening under Wisconsin's APRN Modernization Act
Questions owners ask
We're cash-pay. Do we still need this?
Possibly not for HIPAA, which is why the first step is confirming it. Wisconsin's records law applies to licensed clinicians regardless of how patients pay, and patients, insurers and future buyers of your practice will expect to see a documented program.
We offer only esthetic services. Does this apply to us?
Usually not in the same way. If no licensed nurse, nurse practitioner, physician assistant or physician prepares or supervises your client records, Wisconsin's health records law and HIPAA generally do not reach them. Client payment card and ID details still fall under Wisconsin's data breach law, and our templates cover the basics. Once you add a nurse injector or any medical service, the Solo Practice package fits.
Our EHR says it is HIPAA compliant. Isn't that enough?
The vendor is responsible for its own system. Your phones, email, photos, logins and vendor contracts remain yours, and the risk analysis is the first document regulators ask a clinic to produce after an incident.
Is there a HIPAA certification at the end?
There is no government-issued HIPAA certification. Empyric delivers an assessment and a documented program you can show an investigator, insurer or buyer, not a badge.
Do you replace our IT provider?
No. Empyric covers the risk analysis, policies, training, vendor agreements and patient documents. Your IT provider makes the technical changes, and we work with them on what the analysis finds.
Is this legal advice?
No. Empyric provides compliance consulting. Questions about coverage, contracts or practice ownership belong with your healthcare attorney, and we are glad to work alongside them.
Find out where your clinic stands
The Coverage and Exposure Check takes 90 minutes and costs $750, credited toward any package if you continue within 60 days.
Short, practitioner-level posts on the frameworks that actually come up, written for people who implement them rather than just cite them.
MedSpa
4 min read
Does HIPAA apply to your medspa? Start with how you get paid
Medspa owners tend to hear two confident answers: HIPAA covers everyone in healthcare, or HIPAA does not apply because the clinic is cash-pay. For a given clinic, either one can be wrong.
HIPAA reaches a health care provider only when it transmits health information electronically in connection with a standard transaction. The common ones are claims, eligibility and benefit inquiries, claim status, prior authorization and referral requests, and remittance advice. A clinic that never conducts one of these, directly or through a billing service, may not be a covered entity at all.
Two details catch owners off guard. Coverage is all or nothing: a clinic that submits even occasional claims is a covered entity for all of the health information it holds, including records of patients who paid cash. And patient financing through a consumer lender is a credit arrangement, not a health plan transaction, so it does not settle the question either way.
Wisconsin law does not wait for a claim. Under Wis. Stat. 146.82, records prepared by or under the supervision of a licensed nurse, physician or physician assistant are confidential. Section 146.84 lets an injured patient recover actual damages, exemplary damages of up to $1,000 for a negligent violation or up to $25,000 for a knowing and willful one, plus attorney fees.
For most clinics that prescribe, the practical answer is the same: there is a legal duty to protect patient records either way, and the HIPAA Security Rule is the measure regulators, insurers and courts will apply. The takes two minutes.
Before-and-after photos: what to have on file before you post
Treatment photos are a medspa's strongest marketing and its most common privacy slip. A full-face photograph is one of the identifiers HIPAA names, and a treatment photo tied to a patient is a health care record under Wisconsin law.
Clinical photos and marketing photos need different permission. Treatment consent covers taking a photo for the chart. Posting it to social media, a website or an ad is a marketing use, which under HIPAA requires a separate written authorization and under Wisconsin law requires the patient's informed consent to the disclosure.
What belongs in the file before anything is posted:
A signed authorization naming the photos or treatment areas, where they may appear, and whether the face will be shown
An expiration date or event, and a plain statement of how to revoke
A statement that treatment does not depend on signing
A note that once posted, images may be copied or shared by others
A log tying each published image to its signed authorization
Where the photos live matters as much as the form. Images taken on personal phones sync to personal cloud accounts and leave with the employee. Use a clinic-controlled device or your EHR's photo feature, keep patient images out of personal camera rolls, and strip location data before publishing.
When a patient revokes, stop new uses right away and remove what you control. Empyric's photo consent and marketing authorization form is included in every .
Opening an independent NP practice under Act 17? Set up privacy on day one
Wisconsin's APRN Modernization Act took effect September 1, 2026. Nurse practitioners who meet its clinical-hour and experience requirements can apply to practice without a collaborative agreement. Independent practice is not automatic; it follows an application to the state.
