Question 1

Is this an audit?

Accepted Answer

No. It is the risk analysis that the Security Rule requires every covered entity and business associate to perform (45 CFR 164.308(a)(1)(ii)(A)). It is also the document an auditor asks for first.

Question 2

Do you need access to patient records?

Accepted Answer

No. Ward reads security configuration only. The access is read-only, scoped to settings, and your administrator grants and can revoke it. The attestation asks about safeguards and processes, never about patients.

Question 3

Will we pass an audit?

Accepted Answer

No one can promise that, and you should be wary of anyone who does. You get a signed analysis, evidence behind every finding, and a prioritized plan to close the gaps that matter.

Question 4

How is this different from compliance software?

Accepted Answer

Software gives you a questionnaire and a score. SaberGuard gives you a compliance expert who collects real configuration, writes and signs the findings, and stays available while you fix them.

Question 5

What happens after the report?

Accepted Answer

You get a remediation plan ordered by risk. SaberGuard can do the work through managed security, or hand the plan to your IT provider. Monitoring comes with the Managed Security and Fully Managed tiers and starts after the baseline risk analysis.

Question 6

What is Ward Agent, and do we log into it?

Accepted Answer

Ward Agent is SaberGuard's assessment platform. It collects security configuration from your Microsoft 365 or Google Workspace tenant, evaluates it against the Security Rule, and keeps doing so on a schedule on the Managed Security and Fully Managed tiers. You never log into it; you receive signed findings and an executive summary.

Question 7

What does SaberGuard cost?

Accepted Answer

Risk analysis is a fixed fee within a range set by practice size. Engineering and remediation projects and the Regulation S-P program are quoted as a fixed fee after a scoping call. Advisory is $175 per hour or on a monthly retainer. Managed security is $50, $90, or $165 per user per month by tier, plus one-time onboarding. The pricing page lists risk analysis, managed security, and advisory prices.

Question 8

How long does a risk analysis take?

Accepted Answer

Your team's part, granting read-only access and completing the attestation, takes under two hours. Collection, evaluation, and review follow, and the findings call is scheduled when the report is signed. Exact timing depends on practice size and platforms.

Question 9

We're not in healthcare. Does Massachusetts law still apply to us?

Accepted Answer

If you hold personal information about a Massachusetts resident (name plus SSN, driver's license, or financial account number), 201 CMR 17.03 requires a written information security program whether or not HIPAA applies. SaberGuard writes them.

Question 10

Do you replace legal counsel for breach notification decisions?

Accepted Answer

No. We provide technical findings, timeline support, containment guidance, and remediation evidence. Notification decisions belong with qualified healthcare privacy counsel.

Question 11

Can you implement the safeguards you recommend?

Accepted Answer

Yes. Microsoft 365 hardening, identity and MFA rollout, endpoint management and protection, email security, backup and recovery, security awareness training, and incident response planning, done by the same person who signed the report.

Question 12

Where are you located, and who do you work with?

Accepted Answer

SaberGuard is based in Central Massachusetts and works with medical, dental, and behavioral health practices and their business associates across the Commonwealth. Everything runs remotely; on-site visits are scheduled when a finding calls for one.

Questions we get before the first call

Bring your question to the scoping call.