The October 2026 Brief · Lauderhill, FL
We audit, harden and train — remotely, on a fixed fee between $400 and $1,500, quoted in writing before a single setting changes. You come away with a report your managing partner can read on a Sunday, and a Microsoft 365 tenant an attacker would rather skip.
Scoping calls Mon–Fri, 11am–6pm Eastern
Finding 03 — Exchange Online
A mailbox rule quietly forwards anything containing “wire”, “settlement” or “lab results” to an outside Gmail address. Created 2:14 a.m., on a Saturday.
Closed on day three of hardening.
Large firms buy security teams. The office with one paralegal, two physicians and a shared front-desk login buys nothing — and that is precisely what the people reading your email are counting on.
Most small practices were never set up to be defended; they were set up to open on Monday. Someone created the Microsoft 365 account in a hurry, the managing partner got global admin “just in case”, and the receptionist’s password went on a sticky note so the locum could cover her lunch. None of it was careless. All of it is a door.
Thornbury & Hale exists to close those doors without turning your office into a construction site. We work from Lauderhill, FL, and almost entirely through a screen share: delegated access, logged and revoked, so nobody sits in your waiting room with a laptop and your clients never learn we were there.
An attacker doesn’t need your server. They need one partner’s password and a Friday afternoon.
— The premise of every engagement we run
We keep the work deliberately narrow. Three kinds of engagement, each with a written scope and a fixed fee, each ending in a document you can hand to your insurer, your bar counsel or your HIPAA privacy officer without translation.
And we write those documents for the person who signs the cheques. The first page is plain English: what we found, what it would cost you if left alone, and what to do first. The technical appendix follows for whoever keeps your machines running.
Pick the one that matches the worry. The price below is the price on the invoice; if your office needs more than the scope covers, we say so on the scoping call — never halfway through.
A considered read of the whole office: endpoints, backups, Microsoft 365, password habits, and the vendors who can reach your data. Measured against what the HIPAA Security Rule and your bar’s duty of technology competence actually ask — not against a vendor’s checklist.
The smallest useful look: forwarding rules, MFA coverage by user, who holds admin, and thirty days of sign-ins from places you’ve never been. Delivered as a four-page memo.
Scope the Inbox CheckA simulated campaign written in the voice of your real correspondents — e-filing notices, lab portals, insurers — then a live 45-minute session, and a second campaign thirty days later to see what stuck.
Schedule a campaignConditional Access, legacy authentication switched off, Defender policies, data-loss rules for SSNs and PHI, audit logs retained, and sharing defaults reined in — with a change log of every setting we touch.
Lock down the tenantSecurity work is a considered purchase, and it should be. These are the hesitations we hear most often, answered the way we would answer them on the phone.
No. Every engagement runs remotely through delegated admin access and the occasional scheduled screen share. You can watch the permissions we hold at any moment, and we remove them the day the report is delivered.
Measure it against one diverted settlement wire or one breach-notification letter to your patients. If the scoping call suggests the Inbox Check at $415 would cover your real risk, we’ll recommend that instead and tell you why.
We map every finding to the HIPAA Security Rule safeguards and to your duty of technology competence, so you have documented, reasonable steps on file. We don’t issue certificates — nobody honest can certify an office in a fortnight.
Good — keep them. We are a second pair of eyes, not a replacement. The technical appendix is written for your IT provider, and we’re glad to have them on the walkthrough call.
We stop the scheduled work and call you within the hour, with the containment steps to take first. The audit resumes once the immediate problem is closed.
Invoiced in two halves — at kickoff and on delivery of the report — payable by card or ACH. The fixed fee in your written quote doesn’t move.
Nobody walks your hallway or borrows a desk. Access is delegated, logged in your own tenant, and revoked the afternoon the report lands.
The most any engagement costs. Every project is fixed-scope and quoted in writing between $400 and $1,500.
Page one is for the partner or physician-owner, in plain English. The settings, screenshots and scripts follow for your IT provider.
If the number fits, the next step is twenty minutes on the phone.
Book the twenty-minute callNot testimonials — evidence. These are the places a small practice leaks, and every one of them is on the list we work through in an audit.
Every engagement follows the same order, whichever of the four you choose. You always know which page of the file we’re on.
Open your fileWe ask what you hold, who can reach it, and what keeps you up at night. Within two business days you have a fixed quote and a written scope.
Read-only wherever possible, a named guest administrator where not. Every permission we hold is visible to you in your own admin centre.
We work Mon–Fri, 11am–6pm, largely out of sight. You get one short mid-point note, and an immediate call if anything can’t wait.
A 45-minute video walkthrough with whoever signs and whoever maintains your systems, followed by the written report and appendix.
We remove our access and send written confirmation, so your file closes as cleanly as it opened.
Tell us what kind of practice you run and what prompted the enquiry. We reply within two business days with a time for the call — no sales sequence, no newsletter you didn’t ask for.