Your staff already use AI. Nobody checked what patient data left the building.
I audit that first. Then I show you, with your own numbers, where AI actually pays you back.
For owner-run hormone, aesthetic, regenerative and weight-loss clinics in metro Pittsburgh. The risk score takes three minutes. No call required.
A note like this one, pasted into a free AI tool by a well-meaning staff member, is something your attorney has to assess as a possible breach. The patient and the note are invented.
Who this is for
Private-pay clinics have no insurance payer, a monthly recurring program, and a small back office. Nobody in that office owns automation or the vendor agreements. That gap is what I work on.
- Practice type
- Hormone and TRT, pellets, medical weight loss and GLP-1, aesthetics and med spa, regenerative and PRP.
- Size
- Owner-operated. One to eight locations. No IT department.
- Where
- Metro Pittsburgh. The discovery session is on site. The walkthrough is on site or a call, your choice.
- Not a fit
- Insurance-billed practices, hospital systems, and anyone who wants a chatbot on the website and nothing else.
Why this year, not next
- Staff are already doing it. In a January 2026 survey of 518 healthcare professionals, more than 40% knew a colleague using AI tools the organization never approved. Of the people using those tools, 17% said identifiable patient data goes in "sometimes or often". Only 17% of administrators could name their organization's AI policies. Wolters Kluwer Health, Shadow AI report, fielded December 2025.
- The enforcement is already here. Since October 2024, OCR, the HHS office that enforces HIPAA, settled 14 cases under its Risk Analysis Initiative, from $10,000 to $350,000. One was a small neurology practice at $25,000. Every one cited a missing risk analysis. Each came with a two-year corrective plan. The proposed Security Rule rewrite would add a written inventory of every technology that touches patient data, AI included. Final action is now scheduled for July 2027. HHS OCR press releases, October 2024 to June 2026. Federal Register, January 6, 2025.
- Pennsylvania is watching. In May 2026 the Pennsylvania Department of State sued an AI chatbot company under the Medical Practice Act. The company's bot presented itself as a psychiatrist with a fake license. A chatbot disclosure bill passed the state Senate 49 to 1 in March 2026. Commonwealth v. Character Technologies, filed May 1, 2026. Senate Bill 1090.
None of this is a reason to panic. It is a reason to have a policy, a vendor list, and a signed agreement before someone else asks for them.
What a weekend costs you
A form filled at 9 PM on Saturday waits until Monday. You already paid for that lead. Put your own numbers in. The arithmetic is shown so your CPA can check it.
The AI & Compliance Assessment
One recorded discovery session with you and your clinic director. Ten business days later you hold a scored report you can act on with or without me.
There is no free discovery call. The assessment is the discovery. I am paid for the diagnosis, whatever it says.
What you receive
- Shadow AI audit. Which tools your staff use, what went into them, which vendors have AI switched on, and which have no Business Associate Agreement.
- A written AI use policy and a one-page staff briefing. Hand it out the same week.
- The OCR first-request checklist. The eight documents OCR asks a practice for first, each marked present or missing. You see the gap before OCR does.
- Scored findings. Every problem you raise, scored on money, staff time, patient experience and PHI (protected health information) exposure. Every dollar figure shows its inputs.
- A 90-day roadmap with the lowest-risk, highest-return work first. Nothing in the first 60 days opens a chart.
- A walkthrough, on site or by call, and a short summary video for the partner, spouse or CPA who was not in the room.
- Two options on the last page. Run it yourself, or have me run it. Both are real.
$1,500 one location
$2,500 two to eight locations
The assessment starts with that call. If you are not a fit, I say so on the call.
If, after the walkthrough, you feel the report was not worth the fee, say so and I refund it. The report stays yours. If you hire me to build it, the fee is credited to your first month.
What a findings page looks like
From the sample report I built for a fictional six-site clinic. Names and numbers are invented. The structure is exactly what you get.
Scroll sideways to see all five columns.
| Finding, in the owner's words | Outcome | Exposure | Annual value | Effort |
|---|---|---|---|---|
| "That's 940 people who already trusted us." No one contacts lapsed patients. | Money | Aggregate | $92,800 | Low |
| 370 pellet re-doses went missing last year. Nobody tracks who is overdue. | Money | Aggregate | $66,600 | Low |
| A Saturday 9 PM inquiry waits until Monday. $22,000 a month buys those leads. | Money | None | $158,050 | Low |
| 18 missed calls a day. "We don't text at all." | Money | None | $89,900 | Low |
| Providers write notes after hours, 7 to 8 minutes per patient. | Time | PHI | $36,750 | Medium |
| Patient details flow into two vendors with no BAA. Staff use free AI tools. No policy. | Quality | PHI | Risk | Low |
| Three smaller findings: no-shows, intake retyping, the owner's site report. | Mixed | Aggregate | $92,496 | Mixed |
| Less 15% where the funnel plays overlap | −$48,370 | |||
| Total projected annual value | $488,226 | |||
Every figure in the real report carries its arithmetic. Example: 940 lapsed × 85% reachable × 8% return × $1,450 = $92,800. Change any input and I re-run it.
How it works
Fit call, 15 minutes
You tell me the practice, the sites, and the one thing you would fix. I tell you whether the assessment will pay. We pick a date. No pitch.
