AI Governance Protects Your Business.
Security, Compliance & Audit-Readiness Follow.
No Panic, No Gaps.
We Find Your Gaps Before the Auditors or the Hackers Do.
Certified and Cyber-insured agency.
I’m Fred, your outsourced security & compliance lead. I find the gaps in how your practice protects patient and client data, fix them, and keep you ready for any audit, breach or inspector, including the new risks from ChatGPT and AI tools.
30 minutes · no sales pitch · you leave with your top 3 priorities
- ★ Client reviews on Google
- Certified & Cyber-insured
- 20+ years in security & compliance
- Jacksonville & remote · EN · FR · PT
Three steps to audit-ready.
- 1
Free 30-min call
Tell me how your practice runs. You leave with your top 3 priorities, no pitch.
Free - 2
Risk Snapshot
A short onsite visit and a 1-page priority list of your gaps, delivered in 2–3 business days.
$995 flat - 3
Stay audit-ready
I keep your policies, training and vendor paperwork current, so an audit is just a meeting.
From $299/month
AI Governance Is
the New Compliance
Auditors, insurers and regulators now ask how your team uses AI, and most businesses have no written answer. ISO 42001 is the international standard for governing AI, and CLAS by Fred is one of the few consultancies in Northeast Florida delivering it for small and mid-sized businesses.
One employee prompting ChatGPT with a patient name. One undisclosed AI vendor in your workflow. One AI-generated clinical note without a human override policy. Each one is an audit finding, or worse.
ISO 42001 is the international standard for AI Management Systems. It maps directly to HIPAA safeguards, giving you a defensible governance layer for every AI tool your organization uses today, and tomorrow.
Fred delivers a complete AI Governance Framework: AI risk register, acceptable use policy, vendor assessment, staff training plan, and a HIPAA crosswalk, all authored for your specific environment.
AI Governance Is Your Foundation.
Security & Compliance Follow.
Every AI tool in your organization (ChatGPT, Copilot, scheduling bots, clinical scribes) poses a compliance and security risk without governance. We build the ISO 42001 AI Management System first, then layer your regulatory compliance (HIPAA, PCI DSS, GDPR and more) and security hardening on top. One integrated framework.
You run a small practice. You've got patients, staff, and a growing pile of technology, but no idea whether any of it is compliant. That fog is your biggest liability.
Most OCR fines and data breaches don't hit organizations that tried and failed. They hit organizations that never checked. The Risk Snapshot is designed for practices with 1–9 employees who need to know exactly where they stand: fast, affordably, and without a long-term commitment.
You choose the audit tool that fits your situation: HIPAA for healthcare practices, ISO 27001 for security framework, or ISO 42001 for AI governance. We review your results during a 30-minute onsite visit, check your M365 and Apple security posture, and deliver a clear priority matrix within 2–3 business days. No jargon. No scare tactics. Just clarity.
- Client completes audit tool (HIPAA, ISO 27001, or ISO 42001)
- 30-minute onsite visit: Fred reviews results, checks environment
- M365 / Apple security baseline check
- Vendor & BAA gap identification
- 1-page prioritized risk matrix
- Risk summary email with immediate action items
- Notes from onsite visit (audit tool HTML export included)
AI Governance, Compliance (HIPAA, PCI, GDPR & more) & Security.
Pick Your Starting Point.
Priced by headcount. Five tiers, from a one-person practice to a 100-person firm. Every tier starts with an entry assessment or a retainer, runs on a 12-month minimum where stated, and can include AI governance.
Standing compliance contact for small teams. Four core policies kept current, a quarterly check-in, and training every year.
- Four core policies authored and maintained
- Quarterly remote check-in
- Annual security awareness training
- Email support between check-ins
- Start with the $995 Risk Snapshot to find your gaps
Your first compliance binder for a 10–24 person practice: assessment, four core policies and a remediation roadmap.
- Client completes CLAS audit tool (HIPAA, ISO 27001, or ISO 42001)
- 1-hour onsite visit with Fred
- Four core policies (HIPAA, ISO 27001 or ISO 42001), custom-authored
- Assessment report
- Remediation roadmap template
- Upgrade to Resilient within 30 days: 50% credit ($747.50)
Ongoing compliance for a growing practice: audit, six core policies, two onsite check-ins a year and a living risk register.
- Compliance audit (CLAS audit tool + onsite review)
- 6-policy core set, custom-authored and maintained
- Two semi-annual onsite check-ins (90 min each)
- M365 hardening guidance document
- Risk register with remediation roadmap
- 30-day initial setup included
Comprehensive assessment and first compliance binder for a 25–100 person firm: 2-hour onsite visit, six custom HIPAA policies, gap analysis and remediation roadmap.
