Practical security and compliance leadership for healthcare and regulated organizations.
HIPAA, HITRUST, SOC 2 and NIST CSF readiness, AI governance, fractional security leadership and managed IT, built around how your organization actually operates.
Most organizations don't lack effort.
They lack clear ownership, current evidence and a plan leadership can follow. Each engagement starts with the operating problem, then sets the right level of support.
Unclear exposure
A current risk assessment, prioritized risk register and 90-day roadmap.
Security BaselineFragmented evidence
Controls and evidence organized in one place, with named owners and a reporting rhythm.
Readiness & AdvisoryCustomers asking for SOC 2
A readiness plan, the controls and evidence auditors expect, and support through the audit.
Readiness & AdvisoryRemediation backlog
Approved fixes implemented, tracked and reported to leadership.
Security TransformationIT that nobody owns
Devices, accounts, backups and patching managed and monitored, with security built in from day one.
Managed ITUnmanaged AI and vendor risk
An AI inventory, clear rules for sensitive data, and vendor oversight.
Readiness, then Managed GRCNo accountable security owner
A named security leader who reports to executives and the board.
Fractional Security LeadershipThe right framework for your organization, not a one-size checklist.
Healthcare is our specialty, but the same approach works for any organization that handles sensitive data. We help you pick the framework your customers, regulators and funders actually expect, then build one program that can map to more than one.
HIPAA
Security risk assessments, safeguards, policies and business associate oversight.
HITRUST
Readiness reviews, control mapping and evidence preparation ahead of assessment.
SOC 2
Readiness, control design, evidence collection and auditor coordination for Type I and Type II.
NIST CSF
A maturity assessment and roadmap aligned to the NIST Cybersecurity Framework 2.0.
Your staff are already using AI. The question is whether sensitive data is safe when they do.
Clinicians, finance teams and administrators are adopting AI scribes, chat assistants and AI features built into the software you already pay for. Most organizations have no inventory of these tools, no rule for what data can go into them, and no review of the vendors behind them.
VitalPoint puts practical guardrails in place so your teams can use AI productively without creating a compliance problem.
The goal isn't to block AI. It's to know what's in use, decide what's allowed, and prove it to auditors, customers and your board.
- AI-use discovery and inventoryFind the AI tools and AI features already in use across departments and vendors.
- Acceptable-use policy for AIClear rules on which tools are approved and what information can and can't go into them.
- AI vendor risk and agreementsReview AI vendors for how they handle your data, and confirm the right agreements (including BAAs for PHI) are in place.
- Approval process for new toolsA simple intake path so new AI requests are reviewed before sensitive data is involved.
- Staff guidance and leadership reportingPlain-language training for staff and a clear view of AI risk for executives and the board.
Three phases, one accountable plan.
Assess
Find where you're exposed and what matters most, including where AI and vendors touch sensitive data.
Build
Assign owners, fix priority gaps, write policies that match how you operate, and organize evidence.
Lead
Keep the program and your IT running, with regular reporting to leadership and the board.
Every engagement assigns owners, tracks decisions and reports progress, so it never becomes another report on a shelf.
Focused assessments, sized to the question you need answered.
Not every organization needs a full baseline on day one. These targeted assessments give you a clear answer on a specific risk, and each one can roll into a larger engagement later.
Quick-Start Risk Snapshot
Contact us
- High-level review of your security and compliance posture
- Top risks ranked by business impact
- Short, plain-language summary for leadership
- Recommended next steps
Security Risk Assessment
Contact us
- Assessed against HIPAA, NIST CSF or SOC 2
- Gap analysis and documented findings
- Prioritized risk register
- Remediation recommendations
IT Vendor Transparency Assessment
Contact us
- Independent review of your outsourced IT provider
- Contracts, BAAs and service commitments
- Backups, patching, access and monitoring practices
- Clear findings to discuss with your provider
Vulnerability Scan & Phishing Test
Contact us
- External and internal vulnerability scanning
- Simulated phishing campaign for staff
- Results summary with fix priorities
- Available on its own or with any assessment
Pricing is scoped to your size and confirmed in a written proposal. Contact us to find the right fit.
Clear scope. Defined deliverables. A plan sized to your organization.
Start with an assessment, build your program over 12 months, then keep it running with an ongoing plan. Every engagement is scoped to your size and priorities, with pricing confirmed in a written proposal.
