One-time HIPAA risk assessment vs Annual Security Program
Choose the one-time HIPAA / 360 Risk Assessment when you need a current analysis and roadmap now. Choose the Annual Security Program when you want that analysis plus a light year of continuity. Both are fixed fees, scoped on a short call.
Both are flat fee
The one-time assessment gives you a current analysis and roadmap. The Annual Security Program adds one annual reassessment, four quarterly check-ins, and async Q&A capped at 4 hours per quarter.
Both start with a free 30-minute scoping call. Many practices begin with the assessment and move into the annual program once the first report is in hand.
Last updated September 7, 2026
How the two compare
| One-time Risk Assessment | Annual Security Program | |
|---|---|---|
| Price | Fixed fee, scoped on a short call | Fixed fee, scoped on a short call |
| Best when | You need a defensible analysis and prioritized roadmap this quarter | You want ongoing rhythm after, or instead of, a one-off scramble |
| Includes | Guided assessment, plain-English report, roadmap (2 to 4 weeks typical) | 1 annual reassessment, 4 quarterly check-ins, async Q&A capped at 4 hours per quarter |
| Does not include | Ongoing quarterly cadence or open-ended advisory | Unlimited hours, deep remediations, or full fractional CISO retainers |
Extra locations on an assessment: fixed fee, scoped on a short call, travel at cost for on-site.
How to decide in three questions
- 1
Do you have a current, usable security risk analysis?
If no, start with the assessment, or confirm multi-site scope on the call.
- 2
Is cyber insurance renewal, a payer questionnaire, or an auditor request on the calendar this year?
A fresh assessment helps now. The annual program helps you stay ready instead of rebuilding every year.
- 3
Do you want a named CISO touchpoint each quarter without a heavy retainer?
The Annual Security Program is built for that light continuity. Practices that outgrow it can discuss fractional CISO retainers separately.
A simple path most practices follow
- 1Book a scoping call and confirm single-site vs multi-site scope
- 2Complete the one-time assessment when you need the report and roadmap
- 3Move into the Annual Security Program when you want reassessment and quarterly check-ins without starting from zero next year
You can also scope the Annual Program directly if you already have a solid recent analysis and mainly need continuity. We decide that together on the call.
Questions about the two options
Is the Annual Program just four more assessments?
No. It is one annual reassessment plus four quarterly check-ins and capped async Q&A. It is continuity, not four full engagements.
If I buy the assessment, do I have to buy the Annual Program?
No. The assessment stands alone. The Annual Program is optional when you want year-round rhythm.
What does prepaid mean for the Annual Security Program?
The Annual Security Program is billed as a fixed fee, scoped on a short call, prepaid, for the agreed year of light continuity. Exact payment terms are confirmed in the SOW after scoping.
Can Harborline implement all the fixes from the report?
Remediation implementation is outside the standard assessment and Annual Program scopes. We can discuss separate catalog work or point you to your MSP or internal IT after the roadmap is clear.
Who is this for?
Practice admins, office managers, and owner-physicians at outpatient and similar healthcare organizations, roughly 5 to 100 staff, plus healthcare vendors and business associates who need the same clarity.
What if we only need help with one questionnaire or renewal?
Say that on the scoping call. Sometimes the right next step is a focused assessment. Sometimes it is questionnaire support scoped separately. We will not force the Annual Program if it is not the fit.
Related pages
How much does a HIPAA risk assessment cost?
How the fixed fee is set, what affects the scope, and what you get in 2 to 4 weeks.
Risk assessment vs penetration test
Two different questions. Here is which one your renewal or auditor is asking about.
HIPAA risk assessment cost and requirements
What the Security Rule asks for and how the analysis is built.
Annual Security Program
Fixed fee, scoped on a short call, with the scope spelled out.
HIPAA Security Rule risk assessment
Deliverables, timing, and how the engagement runs.
About Harborline
Led by senior healthcare security practitioners with former CISO experience.
Questions? Use our contact form.
Decide on a 30-minute call
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.