Services · rate card · Bronx, NY

Not a product catalogue — three jobs, each with its price.

Name: Dovelio
Address: 2600 Netherland Ave, Bronx, NY, 10463, US
Telephone: (914) 523-3182

We don’t resell software and we don’t sell retainers. Dovelio does three things for independent clinics: write the risk analysis, move your logins to security keys, and teach the front desk what a phishing email looks like on a Tuesday. Each is a flat fee, quoted in writing before we start, invoiced once. The numbers below are the real ones.

Price my practice Call (914) 523-3182

01HIPAA security risk assessmentThe risk analysis the Security Rule asks for, finished and signed.10 business daysFrom $2,840
02Phishing-resistant MFA rolloutSecurity keys and passkeys on your EHR, email and remote access.2 half-days on siteFrom $1,960
03Staff security trainingLive, after close or on video, with a training record for your file.90 minutes live$640

The spec sheets

What’s in each job, and what isn’t

HIPAA security risk assessment

The risk analysis, finished

Book the walkthrough

Antique tintype-style photo of a hand-drawn clinic floor plan with a clipboard, pencil and router on a wooden desk

What we do: One 90-minute walk of your office: front desk, back office, the router in the supply closet. A ten-minute chat with each person who touches patient records. Then we map every place electronic patient data lives (the EHR, email, the scanner, the laptop someone takes home) and check each one against the Security Rule’s administrative, physical and technical safeguards.
What you get: A one-page ranked risk register your front desk can read
A full report mapped to the Security Rule, written for your practice manager
A fix list with a rough cost beside every line, free fixes included
A list of the business associate agreements you still need to chase
Thirty days of email follow-up after the report is signed
Covers: Up to 10 staff and 12 devices. Extra devices are $45 each; each person past 10 is $95.
Timeline: Ten business days from kickoff to signed report.
You bring: A staff list with roles, the name of your EHR and who administers it, a list of vendors that touch patient data, and someone who knows where the router lives.
Not included: Hands-on fixes after the report ($165 an hour, below)
Penetration testing
Legal advice, which is your attorney’s job

Phishing-resistant MFA rollout

Keys in hand, passwords stop mattering

Price my rollout

Antique tintype-style photo of a hand inserting a security key into a laptop at a clinic reception desk

What we do: Day one, we inventory every login that touches patient data. Day two, we move your EHR, email and remote access to FIDO2 security keys and passkeys, enrol each person at their own desk, and test the plan for the Monday someone loses a key on the subway.
What you get: Every person enrolled on a main key and a spare for the drawer
Password-only and text-code fallbacks switched off wherever the system allows
A break-glass procedure written for your office, with a sealed copy for the practice manager
A one-page cheat sheet for the front desk
Covers: Up to 10 staff. Keys are billed at cost, about $55 each, and we recommend two per person. Each person past 10 is $95 plus keys.
Timeline: Two half-days on site, about four hours each, usually booked within three weeks of signing. Evenings on request.
You bring: Admin access to your email domain and EHR for those two days, a staff list, and a chair for each person.
Limits: Some older EHRs can’t take security keys at all. We find out on the quote call, set the strongest option the system does support, and say so in writing.
Replacing your EHR or email provider

Staff security training

Ninety minutes your front desk will sit through

Schedule a session

Antique tintype-style photo of chairs arranged in a clinic waiting room facing one monitor, with a sign-in sheet in the foreground

What we do: Live, in your waiting room after close or over video. Real phishing from real clinics with the names taken off, the fax-and-voicemail tricks that target front desks, the stranger who follows someone through the back door, and the first ten minutes after somebody clicks.
What you get: A sign-in sheet and a training record for your compliance binder
A pocket card for the desk: “I clicked, now what”
The slides, if you want them, and nothing you have to log into
Covers: Up to 15 people. Daytime is $640; evening is $720. Staff past 15 get a second session at $640.
Timeline: Ninety minutes, and the training record is in your inbox by the next business day.
You bring: A room or a video link, a screen we can plug into, and everyone who answers the phone or opens the mail.
Not included: A simulated-phishing subscription. We don’t sell one.
An annual e-learning login nobody will open

The rate card · invoiced per engagement

Every number we’ll quote you, add-ons included

Dovelio rate card
Line item	Price
The three engagements
HIPAA security risk assessmentUp to 10 staff, 12 devices. Signed report in 10 business days.	From $2,840
Phishing-resistant MFA rolloutUp to 10 staff, two half-days on site, keys extra.	From $1,960
Staff security trainingUp to 15 people, 90 minutes, daytime.	$640
Add-ons, priced instead of guessed
Extra device in the assessmentPast the first 12.	$45
Each person past 10On an assessment or an MFA rollout.	$95
Security keysBilled at cost. We recommend two per person.	≈ $55
Evening training sessionInstead of daytime, up to 15 people.	$720
Second session for staff past 15Same week where we can.	$640
After the report
Written policy packSanction, device and contingency policies matched to your report.	$540
Hands-on fix helpTwo-hour minimum. Per hour, billed in half-hours after that.	$165
Annual refresh of your risk analysisFor practices we’ve assessed before.	$1,380

Request a fixed quote

Send the headcount, get a number back

Tell us the kind of practice, how many people work there and what you log into. We reply by the next business day with a one-page scope and a flat price, or with a straight “this isn’t our kind of job.”

Asking costs nothing, and nobody calls you six times
The quote lists every line, add-ons from the rate card above
Evenings by appointment if the schedule is full

(914) 523-3182

Which job, and for how many people?

Your details go to info@doveliocybersecurity.com and nowhere else.

Questions about the price tag

Why flat, why “from,” and what we won’t do

Short answers, in the order people ask them on the first call.

Ask us yours

Why a flat fee, not hourly?

Hourly billing means you can’t budget and we’re tempted to wander. A flat fee is quoted in writing after a fifteen-minute call. If the scope grows because we missed something, we absorb it. If it grows because you added devices or people, the per-unit price is on this page.

What does “from” actually mean?

It’s the price for a practice of up to 10 staff. A bigger office picks up the add-on lines in the rate card, and the quote spells out every one before you approve anything.

Can we buy just one of the three?

Yes. Most practices start with the assessment because it ranks what matters. If stolen passwords are your only worry, start with the MFA rollout and skip the rest until you need it.

Does this make us “HIPAA compliant”?

No, and nobody can sell you that. The assessment gives you the written risk analysis the Security Rule requires, plus a fix list to work through. Compliance is something your practice keeps doing. None of this is legal advice.

Do you do pen testing or incident response?

No. We’re a small firm with no 24/7 operations center. If you’re breached, call your attorney and your cyber insurer first. What we can hand you afterwards is the paper trail showing you did the work beforehand.