Security Baseline
Fixed fee
- Risk assessment against HIPAA, NIST CSF or SOC 2
- Microsoft 365 or Google Workspace security review
- AI-use discovery
- Risk register and 90-day roadmap
- Executive briefing
Readiness & Advisory
Scoped to your size
- Everything in the Baseline
- HIPAA, HITRUST, SOC 2 or NIST CSF readiness
- Compliance platform setup and administration
- Up to 30 policies and 10 procedures
- AI governance program
Security Transformation
Scoped to your size
- Everything in Readiness
- Dedicated remediation hours
- Expanded AI governance
- Independent penetration test and retest
- Quarterly board reporting
Baseline fees are fully credited toward a 12-month program signed within 60 days. Add-ons include vendor risk management, security awareness, incident response readiness, HITRUST assessment support, SOC 2 audit support and cloud security reviews (AWS, Azure or GCP).
IT support run by the people accountable for your security.
Most organizations have one company running their IT and another telling them it isn't compliant. VitalPoint can do both, so the way your systems are managed day to day matches the policies and evidence your auditors see.
- Help desk and user supportResponsive support for staff, plus onboarding and offboarding done the same way every time.
- Microsoft 365 and Google WorkspaceAccount, licensing, email security and access management, configured to your framework.
- Device management and patchingLaptops and mobile devices enrolled, encrypted and kept up to date.
- Endpoint protection and monitoringEDR and managed detection and response, with alerts tied to your incident response plan.
- Backup, recovery and networkTested backups, firewall and Wi-Fi management, and continuity plans that actually work.
- Audit-ready evidencePatch, backup and access reports produced as part of the service, ready for your next audit.
Organizations that carry sensitive data without a large security team.
Healthcare providers, agencies, nonprofits and the companies that serve them, typically with 50 to 1,000 employees.
Healthcare
Community health centers (FQHCs)
Clear ownership of IT and security, consistent access controls, and tested continuity plans.
Behavioral health and substance use providers
Program-wide policies, access controls and evidence that stand up to audits and funders, including records under rules stricter than HIPAA.
Long-term care, home care and senior living
Vendor oversight and practical safeguards for resident data across EHRs, vendors and mobile staff.
Health tech and business associates
HITRUST or SOC 2 readiness, evidence and security leadership that support sales, customer questionnaires and audits.
Beyond healthcare
Human services nonprofits
One security and compliance program across foster care, housing, health and education programs, with reporting boards and funders trust.
Government agencies and schools
Security programs aligned with the NIST Cybersecurity Framework, plus AI guidance for student and constituent data.
SaaS and professional services firms
SOC 2 readiness and the security program behind it, so customer security reviews stop stalling deals.
MSPs and technology partners
Independent governance and compliance ownership for your regulated clients, working alongside your team.
Senior security leadership, without the full-time hire.
David Saget, Founder and Principal Advisor, has spent more than 15 years in IT infrastructure, operations and leadership, much of it in healthcare. He has led work on HIPAA compliance, protecting patient information, third-party risk and HITRUST readiness, coordinating internal teams and technology providers toward one plan. He also helps organizations align with the NIST Cybersecurity Framework and prepare for SOC 2.
His technical background spans Microsoft 365, Entra, Intune, Purview, endpoint security, SIEM and MDR, and cloud governance. He can talk strategy with executives and settings with engineers.
Before founding VitalPoint, David led security and compliance coordination for a regional healthcare organization preparing for HITRUST, where responsibilities were spread across internal teams and several technology providers. The work established named owners for every control area, one prioritized remediation plan, repeatable policy reviews and consistent executive reporting.
Do you replace our IT provider?
Only if you want us to. VitalPoint can run your IT as your managed provider, or work alongside your current MSP and provide independent governance, compliance ownership and executive reporting.
Why not just buy a compliance platform?
Compliance platforms collect evidence. They don't decide which risks are acceptable, rewrite your policies, lead remediation or report to your board. That's the work we do, inside the tools you own.
Do you only work with healthcare?
No. Healthcare is our specialty, but we also help agencies, schools, nonprofits and service providers with NIST CSF and SOC 2.
Which framework do we need?
It depends on who's asking. Customers usually ask for SOC 2, regulators and funders often point to NIST CSF, and covered entities need HIPAA. The Security Baseline tells you which applies.
Not sure where to start?
In 45 minutes we'll confirm your priorities, find where evidence, ownership, IT or AI use is breaking down, and agree on the right first step.
- A written summary within 24 hours
- A recommended starting point and a written proposal
- Please don't include patient, client or other sensitive information in your first message.