- Client completes CLAS audit tool (HIPAA, ISO 27001, or ISO 42001)
- 2-hour comprehensive onsite visit with Fred
- Gap analysis
- Six custom-authored HIPAA policies
- M365 and Apple baseline with written hardening guidance
- Findings report and 1-page risk summary
- Written remediation roadmap with timeline
For a 25–49 person firm: the Resilient program with an 8-policy set, semi-annual onsite visits and a standing advisory call.
- Everything in Resilient
- 8-policy set, custom-authored and maintained
- Semi-annual onsite check-ins
- 2–4 hours/month advisory call
- Policy upkeep and annual review
Full vCISO partnership for 50–100 staff: 12 policies, advisory hours each month, quarterly onsite visits and regulatory monitoring.
- Everything in Vanguard
- 12-policy set with annual refresh
- 8–12 fractional vCISO hours/month
- Quarterly onsite check-ins
- Regulatory monitoring
Every engagement includes professionally formatted, editable deliverable templates: SRA spreadsheet, HIPAA policy library, DPIA template, and executive slide deck, authored and tailored by Fred Saraiva for your specific environment. No generic templates. No copy-paste compliance.
Your fractional vCISO for 12 months: 8–12 advisory hours a month, quarterly onsite check-ins, 12-policy set and regulatory monitoring.
One violation can cost up to $73,011. Repeat violations of the same HIPAA rule are capped at $146,053 a year (HHS, 2026).
Yearly cap per HIPAA rule when a known problem is not fixed within 30 days (HHS, 2026).
Typical market ranges come from published 2026 industry pricing guides (RESILIENT's range is the published consultant price of its parts: custom policies, annual upkeep, staff training, vendor/BAA review and remediation planning); HIPAA penalty figures are the HHS inflation-adjusted amounts effective January 28, 2026. Your price depends on scope. See sources →
Also available: HIPAA Security Risk Analysis from $3,500 · AI Governance Framework from $3,500 · ISO 27001 gap analysis from $4,500 · Fractional vCISO (custom) · Fractional vCAIO from $2,500/month · Apple ecosystem security, quoted per fleet. Full service menu →
Why I Built CLAS
I know what enterprise compliance looks like: IT Security Lead for Apple vendor across Europe, raising audit scores from 72% to 96% and training over 1,000 agents in several countries. I've built disaster recovery plans for telecom companies, security frameworks for SaaS platforms, and access control systems for multinational operations.
But I also know that a 12-person chiropractic office doesn't need a 200-page security manual. CLAS by Fred takes the precision of enterprise governance and scales it down: custom HIPAA audits, AI governance frameworks, and compliance roadmaps built for practices where the owner is also the decision-maker, the budget holder, and the person who has to explain it to their staff.
I pioneered Apple's first remote support model for the German market. I scaled a SaaS startup to €4M ARR. I've navigated OCR inquiries, GDPR enforcement actions, and ISO 27001 certification audits. And I've done it in three languages, across two continents, for more than two decades.
Now I'm based in Jacksonville, certified ISO 42001 Lead Auditor & Implementer, building compliance programs for Northeast Florida healthcare practices, law firms, and all regulated (or not yet regulated) environments seeking AI Governance, physical security guidance, or audit-ready documentation without enterprise bureaucracy. No generic templates. No copy-paste policies. Just custom frameworks built by someone who's been in the CISO & CTO chair and knows what actually holds up under scrutiny, and knows what keeps hackers out before they ever find a way in.
Frederic Saraiva, Founder
I’m a…
Medical or dental practice
“If OCR called tomorrow, could we show them our risk assessment and policies?”
Start with HIPAA compliance →Behavioral health or recovery center
“Our patient records are extra sensitive. Is our staff handling them safely?”
Start with HIPAA compliance →Law, CPA or financial firm
“Clients trust us with confidential files. Could one phishing email expose them?”
Law firms: Florida Bar & ABA rules →CPAs & advisors: FTC Safeguards & Reg S-P →Church or nonprofit
“We hold donor and member data, but nobody owns security. Where do we start?”
Start with Florida’s data protection law →In February 2026, a substance-use treatment center with 1,980 affected patients paid HHS $103,000 after a phishing email exposed patient data, and OCR found it had never done an accurate risk analysis. Small practices are not too small to be investigated.
Source: HIPAA Journal →The Questions Small Practices
Ask Before Booking
Yes. There is no small-practice exemption in HIPAA. If your practice transmits health information electronically (billing, lab orders, referrals), you are a covered entity. OCR has issued corrective action plans and fines to solo practitioners and practices with fewer than five employees. Size does not protect you. The absence of documentation is what makes you vulnerable.
