Answer a guided wizard. Receive every required policy, your risk analysis and risk management plan, business associate agreements, breach procedures, training and device registers, and the annual review minutes, as editable Word documents. Renew next year at half price.
The HIPAA Security and Privacy Rules require written policies, a documented risk analysis, a risk management plan, training records, business associate agreements and breach procedures, kept for six years. Cyber-insurance applications ask for the same things.
A one-dentist office settled with federal regulators in October 2026 for $140,000 (computed exposure $1.4 million) for missing policies and training. A treatment center paid $103,000 in February 2026 after one phished mailbox and no risk analysis. Every case ended with a two-year monitored corrective action plan.
In 2026 the Office for Civil Rights said it is looking past the risk analysis to the risk management plan: did identified risks actually get closed? The binder keeps that register year over year, so the answer is on paper.
One flat price per year. No per-user fees. Renewal is exactly half the first-year price, every year.
1–5 staff, one location
Everything a solo or two-provider office needs: policies, risk analysis, forms, registers and the annual review.
6–25 staff, one location
The same binder with room for a full staff roster, device inventory and access reviews across teams.
26–50 staff, or 2–3 locations, or a business associate
Multi-site facility controls, the business-associate edition with subcontractor agreements, and per-location walkthroughs.
| Add-on | What you get | Price |
|---|---|---|
| Annual review done-with-you (2-hour session) | A CRU technician walks the annual review checklist with you on a screen share and records the minutes. | $315.60 per year |
| Human risk-analysis review | CRU reviews your completed risk analysis, writes findings and remediation priorities, and signs the report. | $399 one time |
| Staff training seats, unlimited up to 25 | Annual HIPAA awareness course with certificates, logged straight into the training roster. | $199 per year |
| Staff training seats, unlimited up to 50 | Annual HIPAA awareness course with certificates, logged straight into the training roster. | $349 per year |
| Business associate agreement review (up to 10) | CRU checks each vendor agreement against the HHS required elements and returns redline notes. | $149 per batch |
| Printed, tabbed binder shipped to you | A 3-ring binder with tabs for every section; renewal reprints of changed sections are $59. | $89 one time |
| Additional location | Adds a location to the facility controls, walkthroughs and device inventory. | $99 per year |
| Product | Year 1 | Year 2 | 3-year total |
|---|---|---|---|
| CRU Binder Practice (6–25 staff) | $650 | $325 | $1,300 |
| Medcurity Small Practice SRA | $499 | $499 | $1,497 |
| Patient Protect Basic | $468 | $468 | $1,404 |
| One Guy Consulting Self-Guided | $675 | $675 | $2,025 |
| SecurityMetrics HIPAA Basic | $999 | $999 | $2,997 |
| Compliancy Group Foundation (10 staff) | $2,148 | $2,148 | $6,444 |
| Abyde (1 location, 1–10 staff) | $1,932 | $1,932 | $5,796 |
Competitor prices are the vendors' published self-service rates as of October 2026; none publishes a reduced renewal. Our research notes are available on request.
Tell us about your practice. We reply with a QuickBooks estimate within one business day. Nothing is charged until you approve it.
If you are a provider who bills electronically, a billing company, or any vendor that touches patient records, yes. The HIPAA Security and Privacy Rules require written policies, a documented risk analysis, workforce training records, business associate agreements and breach procedures, retained for six years. Every 2025–2026 enforcement action against a small practice ended with a two-year corrective action plan requiring exactly these documents.
A binder generated from your own answers: 27 documents including the Notice of Privacy Practices, every required policy, your risk analysis report and risk management plan, a business associate agreement template and register, incident and breach procedures with letter templates, a contingency plan, Minnesota Health Records Act supplement, the registers and logs, workforce acknowledgment forms and the annual review minutes. Delivered as Word documents you can edit, plus a printable index.
Most offices finish the first pass in two to three hours spread over a few sittings. Save as you go. The device inventory and business associate list are the parts that take real time; the wizard carries your answers forward every year so you only do that once.
The work is in the first year. Each renewal carries your answers forward, opens a fresh annual-review section, keeps prior years' meeting notes on file, and updates the policy text for rule changes. HIPAA expects the annual review, refreshed risk analysis and current training and vendor records every year, and cyber-insurance applications ask for the same things.
No. The binder is a documentation tool built on the HHS model notices, HHS sample business associate provisions, NIST SP 800-66 and Minnesota statute. It gives you a complete, consistent set of documents and tells you what is still missing. Have your attorney review anything specific to your situation.
You open the binder. The risk analysis, policies, training roster, business associate agreements and incident log are what the Office for Civil Rights asks for first. The breach section has the four-factor worksheet, the deadlines and the letter templates. If you want help, the done-with-you session is available any time at our normal rate.
On CRU's own servers in central Minnesota, not a third-party cloud. Your binder is protected by your license key and a passphrase you choose. Generated binders are emailed to you and kept on file so a lost copy can be re-sent.
Yes. Add the human risk-analysis review and the done-with-you session, or ask for a quote for a full onsite assessment. The binder is still the deliverable, so you own the documentation either way.