Skip to main content
CoreFolioHIPAA

Pricing

Simple, transparent pricing

Free to start. One flat price for a single practice. Per-practice pricing for consultants. No surprises.

Pricing

The Risk Assessment is free. The Digital Binder is one flat price for a single practice. Pro is for consultants and fractional officers who manage 2 or more practices.

Risk Assessment

Free, no account

$0
  • Every section of the 8-section assessment (about 15 minutes)
  • Risk score with critical gaps flagged
  • Plain-English questions
  • Optional email summary
  • Your answers stay in your browser unless you choose to create an account
  • CoreFolio Brief — free weekly federal HIPAA update
Start the free assessment

Practice

Your dated, defensible risk-management file

$99/month

or $990/year (save $198)

Founding rate: $49/month or $490/year — locked for life with continuous subscription. Available to the first 100 customers.

  • Your Risk Analysis Report and Risk Management Plan — the two dated PDFs at the center of the Office for Civil Rights (OCR) Risk Analysis Initiative
  • 50+ required HIPAA documents, auto-tailored to your practice
  • A clear action plan — what to fix, in priority order
  • We keep your binder current — you're alerted only when you need to act
  • Workforce training included — unlimited seats, no per-seat fees
  • BAA management and e-signature
  • Share with up to 2 collaborators — read-only or editor access
  • Update a device, workforce, or vendor once — it flows to every document
  • One flat price for your whole practice — cancel anytime
Lock in founding rate

Pro

For HIPAA consultants managing 2+ practices

Founding rate

$59/ practice / month

Founding rate: a flat $59 per practice per month — every practice, no volume tiers. Locked for life with continuous subscription, for the first 10 Pro customers.

  • Everything in the Digital Binder, for every practice you manage
  • One dashboard for all your client practices
  • Move between practices without separate logins
  • Each practice keeps its own dated, defensible risk-management file
  • Give each client read access to their own binder
  • Full activity trail — every action shows who took it, you or the practice
  • After the founding cohort, standard volume pricing applies: from $79 per practice (2–5 clients) down to $59 (21+)
  • Consolidated billing — one invoice for your whole book
Talk to our team

Questions we hear a lot.

A risk analysis is just one element OCR looks at. Doing one is mandatory under 45 CFR § 164.308(a)(1)(ii)(A), and not doing one is the most common finding in OCR settlements. Our output gives you the documentation OCR expects to see, but you also need to actually act on the gaps it identifies. The Digital Binder gives you three ways to do that: a remediation checklist prioritized by risk level, policy templates ready to adopt the day the assessment finds a gap, and integrated workforce training so your team operates to the standard the policies set.
The HHS SRA Tool helps you produce a single document — a risk analysis — as a Windows or Excel desktop tool. That risk analysis is just one of the 50+ documents in the CoreFolio Digital Binder. Our free assessment covers the same ground, but web-based, mobile-friendly, written in plain English, and aligned with the proposed Security Rule update — and it produces a remediation plan you can actually use on Monday morning. The Digital Binder then adds the policies, logs, and records that surround that risk analysis and keep it current.
You can cancel any time from the link in your receipt email. No setup fees, no exit penalties. Your downloaded reports are yours to keep.
No. We never see and never store ePHI.The assessment asks questions about your practice’s compliance posture — not about patients. Your answers stay in your browser and your reports are saved directly to your device.
OCR’s question isn’t “did you do a risk analysis?” — it’s “do you have a current one?” A one-time PDF is defensible the day you download it and stale the day after. The Digital Binder is the shared workspace where it stays current: adopt policies as the assessment finds gaps, record your logs as events happen, and update a device or vendor once to have it flow through every document. When the rules move, changes are queued for your approval — and your team and collaborators work in the same live file, not a folder of stale PDFs.
Right now, we do the HIPAA Security Rule risk analysis and proposed-rule readiness in your risk management plan. CoreFolio is built to expand — OSHA, training, state privacy laws (including California’s Data Exchange Framework and CMIA), AI policy — but we’re starting where the urgency is sharpest.