PrivaPlan

What PrivaPlan does

PrivaPlan Associates, Inc. is a Santa Fe, New Mexico-based HIPAA compliance consultancy and software provider founded in 2001 by David Ginsberg, Leslie Berkeyheiser, Harry Smith, and Leia Ginsberg. The firm serves healthcare covered entities (physician practices, multi-site clinics, hospitals, health plans, FQHCs), business associates, and adjacent regulated organizations (finance, government) that require HIPAA Privacy Rule, Security Rule, and Breach Notification compliance support, with the firm's methodology field-tested across thousands of organizations over two decades.

Its core offering is the HIPAA Privacy & Security Policy Templates Toolkit, a SaaS-style portal delivery containing 100+ customizable policy templates, step-by-step PrivaGuides, security risk assessment tools, and checklists, available in two editions: a U.S. Standard edition for nationwide buyers and a California edition co-developed with the California Medical Association (CMA). Adjacent products include TrackerReveal (a Cyndelos-powered website compliance tracking tool for tracking technologies and BAA determination) and an AI Compliance Guide for HIPAA Security Rule that bridges the NIST AI RMF with HIPAA Security Standards. The professional services catalog spans Security Risk Analysis, Privacy Compliance Reviews, Data Governance, Managed Phishing Testing, Penetration Testing, Breach Notification, HIPAA Certification, and Education/Training engagements delivered onsite or remotely.

PrivaPlan's revenue mechanics blend subscription toolkit access (1-year at $495, 3-year at $1,200, with CMA member discounts), a $45 standalone AI Guide purchase, an individual/group-priced HIPAA Certification program, and project-based professional services. Its go-to-market is a hybrid self-serve PLG motion (toolkit and AI Guide sold directly via toolkit.privaplan.com and cma-toolkit.privaplan.com) combined with inside sales for services and mid-market engagements, channel distribution through the CMA partnership into California physicians, and an active content marketing engine (blog, newsletter, LinkedIn, Vimeo) supporting organic demand generation.

Name

PrivaPlan

Legal name

PrivaPlan Associates, Inc.

Website

https://privaplan.com

Company type

Private

Founded year

2001

Operating status

Operating

Headcount range

1–10 employees

Short description

PrivaPlan Associates provides HIPAA Privacy and Security compliance toolkits, AI-compliance guidance, training, and consulting to healthcare providers, business associates, and adjacent regulated entities, with a CMA-co-branded California edition and a recently launched AI compliance guide.

Ownership category

akta.pro rank

Product category

HIPAA Compliance Software

NAICS

Other Computer Related Services (541519), Computer Systems Design and Related Services (5415)

SIC

Services-Prepackaged Software (7372), Services-Misc Health & Allied Services, Nec (8090)

akta.pro primary industry

Privileged Access Management (PAM) & Session Control (HLACAJAB)

akta.pro secondary industries

Privacy Management (Consent, DSAR, RoPA) (HDADAFAH), IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK), Data Security & Privacy Managed Services (DLP/Encryption) (BPAEADAL)

Keywords

• HIPAA compliance solutions
• Security risk analysis
• Privacy and security compliance
• Healthcare compliance consulting
• Compliance policy templates

Headquarters

HQ city

Santa Fe

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations

Revenue model

1. Toolkit Subscription: Annual and multi-year subscription access to the HIPAA Privacy & Security Toolkit delivered via a secure online portal. Subscriptions include access to policy templates, PrivaGuides, risk assessment tools, checklists, and training materials. Available in two editions: U.S. Standard and California (CMA-backed).
2. AI Compliance Guide (standalone): One-time purchase of the 'Ensuring HIPAA Compliance in Generative AI Systems' guide for $45. This guide is also included with the Toolkit subscription.
3. HIPAA Certification Program: Self-paced online HIPAA certification program for individuals responsible for HIPAA compliance. Pricing available upon inquiry; individual and group pricing options offered.
4. Professional Services: Consulting services including HIPAA Privacy Compliance Reviews, Security Risk Analyses, HIPAA Education & Literacy Training, Breach Notification Management, Disaster & Recovery Planning, Vendor Risk Assessments, Penetration Testing, Managed Phishing, Data Governance, and Policies & Procedures Development. Delivered as onsite or remote engagements.

Pricing tiers

Go-to-market motion1 record

Distribution channels3 records

Marketing channels6 records

Core offering

PrivaPlan provides HIPAA Privacy and Security compliance solutions through a software-as-a-service Toolkit platform (100+ customizable policy templates, PrivaGuides, security risk assessment tools, and breach assessment documents delivered via secure online portal in U.S. Standard and California/CMA editions) and a portfolio of professional consulting services. The Toolkit is sold via annual and multi-year subscriptions, complemented by onsite/remote risk analyses, breach notification management, managed phishing, penetration testing, training, and certification services for covered entities, business associates, health plans, and government organizations.

Product overview

PrivaPlan is a HIPAA compliance solutions provider offering a platform of software toolkits and professional services. The core product is the HIPAA Privacy & Security Policy Templates Toolkit, available in two editions (Standard U.S. and California/CMA), which provides over 100 customizable policy templates, PrivaGuides, and security risk assessment tools. The toolkit includes an AI Guide add-on for HIPAA Security Rule compliance with generative AI systems. Additional products include TrackerReveal for website compliance tracking. The service portfolio encompasses Security Risk Analysis, Privacy Compliance Reviews, Data Governance, Disaster Recovery Planning, Managed Phishing Testing, Penetration Testing, Breach Notification Management, HIPAA Certification, Education & Training, and Policies & Procedures Development.

