The compliance program OCR expects to actually be running.

Yes. The Compliance Management System manages compliance, but assumes your foundational documentation is already in place. The Core Documentation System (SKU-107), which covers Notice of Privacy Practices, patient authorization, BAA template, workforce acknowledgments, training log, and patient rights forms, is a prerequisite, not an alternative.

If those documents are not yet in place, start with the Core. The operational program documented here has nothing to run on without that foundation. The Flagship tier bundles both, if you want to handle it in one purchase.

All seven documents are delivered as fillable Microsoft Word (.docx) files. Several are multi-tab tools: the Risk Assessment is three tabs, the Sanctions Policy is two, the Training Package is three. Bracketed fields like [PRACTICE NAME] are pre-marked throughout.

Each document includes its specific regulatory citations printed in the template itself, so you have documented authority for every record you produce.

The cycle runs annually, without exception. The Security Risk Assessment is required at least annually and after any significant environmental change. Workforce training is annual. The Compliance Audit Checklist is annual.

Some documents are standing or per-event: the Sanctions Policy stays in effect (review annually); violation forms are completed per incident; vendor reviews happen before any new vendor relationship begins. The system is designed so a practice can run the full cycle each year and produce a complete documentation packet.

This is the operational program: seven documents covering risk, workforce, controls, and audit. It assumes the Core foundation is in place separately.

The Flagship Complete HIPAA Compliance System bundles both the Core (SKU-107) and this system (SKU-208) with additional Privacy & Security Policies, the Breach Response Kit, Workforce Training materials, and a Risk Management Plan. Everything an OCR auditor expects to find. Practices that want a single end-to-end purchase typically go straight to the Flagship.

It is not a subscription. The Compliance Management System is a one-time purchase, yours forever. The 2026 Edition is current; the proposed 2025 Security Rule amendments (expected finalized in 2026) would codify the annual SRA requirement and add a mandatory technology asset inventory, both of which are already structured into the templates.

If we publish a major revised edition responding to a final rule change, it will be released as a separate edition with an upgrade path for existing customers.

The license covers a single practice entity. If you operate multiple practices under separate legal entities, each entity needs its own license. Multiple physical locations under one practice entity are covered by one license.

If you're unsure how this applies to your structure, contact us before purchase.

Because this is a digital product delivered immediately on purchase, all sales are final. We don't offer refunds.

If you're not certain this is the right tier for your practice, the FAQ above and the tier comparison should answer most questions. If you have a question that's not answered, reach out before buying. We'd rather help you choose correctly than process a return.