Going independent also moves responsibility. Compliance work that a collaborating physician's practice may have carried, from the EHR contract to the breach plan, now sits with the nurse practitioner who owns the clinic.
Six things to put in place before the first patient:
Decide whether you will bill any insurance. It determines whether HIPAA applies, and Wisconsin's records law applies either way.
Choose an EHR and booking platform that will sign a business associate agreement, and keep health questions out of tools that will not.
Run business email and file storage on an account covered by a business associate agreement, not a personal one.
Have patient documents ready: Notice of Privacy Practices, photo consent and marketing authorization, and consent for texting and email.
If you prescribe testosterone or another controlled substance, protect e-prescribing with named accounts and multi-factor login.
Write a short risk analysis while the practice is small. It is the first document regulators ask for after an incident.
Empyric's Solo Practice package covers each of these, starting at $3,500. for details.
Scoping a HITRUST assessment without over-scoping your budget
The single most expensive mistake in a first HITRUST engagement usually isn't a failed control. It's a scope drawn too wide before anyone understood which systems actually touch covered information. A tighter, well-justified scope shortens the assessment, lowers the invoice, and still holds up under review, as long as the boundary logic is documented the way an assessor expects to see it.
The teams that get this right start with a data flow diagram, not a control checklist, and they draw the CSF scope line around systems, not departments.
SOC 2
5 min read
What a SOC 2 Type II observation period actually expects of you
A Type I report proves your controls exist on a given day. A Type II proves they held for the whole observation window, typically three to twelve months, and that difference changes what "ready" means. Evidence has to be collected continuously, not assembled retroactively, which means the operational habit matters more than the initial control design.
Startups moving from Type I to Type II underestimate this almost every time, and it's the single biggest driver of a delayed report.
HIPAA
6 min read
The HIPAA risk assessment isn't a form, it's a decision record
Most HIPAA risk assessments fail an audit not because the risks were wrong, but because the document reads like a checklist instead of a record of reasoning: what was considered, what was accepted, and why. An assessor doesn't just want the list of risks. They want to see that leadership actually made a decision about each one.
That distinction is the difference between a risk assessment that holds up and one that just exists.
Compliance templates
Built once, used repeatedly. Each template is a starting point: structured, framework-aligned, and ready to adapt to your environment.
Independent healthcare compliance advisory, built on a background of hands-on GRC, IT audit, and healthcare regulatory work.
Nicole Janko is a senior compliance leader with deep, hands-on experience across HITRUST, SOC 2, HIPAA, ISO, and NIST, the practical kind that comes from running engagements rather than just studying frameworks. Empyric Health Compliance is where that experience is available directly: short advisory calls, focused consulting engagements, and templates built from the same playbooks used on real programs.
Credentialed as a CISSP and CDPSE, a PCI Qualified Security Assessor, an ISO 27001 and ISO 42001 Lead Auditor, and a Certified HITRUST Quality Professional, active certifications backed by real audit and assessment work rather than exam prep alone.
hello@empyriccompliance.com
CertificationsCISSP · CDPSE · QSA · CHQP · ISO 27001 Lead Auditor · ISO 42001 Lead Auditor
FrameworksHITRUST · SOC 2 · HIPAA · ISO · NIST
EducationM.B.A., Project Management
UpcomingM.S., Clinical Health Informatics
Based inWisconsin
Privacy notice
Last updated [date]. How Empyric Health Compliance handles information collected through this website.
What we collect
When you request the readiness checklist, we collect your first name, email address, the type of organization you choose, and your consent to receive email. When you book a call, Microsoft Bookings collects the details you enter there. This site does not ask for patient or health information. Please do not send it through any form or email.
How we use it
We use it to send the checklist, to send occasional emails about healthcare compliance and Empyric's services, and to respond to your requests. We do not sell or rent your information.
Who processes it
Email is delivered through [email platform], which stores your address on our behalf. Templates are sold through Gumroad, and calls are scheduled through Microsoft Bookings. This site loads fonts from Google Fonts. Each provider handles data under its own privacy policy.
Your choices
Every email includes an unsubscribe link. To ask what information we hold about you, or to have it deleted, write to hello@empyriccompliance.com.
