We Find Your Gaps Before the Auditors, or the Hackers, Do.
And we do it with CLASse.
Your EHR vendor doesn't handle compliance. Your IT person doesn't know HIPAA law. Your AI scribe tools might be leaking patient data. That's where I come in.
Most small practices don't know what compliance gaps they have — not because they're careless, but because nobody ever showed them. That changes here.
You run a small practice. You've got patients, staff, and a growing pile of technology — but no idea whether any of it is compliant. That fog is your biggest liability.
Most OCR fines and data breaches don't hit organizations that tried and failed. They hit organizations that never checked. The Risk Snapshot is designed for practices with 1–10 employees who need to know exactly where they stand — fast, affordably, and without a long-term commitment.
You choose the audit tool that fits your situation — HIPAA for healthcare practices, ISO 27001 for security framework, or ISO 42001 for AI governance. We review your results during a 30-minute onsite visit, check your M365 and Apple security posture, and deliver a clear priority matrix within 2–3 business days. No jargon. No scare tactics. Just clarity.
Full Security Risk Analysis covering all administrative, physical, and technical safeguards. Required by law. Your primary defense against OCR audits and breach liability.
Running AI scheduling tools, scribes, or clinical decision support? ISO 42001 ensures your AI systems meet HIPAA-aligned standards before they become a liability.
Ongoing security leadership without a full-time hire. Quarterly reviews, policy maintenance, regulatory change monitoring, and incident response guidance — at SMB economics.
Additional services: Custom policy development, M365 security hardening, ISO 27001 gap analysis, security awareness training, Apple ecosystem security. Full service menu →
Three tiers designed for healthcare practices, law firms, and regulated SMBs in Northeast Florida. From fast risk assessments to full vCISO partnerships.
Comprehensive compliance assessment for small practices (1–10 employees). Includes a findings report, gap analysis, and written remediation roadmap.
Comprehensive compliance program for growing practices (5–12 employees). Full HIPAA assessment, custom policies, and semi-annual onsite check-ins.
Full vCISO partnership for established practices (8–20 employees). Strategic leadership, ongoing monitoring, and annual policy maintenance.
Every engagement includes professionally formatted, editable deliverable templates: SRA spreadsheet, HIPAA policy library, DPIA template, and executive slide deck, authored and tailored by Fred Saraiva for your specific environment. No generic templates. No copy-paste compliance.
I know what enterprise compliance looks like: I ran it for Apple across Europe, raising audit scores from 72% to 96% and training over 1,000 agents in four countries. I've built disaster recovery plans for telecom companies, security frameworks for SaaS platforms, and access control systems for multinational operations.
But I also know that a 12-person chiropractic office doesn't need a 200-page security manual. CLAS by Fred takes the precision of enterprise governance and scales it down: custom HIPAA audits, AI governance frameworks, and compliance roadmaps built for practices where the owner is also the decision-maker, the budget holder, and the person who has to explain it to their staff.
I pioneered Apple's first remote support model for the German market. I scaled a SaaS startup to €4M ARR. I've navigated OCR inquiries, GDPR enforcement actions, and ISO 27001 certification audits. And I've done it in three languages, across two continents, for two decades.
Now I'm based in Jacksonville, building compliance programs for Northeast Florida healthcare practices: dentists, chiropractors, psychiatrists, dermatologists, who need audit-ready documentation without enterprise bureaucracy. No generic templates. No copy-paste policies. Just custom frameworks built by someone who's been in the CTO chair and knows what actually holds up under scrutiny.
Fred Saraiva, Founder
Illustrative scenarios based on common compliance challenges in the healthcare practices we serve.
Practice facing OCR inquiry after patient complaint. Delivered full HIPAA compliance program (Security Risk Assessment, 8-policy set, staff training) in 60 days. Avoided fines, passed follow-up audit on first attempt.
Practice using AI scribe tools (Nuance DAX, Suki) without Business Associate Agreements or data governance. Built AI Acceptable Use Policy and vendor risk framework aligned with HIPAA and ISO 42001, eliminated PHI exposure risk.
Solo provider preparing for first insurance panel audit. Conducted HIPAA gap analysis, implemented M365 security hardening (MFA, encryption, conditional access), created audit-ready documentation in 30 days.
Solo chiropractor hit with ransomware attack after clicking phishing email. Guided breach notification process (OCR reporting, patient notifications), rebuilt security controls, restored HIPAA compliance within 90 days.
CLAS operates as an extension of your leadership team, not a ticket queue. Fred's engagement model prioritizes understanding your business before prescribing solutions.
Regulatory frameworks are often designed for large enterprises. CLAS translates them into right-sized, actionable programs that protect you without paralyzing your operations.
With experience across Europe, Africa, and the US, with fluency in English, French, and Portuguese, CLAS is built for organizations with international ambitions and local accountability.
Most security breaches are preceded by a compliance gap someone knew about but didn't act on. A HIPAA Risk Assessment or cybersecurity review with CLAS takes weeks. A data breach can take years to recover from.
Request a Consultation