Pricing
Transparent starting prices. No quote-wall.
Four packages with published inclusions and exclusions. The independent CPA examination fee is always separate — that's how audits stay independent.
HIPAA Foundations
Small practices, business associates, and early-stage healthcare vendors that need a documented HIPAA program but are not pursuing SOC 2 yet.
$4,500 implementation
+ $399/month ongoing
Or $7,500/year prepaid.
Target: 4–8 weeks
Timelines are targets, assuming timely client responses.
Included
- Applicability and entity-status assessment
- HIPAA Security Rule risk analysis
- Privacy and security gap assessment
- Remediation plan prioritized by risk
- Administrative, physical, and technical safeguard review
- Policy and procedure library customized to your organization
- Security/privacy officer role documentation
- + 11 more — see full inclusions
SOC 2 Readiness
B2B SaaS companies that need a SOC 2 Type 1 or Type 2 report to close customers.
$9,500 implementation
+ from $750/month ongoing
Plus the independent CPA audit fee, quoted separately by the audit firm.
Target: 6–12 weeks
Timelines are targets, for a reasonably mature startup; the CPA audit and report timeline is separate.
Included
- Scope workshop and system boundary definition
- Trust Services Criteria selection
- Readiness / gap assessment
- Control matrix and ownership assignments
- Risk assessment and risk register
- Policy customization and approval workflow
- Asset, vendor, personnel, and access inventories
- + 12 more — see full inclusions
Healthcare Trust Launch
Healthcare SaaS, medical AI, digital health, telehealth, and healthcare infrastructure startups that need both frameworks.
$14,500 implementation
+ $1,250/month ongoing
Plus the independent CPA audit fee, quoted separately. $1,500 discount for annual prepayment of the ongoing service.
Target: 8–14 weeks
Timelines are targets, for HIPAA readiness and SOC 2 Type 1 readiness, assuming a functioning cloud environment and responses within two business days; a Type 2 report additionally requires a 3–12 month observation period plus audit and reporting time.
Included
- Everything in HIPAA Foundations
- Everything in SOC 2 Readiness
- Unified control library mapping HIPAA safeguards to SOC 2 controls
- Deduplicated evidence plan
- Healthcare data-flow and subprocessor review
- BAA coverage review for cloud and SaaS vendors
- Minimum-necessary and access-control workflow
- + 9 more — see full inclusions
Continuous Compliance
Customers that completed readiness and need to remain prepared, year after year.
$1,250/month
For up to 50 employees and one production environment; custom pricing above that.
Target: Ongoing
Timelines are targets, monthly and quarterly operating cadence.
Included
- Monthly control-health review
- Evidence calendar and reminders
- Quarterly access review facilitation
- Quarterly vendor and risk-register updates
- Annual HIPAA risk-analysis refresh
- Annual workforce training campaign
- Policy review and version management
- + 6 more — see full inclusions
Published prices cover up to 50 employees and one production environment; larger scopes are quoted after discovery. Timelines are targets that depend on client responsiveness and existing maturity.
Feature comparison.
| HIPAA Foundations | SOC 2 Readiness | Healthcare Trust Launch | Continuous Compliance | |
|---|---|---|---|---|
| HIPAA risk analysis & program | Included | — | Included | Annual refresh |
| SOC 2 readiness & control matrix | — | Included | Included | Maintained |
| Unified HIPAA ↔ SOC 2 control mapping | — | — | Included | Maintained |
| Customized policies & acknowledgment | Included | Included | Included | Review cycle |
| Workforce training & tracking | Included | Included | Included | Annual campaign |
| Vendor / BAA inventory & tracking | Included | Vendor risk | Included | Quarterly updates |
| Evidence collection & quality review | Evidence binder | Included | Included | Standing calendar |
| Access review process | Reviewed | Included | Included | Facilitated quarterly |
| Incident & breach playbooks | Included | Included | Included | Business-hours support |
| CPA audit coordination | — | Included | Included | Renewal planning |
| Trust Center setup | — | — | Basic setup | Document updates |
| Customer questionnaires | — | — | Starter library | 4 / month included |
| Weekly implementation meeting | — | — | Included | Monthly + quarterly |
| Executive reporting | Readiness summary | Readiness letter | Dashboard | Quarterly report |
Add-ons.
