Pricing
Every plan includes a 14-day free trial with no credit card, and no onboarding fee. Annual billing saves roughly two months.
Business Associate
Billing companies, vendors and single organizations
$79/mo
per organization / month
$66/mo billed annually
Everything you need to run a HIPAA program and hand over evidence when a client asks.
- Guided risk assessment across all 68 Security Rule controls
- Remediation tasks with owners, due dates and evidence
- Plain-language policy library with versioning and staff acknowledgements
- Training records with per-person certificates and renewal tracking
- Vendor and BAA register, seeded from our published research
- Incident log with breach notification deadline tracking
- Automated Microsoft 365 checks — settings verified read-only, filed as dated evidence
- Trust Packet PDF export
- Append-only, tamper-evident audit log
- Up to 15 staff seats
Most popular
Business Associate Pro
Vendors selling into hospitals, payers and enterprise health
$149/mo
per organization / month
$124/mo billed annually
For teams whose deals stall on a security questionnaire.
- Everything in Business Associate
- Public trust page with selective disclosure
- Security questionnaire answer library, filled from your own data
- Your branding on the Trust Packet and trust page
- Unlimited staff seats
MSP Console
IT providers managing compliance for healthcare clients
$49/mo
per client organization / month
$41/mo billed annually
Run every client's program from one grid. Minimum three clients.
- Every client gets full Business Associate features
- Multi-client dashboard with posture at a glance
- Cross-client task and deadline rollup
- Your branding on client packets
- Volume pricing: $39 at 10+ clients, $29 at 25+
Common questions
- How much does HIPAA compliance cost?
- Self-serve, for a small organization: software from $79 per month here — no onboarding fee, and nothing auto-renews — plus your own time for the assessment, policies and training. Consultants commonly charge $5,000–$25,000 to cover the same ground, and coached programmes run several thousand per year. The expensive versions buy hand-holding, not a different regulation.
- Who pays for a HIPAA violation?
- The organization that committed it. Covered entities and business associates are each directly liable for their own failures, with civil penalties tiered by culpability. A business associate agreement allocates responsibility between you and a vendor — it does not transfer your own liability, which is why the evidence of your own programme is what actually protects you.
Prices in US dollars, exclusive of any applicable tax. Software and published research only: we are not a law firm, nothing here is legal advice, and no product can make an organization “HIPAA certified” — no such designation exists.