HIPAA and OSHA compliance for medical practices. Most compliance vendors sell the same generic checklist to every business in America. We only work with medical practices — so our audits, training, and policies reflect what actually happens in your office, not a template written for a law firm.
Civil penalty ceiling per HIPAA violation category, per year — and it applies whether the breach was intentional or a genuine accident.
The window practices have to notify HHS after discovering a breach — most find out they're behind only after something's already gone wrong.
Roughly how often OSHA inspections of healthcare settings turn up a bloodborne pathogen or hazard communication violation.
Every practice is in a different place. Start with training, hand off the whole program, or find out exactly where you stand with an audit — each path stands on its own.
Self-paced HIPAA and OSHA training with certificates, automatic reminders, and a manager dashboard.
We run your compliance program year-round — assessments, reviews, screening, and expert guidance.
A full HIPAA and OSHA audit with a written, risk-ranked report and a plan to close every gap.
A free 30-minute conversation about your practice — size, specialty, and where you suspect the gaps are.
We walk through your actual policies, physical space, and staff practices — not a generic questionnaire.
A written report ranking issues by real risk, with a clear, practical plan to close each gap.
Policies in place, staff trained, and paperwork that actually holds up if you're ever audited.
"I spent over a decade running the operations of a real medical practice — including compliance. I built ClearMed because most vendors sell compliance like it's a spreadsheet, and it's not. It's how your front desk answers the phone. It's what's taped to the breakroom wall. It has to fit how your practice actually works, or it doesn't work at all."
30 minutes, no obligation. We'll talk through your practice and tell you honestly where the real risk is.
Three ways to get covered — pick the one that fits where your practice is today. Each stands on its own, and none of it is a generic template.
Self-paced HIPAA and OSHA training with certificates, automatic reminders, and a manager dashboard.
We run your compliance program year-round — assessments, reviews, screening, and expert guidance.
A full HIPAA and OSHA audit with a written, risk-ranked report and a plan to close every gap.
The written risk assessment the Security Rule requires every year — built around your actual systems, not a template. Included in every Managed Compliance plan.
A deeper course for the person responsible for your program: risk assessments, breach response, policies, and audit preparation. Included in Managed Compliance.
Handbook review and emergency action plans — the operational paperwork that protects your practice when a staffing situation gets complicated.
Self-paced online training your staff completes on their own schedule. Managers see completion status at a glance, and reminders go out automatically.
| Practice size | Annual price |
|---|---|
| 1–19 employees | $497 |
| 20–49 employees | $797 |
| 50–75 employees | $1,297 |
| 76–100 employees | $1,497 |
| 100+ employees | Custom quote |
Compliance isn't a once-a-year project — regulations change, staff turn over, and policies go stale. We keep your practice covered all year, and the Training Portal is included.
Ongoing support: exclusion screening, regulatory monitoring, expert Q&A, breach guidance, check-in calls, and onboarding support for new hires.
The big yearly deliverables: your HIPAA risk assessment, your OSHA review, and your policy review — billed once a year because that's how often the work happens.
| Practice size | Monthly | Annual assessment fee |
|---|---|---|
| 1–19 employees | $599 | $3,695 |
| 20–49 employees | $895 | $4,995 |
| 50–75 employees | $1,195 | $6,295 |
| 76–100 employees | $1,645 | $9,250 |
| 100+ employees | Custom | Custom |
Starts with a 3-month commitment, then continues month to month with 30 days' notice to cancel. Managed Compliance covers HIPAA and OSHA; it does not include legal services, IT work, or DEA/CMS compliance.
A full walkthrough of your HIPAA and OSHA posture, priced by practice size. Choose a virtual audit delivered by live video, or an in-person visit to your office.
| Practice size | Providers | Virtual audit |
|---|---|---|
| Small | 1–4 | $2,097 |
| Mid-size | 5–10 | $3,147 |
| Large | 11–20 | $4,197 |
| Enterprise | 21+ | Custom quote |
Virtual audits are delivered through a live video walkthrough and secure document review, and are available to practices anywhere in the country.
Audits cover federal HIPAA and OSHA requirements. State-specific obligations, such as state breach-notification laws, should be confirmed with local counsel.
Tell us about your practice on a free call and we'll tell you honestly where to start.
ClearMed Compliance exists because most compliance vendors are built by people who've never had to explain HIPAA to a front desk team on a busy Monday morning.
After more than a decade managing the day-to-day operations of a real medical practice — including its compliance program — one thing became clear: most compliance training and audits are built by people who've never actually run a practice.
They're built for "businesses" in general — the same training video sold to a retail chain gets sold to a physician's office, with a few words swapped out. It technically covers the regulations. It doesn't reflect how a medical practice actually works: how patients call in, how records move between providers, what the break room conversation sounds like, what actually goes wrong on a normal day.
ClearMed Compliance was built to close that gap — audits, training, and policies written by someone who has actually sat in the practice manager's chair, not just read the regulation.
30 minutes, no obligation — just an honest conversation about where things stand.
38 specific items across the 5 areas OCR investigators actually look at first. Not a generic overview — a real working checklist you can run through your practice this week.
8 items covering Notice of Privacy Practices, patient access requests, and authorization forms.
8 items covering workforce training records, sanctions policy, and access management.
7 items covering facility access, workstation security, and device/media disposal.
8 items covering access controls, audit logs, encryption, and transmission security.
7 items covering your incident response plan and breach notification timeline.
Tell us a little about your practice and we'll send the full 38-item checklist as a PDF.
Tell us about your practice and we'll set up time to talk through where things stand — no obligation, no sales script.