Yes. I sign a Business Associate Agreement with every healthcare client before I start.

My EHR is HIPAA compliant. Doesn't that cover me?

It covers the EHR company's servers. Your risk analysis, devices, passwords, policies and staff training are still on you.

What does HHS ask for first after a complaint or breach?

Your security risk analysis. A missing or outdated one is the most common gap HHS cites.

Volunteers packing food boxes at a community food bank

Cybersecurity for nonprofits

Donors, clients and grant makers trust you with their information, and one breach can cost you all three. I set up the protection with you, write your security plan, train your staff and volunteers, and serve as your Security Officer, so you can focus on your mission.

The rules you face

FTC Safeguards Rule: if you make loans or provide repayable financial assistance, like help with rent or utility bills, you’re likely covered as a financial institution. That means a written security plan, a Qualified Individual in charge of it, a risk assessment and staff training.
Federal grants (2 CFR 200.303): if you receive federal award money, you must take reasonable cybersecurity measures to protect the personal information you collect.
HIPAA: if you provide health, counseling or recovery services, or handle health information for a covered partner, HIPAA applies to you like any other provider.
PCI DSS: if you take donations by card, the card brands require you to protect that card data, even when a platform processes the payment.
State breach laws: every state requires you to notify donors and clients when their personal information is exposed.

Learn more: FTC Safeguards Rule (GLBA) · HIPAA · PCI DSS · Which rules apply to you?

See Pricing

Team members stacking their hands together in a show of unity

Person sitting on a beige couch wearing a blue plaid shirt, holding a white electronic tablet, and wearing dark green pants.

What you get

A written security plan: built from your inventory, and ready for grant applications, audits and your cyber insurance application.
A named Security Officer: I take that role by contract, track what’s due, and keep the paperwork current. You and your board keep every decision.
Vendor management: a simple process for you to check and keep watch on the security of every vendor that handles your donor and client data, including your donor platform, CRM and payment processor.
Monitored protection: 24/7 protection on your devices and email, set up with you.
Staff and volunteer training: everyone who touches donor or client data completes it, with records kept.
An incident response plan: who to call, and how to notify donors, clients, funders and the state if something happens.
A yearly review: we update your plan, devices, vendors and access together.

Want to see the full process? See How It Works.

Take Free Assessment

What clients say

“Informative and knowledgeable about industry.”

Dr. Debra Clark, GreenSHADES Foundation
“This is a top notch business that offers excellent service.”

Jeffrey Jean, The Ascension Society

Common questions

We’re a small nonprofit with mostly volunteers. Do we need this?

Yes. Volunteers often use their own devices and email, which makes them one of your biggest risks. Training and simple access rules close most of that gap.

We help clients pay bills. Does the FTC Safeguards Rule apply to us?

If clients repay the help, it’s lending, and the rule likely applies. Outright grants usually don’t count, but the client data you collect still needs protecting.