Scoped extras when you need them — never required to make the core program work.
Independent penetration test
Delivered by a security partner; quoted by scope.
typically $4,000–$15,000
Cloud security configuration review
from $3,500
vCISO advisory
from $2,500/month
Additional framework mapping
from $3,000 each
Additional employee band
tiered fee
Additional production environment
from $250/month
Security questionnaire overflow
per questionnaire or hourly
Tabletop incident-response exercise
from $2,500
Custom policy drafting
scoped separately
State privacy-law readiness
scoped separately
HITRUST readiness
partner-led custom quote
Expedited implementation
Only offered after a feasibility review.
20–35% surcharge
What affects your price.
Employee count
Published prices cover up to 50 employees. More people means more access to review, more training to track, and more evidence — larger bands are priced in tiers.
Production environments
Each additional production environment adds scope for configuration review, logging, and evidence. Additional environments start at $250/month.
Framework scope
Adding optional SOC 2 criteria (availability, confidentiality, processing integrity, privacy) or extra frameworks expands the control set and evidence plan.
Existing maturity
A team with MFA, centralized identity, and written policies moves faster than one starting from zero. The readiness assessment gives you an early read.
Required remediation
We guide remediation; your team implements it. Deep hands-on cloud work, if you want us closer to the keyboard, is scoped separately.
Urgency
Expedited implementation carries a 20–35% surcharge and is only offered after a feasibility review — we won't take a deadline we don't believe in.
Integration complexity
Unusual stacks, on-premise systems, or legacy tooling add discovery and evidence effort compared to a standard cloud SaaS architecture.
Audit firm choice
The independent CPA firm sets its own examination fee based on scope, criteria, and timing. We introduce you to qualified firms; the engagement is yours.
Penetration-test scope
If customers require a pen test, partner pricing typically runs $4,000–$15,000 depending on application and infrastructure scope.
The independent audit fee, explicitly.
The SOC 2 examination is performed by an independent, qualified CPA firm that you engage directly. The firm quotes its own fee based on scope, selected criteria, and report type, and issues its own opinion. No ClearCompliance price on this page includes an audit fee, and we do not estimate one for you — we introduce you to qualified firms and let them quote accurately.
Billing terms
- Implementation fees are billed in milestones: 40% at kickoff, 30% after the assessment phase, and 30% at readiness delivery.
- Monthly services are prepaid at the start of each month.
- The independent CPA audit fee is quoted directly by the audit firm and is never included in ClearCompliance fees.
Cancellation and rescheduling terms are set out in the service agreement reviewed with you before kickoff.
Pricing FAQ
Why is the CPA audit fee separate?
Because the examination must be independent to have value. The CPA firm quotes its own fee, contracts directly with you, and issues its own opinion. Any provider bundling "the audit" into one price deserves a careful look at who is actually signing the report.
How is implementation billed?
In milestones: 40% at kickoff, 30% after the assessment phase, and 30% at readiness delivery. Monthly services are prepaid. There are no surprise true-ups — scope changes are agreed in writing first.
Are these prices final?
They are honest starting prices for the stated scope (up to 50 employees, one production environment). Your actual quote is fixed in writing after a scoping conversation, before any commitment. Most early-stage companies land at the starting price.
What about cancellation?
Cancellation and rescheduling terms are defined in the service agreement you sign before kickoff, and we walk through them with you plainly at proposal time.
Do you offer a discount for annual prepayment?
Yes — the Healthcare Trust Launch ongoing service carries a $1,500 discount for annual prepayment, and HIPAA Foundations can be prepaid at $7,500/year (versus $4,500 + $399/month).
Get a real number, in writing.
A 30-minute call fixes your scope, timeline, and quote — before you commit to anything.