Discovery session, 60 to 90 minutes, recorded
On site with you and your director. I follow the money and the pain. I ask for numbers, because a finding without a number cannot be priced. No patient records are opened.
Report and walkthrough, within 10 business days
You get the scored report, the policy, the roadmap, and a video for whoever was not in the room. We walk it together. Then you choose one of two paths.
What gets built, if you choose path two
Six plays come out of the sample report. Three use no patient data at all. Two use names and appointment dates, which HIPAA still protects, so they run inside the systems you already hold agreements for. One opens the chart, and it goes last.
A Monday list of who is due, and a text-then-call sequence with the exact talking point for the front desk.
Counts and contact details only. The largest priority in the sample report.Any hour. Real booking links for the right site. A human takes over on any clinical question.
No patient data. This runs before someone becomes a patient.Your phone system can probably already do this. Nobody switched it on.
No patient data.Two-way replies. A same-day fill list per site. No-show rate measured weekly.
Appointment data only.Every site, one page, built from your systems with no human assembly.
Aggregate only.The provider reviews and signs every note. Built last, and only after the agreements are signed. If any agreement is missing, I do not build it.
PHI. Requires a signed BAA with me and with the model vendor.Three ways to have it run
Quoted monthly. Six-month term. Cancel with 30 days' notice. The assessment fee is credited to month one.
Build
$3,000 a month
- The top three no-PHI plays from your report, built and running
- Monthly numbers, with the real result next to the projection
- Policy and staff briefing kept current
Build and operate
$4,500 a month
- Every no-PHI play in your report
- Weekly numbers and a monthly 30-minute review with you
- One staff training session per quarter
- The owner's Monday report across all sites
Whole practice
$6,000 a month
- Everything in Build and operate
- PHI workflows under signed agreements: note drafting, intake
- Quarterly compliance review with a written memo
- Up to eight sites
Where your patient data goes. In writing, before we start.
The moment I handle patient information for you, I am a business associate under HIPAA. I carry my own obligations. So every workflow gets one of three architectures, named in the report.
No patient data leaves your systems
I move only counts and totals. "412 patients are overdue." The AI never sees a person. Every engagement starts here. In the sample report, most of the projected value sits here.
Patient data stays inside a signed boundary
Where a workflow needs records, it runs inside a vendor that has signed a Business Associate Agreement with me. You see which one, in writing, first.
De-identify, then process
All eighteen identifier categories stripped before anything leaves. The key stays in your clinic. Used only when the first two do not fit.
Never allowed: a consumer chat product with no agreement. I do not put your patient data in a public AI tool, for a demo, for a test, or ever. I am not an attorney. The report tells you which agreements to ask your healthcare attorney for.
Why a clinic owner should listen to me
I run the technology for a Pittsburgh restaurant group with more than a dozen locations. Point-of-sale, phone, scheduling, reporting, the integrations between them, and the nightly checks that tell me before the owner does when something broke. Multi-site, owner-operated, cash-driven. Your clinic has the same shape.
I do not sell software. I have no partner deals with any vendor. If your phone system can already text back a missed call, the report says so and you pay nothing for that finding.
I write every number with its inputs, because the person who decides may be the CPA who was not on the call.
Max Baron, founder of Trigger Flow. Pittsburgh, PA.
Questions to ask before you book
Is this HIPAA safe?
Nothing in the first 60 days opens a chart. That is deliberate. Where a later workflow needs records, it runs inside a signed agreement, or it does not run. The report names the architecture for every finding.
Do you need access to our EMR to do the assessment?
No. The assessment runs on the numbers you give me in the discovery session: patient counts, inquiry volume, conversion rates, staff time. I ask which EMR, phone and scheduling systems you use and whether they can export data. I do not open a chart.
Why is there no free consultation?
A free call has to end in a pitch, or it was a waste of both our time. A paid assessment can end in "do this yourself" and still be worth it to you.
We tried a marketing agency and it did not work. How is this different?
They sent you more leads. You answered them the same way. I fix the answering, the follow-up, and the patients who already left. No new ad spend is in the plan.
Our IT provider says they can do this.
Maybe. Five of the six plays never open a chart, and the report is detailed enough to hand them. Ask them for a timeline and a price. Then compare it with mine.
What if the numbers look too high?
Remove the whole under-five-minute reply play. In the sample report that still leaves about $354,000 against the fictional owner's $420,000 goal, after the overlap deduction is recomputed. Every figure is labelled a projection and shows its inputs. I never write "you will save."
What happens to our data during the retainer?
We sign a Business Associate Agreement before any patient information moves. I keep client work in separate, encrypted, access-logged storage. Never on a laptop, never in a screenshot, never in a prompt to a public tool.
Can we start with something smaller?
Yes. The AI Policy Kit is $197: a clinic AI use policy, a staff briefing, a vendor agreement checklist and a recorded walkthrough. Buy the assessment within 30 days and the $197 comes off the price.
Start with the three-minute risk score
Ten questions. You get a score, your three highest-exposure answers, and the AI use policy template to hand your staff this week.
- Get your Shadow AI Risk Score. Free. Three minutes.
- Buy the AI Policy Kit, $197. Credited toward the assessment.
- Book the 15-minute fit call for the $1,500 assessment.