Read: HIPAA requirements for small practices →They handle the technology. HIPAA compliance requires written policies, a Security Risk Analysis, workforce training, Business Associate Agreements, and documented procedures, none of which your IT company or EHR vendor produces for you. Your EHR vendor signs a BAA with you. That is not the same as your practice being compliant. When OCR investigates, they ask for your documentation, not your vendor's.
Find out what your practice is missing: $995 Risk Snapshot →The Risk Snapshot is $995, a flat fee for a 30-minute onsite visit, a HIPAA audit tool, and a 1-page priority report delivered in 2–3 business days. No retainer, no long-term commitment, no obligation after. Compare that to OCR fines for a missing Security Risk Analysis: $145 to $73,011 per violation (2025 inflation-adjusted), and a small treatment center paid $103,000 in 2026 after a single phishing incident. One phishing incident without an incident response plan on file can cost more than a year of compliance work.
Start at $995, no commitment required →OCR investigations are not triggered by negligence alone. They are triggered by patient complaints, breach self-reports, and random audit programs. By the time "something happens," you are already in the enforcement process. A practice without a Security Risk Analysis on file cannot demonstrate good-faith compliance effort. That single gap is what turns an investigation into a fine. The time to build the documentation is before you need it, not the day OCR sends a letter.
What OCR asks for on day one →You don't. Not from a website. That's exactly why the Risk Snapshot exists at $995. It's a single, low-commitment engagement that shows you the quality of the work, the depth of the assessment, and whether Fred's approach fits your practice, before you invest in anything larger. Most clients who start with the Snapshot know within the debrief call whether they want to continue. There's no pressure either way.
Book a no-obligation discovery call first →No sales pitch. No pressure.
The acronyms, explained.
Compliance is full of letters. Here is what each one means for your business.
- OCR
- Office for Civil Rights. The federal office inside HHS that investigates HIPAA complaints and data breaches, and issues the fines.
- HHS
- U.S. Department of Health and Human Services. The federal department that writes and enforces the HIPAA rules.
- HIPAA
- Health Insurance Portability and Accountability Act. The U.S. law that requires healthcare providers and their vendors to protect patient health information.
- PHI
- Protected Health Information. Any health data that can identify a patient: names, dates, records, bills, even appointment details.
- SRA
- Security Risk Analysis. The written risk assessment HIPAA requires every practice to complete and keep up to date. It is the first document OCR asks for.
- BAA
- Business Associate Agreement. The contract HIPAA requires with every vendor that touches your patient data (IT, billing, cloud, AI tools).
- GDPR
- General Data Protection Regulation. The European Union privacy law. It applies to any U.S. business that handles personal data of people in the EU.
- CCPA
- California Consumer Privacy Act. California’s privacy law for businesses that collect personal data from California residents.
- FIPA
- Florida Information Protection Act (Fla. Stat. §501.171). Requires Florida businesses to protect personal data and report breaches.
- PCI DSS
- Payment Card Industry Data Security Standard. The security rules for any business that accepts, stores or processes credit card payments.
- ABA
- American Bar Association. Its ethics rules require lawyers to protect client confidentiality, including when using technology and AI.
- FINRA
- Financial Industry Regulatory Authority. The organization that oversees broker-dealers, including their cybersecurity and record-keeping.
- SEC
- U.S. Securities and Exchange Commission. Regulates investment advisers and requires them to protect client data (Regulation S-P).
- ISO 27001
- The international standard for running an information security program. Proves to clients and partners that you manage security systematically.
- ISO 42001
- The international standard for governing artificial intelligence. Shows how your organization approves, controls and monitors AI tools.
- NIST
- National Institute of Standards and Technology. Publishes widely used U.S. security guidance, such as the Cybersecurity Framework and the AI Risk Management Framework.
- vCISO
- Virtual Chief Information Security Officer. A part-time security executive who leads your security and compliance program without a full-time salary.
- MSP
- Managed Service Provider. Your outsourced IT company. They install and fix the technology; CLAS sets the rules and checks the results.
Industries We
Specialize In
Built for businesses from 1 to 100 employees. You handle regulated data but can’t afford a full-time CISO. CLAS delivers enterprise-grade compliance leadership at small-business economics, starting at $995 for a Risk Snapshot or $299/month for Steady.
Know Where You Stand
in 30 Minutes.
Most breaches start with a compliance gap someone knew about but never fixed. A compliance or security review with CLAS takes weeks. Recovering from a breach can take years. Book a free call and leave with your top 3 priorities.
Book a Free 30-Min CallServing Northeast Florida & Remote Clients Nationwide
Trilingual: EN · FR · PT
Client Reviews
Proven expertise in AI governance and compliance for healthcare practices, law firms, and regulated businesses.