Every price, in one place.
What I sell is the compliance officer function. Everything else on this page is either its first month or something you can buy on its own. The prices are published so you can tell whether a call is worth your time before you book one.
Fractional Compliance Officer, monthly.
Every level includes the same standing function: board reporting on a schedule, policies current, the risk register live, BAAs and training tracked, the annual analysis refreshed, and a person to call. Projects go in a queue, and the level sets how many are in progress at once. Monthly, no minimum term. If you do not have a current risk analysis, month one is that analysis, billed at the assessment price. Every month after is the monthly price. Month one is billed at the assessment price or the monthly price, whichever is higher.
| Level | Price | What runs |
|---|---|---|
| One active project | $2,500/mo | The standing function, with one project from your queue in progress at a time. |
| Two active projects | $4,000/mo | The standing function, with two projects in progress at once. |
| Three active projects | $6,000/mo | The standing function, with three projects in progress at once. |
| One-month sprint | +$1,500 or +$2,000 | For a month that needs more at once, ahead of a renewal, an audit or a buyer's security review, a sprint adds one active project for that month at the difference to the next level. |
A project is one deliverable with a defined done-state, usually from your risk register, sized to about a month of work. Bigger work is split into phases that queue one after another. The queue has no limit; only the number in progress at once does. The entry level is under a third of what the function costs as a hire. How the function works.
One piece of the work, without the retainer.
Each of these is also part of the function: inside the retainer the assessment is month one and the others are projects in the queue. Sold alone, they suit an organization that wants the artifact and nothing ongoing.
| Engagement | Price | What you get |
|---|---|---|
| Security Risk Assessment | starting at $3,500 | The risk analysis 45 CFR 164.308(a)(1)(ii)(A) requires, conducted by a practitioner, every finding evidence-cited. Single entity or site, with the on-site walkthrough in scope at the published price. Travel is settled at scoping. |
| Small-Organization SRA | starting at $1,750 | Same artifact set, size-gated: single-site nonprofit or public, under roughly $2M revenue, or 15 or fewer staff. |
| Risk Management Project | scoped from the findings | The follow-on to a standalone assessment. Implementation of the risk management plan, scoped from your risk register. |
| Part 2 Alignment Review | $750 | For SUD programs. The ten areas the 2024 Part 2 final rule changed, read against your own governing documents. |
| Small-Program Alignment | $1,250 | Single-site. The Review plus corrected documents. |
| AI Vendor Analysis | starting at $5,000 | One stuck vendor deal, unstuck: the vendor's public claims checked against its own legal language and against HIPAA. |
Not sure where you stand? The Self-Checks are free, with no call and no email gate.
Building something new.
Work that builds a program or a tool, rather than running or improving one that already exists, is scoped on its own. Bounded AI work around a program that already runs is a project in the compliance officer retainer instead.
| Engagement | Price | What you get |
|---|---|---|
| AI Enablement Retainer | Scoped per engagement | Building the AI program itself: what is allowed and who approves it, the training routine, and the tools rolled out to staff, run as its own retainer. |
| Custom AI Build | Scoped per engagement | Software built for the way your organization actually works, running in your environment and owned by you outright. |
Not sure which of these you need?
Thirty minutes, no charge. Tell me what triggered the search, and I'll tell you honestly what you need, what it costs, and whether it is something I can help with.