HIPAA compliance your auditor will recognize. Training your staff will finish.
Editable policies, a one-hour training course, and a certificate for every person on your team. The written proof regulators ask for first, ready in an afternoon.
Uses, disclosures, minimum necessary, and patient rights.
Risk analysis plus administrative, physical and technical safeguards.
The four-factor assessment, deadlines, and an incident log.
From "we should really do this" to audit-ready in a week.
Find your gaps
Twelve questions score your practice against the safeguards that matter most and rank the fixes for you.
Adopt your policies
Download Word templates with your practice name already filled in. Complete the bracketed fields, sign and date them.
Train and certify
Invite your team by email. Each person watches six short modules, passes the quizzes, and earns a certificate.
The documents regulators ask for first.
Written for small practices, in plain English. Every policy names an owner, has a log to keep and a place to sign.
- A guided security risk analysis, the document most often missing in audits, with common clinic threats pre-filled.
- Incident response with breach deadlines and the four-factor assessment, ready before you need it.
- A business associate agreement for vendors that don't have their own, plus a vendor inventory.
Training that fits in one lunch break.
Six focused modules, a five-question quiz after each, and a certificate the moment someone finishes. You see who's done without chasing anyone.
- Built from real clinic scenarios: the front desk, the fake vendor email, the "IT support" call.
- Every person gets their own sign-in link, so there are no passwords to manage.
- A completion report you can hand an auditor, payer or insurer today.
Most clinic breaches don't start with a hacker. They start with one convincing email.
"In a meeting. Need four $200 gift cards for staff. Send pics of the backs. Keep it quiet."
"We've changed banks. Please update our details before paying the attached invoice."
"I just sent a code to your phone. Can you read it back to me so I can fix your account?"
A certificate anyone can verify.
Each certificate carries a unique code. An auditor, payer or new employer can confirm it on our verification page in seconds, with no phone calls and no lost paperwork.
- Dated, named, and listing every module completed
- Downloadable PDF for your six-year HIPAA records
- Issued automatically when someone passes all six quizzes
of Riverside Family Practice
has completed HIPAA Privacy and Security Workforce Training
When someone asks for it, you'll have it.
Security risk analysis
A documented, dated analysis with risk ratings and an action plan.
Included in the kitWritten policies
Privacy, security, devices, remote work, backup, all adopted and signed.
Included in the kitTraining records
A certificate per person and a completion report on demand.
Included in trainingBusiness associate agreements
A vendor inventory and a BAA template for anyone missing one.
Included in the kitIncident response plan
Who to call, what to assess, and every notification deadline.
Included in the kitSix-year documentation
Logs for incidents, requests, sanctions and reviews in one place.
Included in the kitOne purchase. No subscription surprises.
Policy kit
For practices that need written policies
$199one-time
- 16 editable policies, procedures and logs
- Practice name pre-filled in every document
- Guided security risk analysis worksheet
- Business associate agreement template
- 12 months of template updates
Complete bundle
Everything a small practice needs
$299one-timeSave $49
- The complete policy & procedure kit
- Staff training for up to 10 people
- Certificates and completion reports
- Template updates and yearly update module
- One purchase, one account
Staff training
For practices that need documented training
$149one-time
- Six video modules, about one hour total
- Quiz after every module
- Certificate for each staff member
- Manager dashboard and CSV completion report
- Up to 10 staff, 12 months of access
Every plan includes 12 months of access. Renew for $99/year if you want to, and we'll never charge you automatically.
Plain-English answers for practice managers.
HIPAA risk assessment for small clinics: a plain-English checklist
What a HIPAA security risk analysis actually is, why it's the first thing auditors ask for, and how a small practice can do one in an afternoon.
Read the guide → Guide · 2 min readDoes my clinic need HIPAA training every year?
What HIPAA actually requires for workforce training, why annual training is the standard, and how to document it so it holds up in an audit.
Read the guide → Guide · 2 min readWhat is a business associate agreement, and which vendors need one?
A plain-English guide to BAAs for small medical practices, including which vendors need one, what it must say, and what happens if you don't have one.
Read the guide →Before you decide.
Is this legal advice?
No. These are professionally structured templates and training. HIPAA sets a federal floor and your state may add requirements, so have your finished policies reviewed by a qualified professional.
Does HIPAA really require training every year?
HIPAA requires documented workforce training and periodic security reminders. Annual training is the standard auditors, payers and cyber insurers expect.
How long does setup take?
Most practices adopt the kit in an afternoon. Staff training takes each person about an hour, and they can stop and resume any time.
What happens after 12 months?
We'll remind you before your access ends. Renewal is optional and never automatic. Certificates you've already earned stay valid and verifiable either way.
What if we need more help than templates?
Tell us what's going on. We'll connect you with an IT partner who works with medical practices, for a done-for-you risk analysis, MFA, backups or incident help.
Find out where you stand in three minutes.
Twelve questions. A score out of 100. Your fixes, in priority order. Free.