Differentiator

Problem solved

Functional benefit

Brands

• TrackerReveal: Website compliance tracking tool powered by Cyndelos, designed to identify potential risks associated with tracking technologies and help determine whether Business Associate Agreements are needed with tracking companies.

Products and services

• HIPAA Privacy & Security Policy Templates Toolkit (Standard U.S. Edition) SaaS-delivered compliance Toolkit providing 100+ customizable HIPAA policies, procedures, templates, PrivaGuides, security risk assessment checklists, and training materials for covered entities and business associates nationwide, accessed via secure online portal at toolkit.privaplan.com.
• HIPAA Privacy & Security Policy Templates Toolkit (California / CMA Edition) Specialized California Toolkit edition developed in partnership with the California Medical Association, addressing state-specific compliance requirements and stricter California privacy laws alongside federal HIPAA, accessed via cma-toolkit.privaplan.com.
• AI Guide for HIPAA Security Rule Standalone guide for healthcare organizations to incorporate generative AI tools without compromising HIPAA Security compliance, bridging NIST AI RMF with HIPAA Security Standards and providing guidance on configuring AI Ambient Scribe settings and establishing AI governance.
• TrackerReveal Website compliance tracking tool that scans websites to identify potential risks associated with tracking technologies (cookies, pixels, other trackers), helps determine BAA requirements with tracking companies, and provides dashboard reports with risk-ranked findings. Powered by Cyndelos.
• HIPAA Security Risk Analysis Service Full security risk analysis program delivered via onsite or remote engagements, evaluating administrative, physical, technical, and organizational safeguards using PrivaPlan's proprietary methodology integrated with NIST and ONC guidance.
• HIPAA Privacy Compliance Review Comprehensive analysis of privacy compliance programs, evaluating patient rights processes, 21st Century CURES Act compliance, forms and notices, policies and procedures, workforce training, and Business Associate management.
• HIPAA Breach Notification Service Breach investigation, risk assessment, and notification management services including determination of breach occurrence, probability assessment, and Office for Civil Rights notification.
• HIPAA Certification Program Self-paced online HIPAA certification program for individuals responsible for HIPAA compliance, with individual and group pricing options offered upon inquiry.
• HIPAA Education & Literacy Training Training options including live on-site training, self-paced online courses, security reminder videos, and customized training tailored to organizational policies and procedures.
• Managed Phishing Testing & Cybersecurity Awareness Training Managed phishing testing and cybersecurity awareness training program including customizable campaigns, email templates, data reporting, and follow-up training to reduce organizational risk.
• Penetration Testing Service Penetration testing services assessing system security by identifying weaknesses and strengths through simulated cyberattacks against computer systems.
• Disaster & Recovery Planning Service Contingency, emergency mode, data backup, and disaster recovery planning services ensuring HIPAA Security Rule compliance and business continuity.
• Data Governance Service Data governance infrastructure customized for organizational needs and size, including data classification, criticality programs, ownership identification, regulatory compliance, and vendor management.
• Policies & Procedures Development Service Policy and procedure development services tailored to organizational structure, operational processes, and compliance obligations including gap assessment and roadmap development.
• Privacy Risk Assessment Service Comprehensive privacy risk assessments for corporations, healthcare providers, and government agencies identifying, evaluating, and mitigating potential privacy risks, including information security infrastructure assessment and vulnerability testing.
• Vendor Risk Assessment Service Vendor risk assessment services evaluating third-party vendor security protocols, compliance efforts, and potential risks to ensure confidentiality and integrity of data.

Quantifiable outcome

• Thousands of security risk analyses conducted for organizations of varying sizes and types
• +2 more outcomes

Named customers7 records

Segments5 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability2 records

Feature6 records

Partnerships

Three partnerships are on record, tiered flagship, core and minor.

• California Medical Association (CMA)flagshipStrategic or Co-development PartnerPrivaPlan developed a Specialized California Edition of its HIPAA Toolkit in partnership with the California Medical Association to address California state-specific compliance requirements. The CMA Toolkit meets stricter California state-level privacy laws alongside federal HIPAA requirements. CMA members receive exclusive discount pricing on the toolkit subscription.
• CyndeloscoreTechnology or IntegrationTrackerReveal, PrivaPlan's website compliance tracking tool, is powered by Cyndelos. The tool scans websites to identify tracking technologies, assess BAA requirements, and provide risk-ranked compliance reports. Cyndelos provides the underlying technology platform for TrackerReveal.
• Infowerks Data Services LLCminorOthersListed as a partner link on the Privacy & Security Services page. Infowerks Data Services LLC is a software vendor partner.

Scale indicators4 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Accountable HQ: HIPAA compliance management platform offering policies, training, and risk assessment tools for small healthcare practices. Closely matches PrivaPlan's SMB healthcare focus and toolkit-style product.
• Compliancy Group: HIPAA-focused compliance software and consulting platform serving small and mid-sized healthcare providers. Closely comparable in target customer (SMB healthcare), template/toolkit-based product approach, and consulting-plus-software model.
• Secureframe: Compliance and security automation platform with HIPAA among its supported frameworks. Offers automated evidence collection that competes with traditional consulting-and-template HIPAA providers like PrivaPlan.
• SecurityMetrics: Provides HIPAA compliance solutions, security assessments, and penetration testing for healthcare merchants and providers. Overlaps with PrivaPlan's professional services including risk analysis, penetration testing, and managed security.
• Vanta: Automated compliance platform covering SOC 2, ISO 27001, HIPAA, and other frameworks with continuous evidence collection. Competes for the same healthcare buyer but offers a more automated, multi-framework alternative to PrivaPlan's toolkit model.
• HIPAA One: HIPAA compliance software platform providing risk analysis, policy templates, and training for healthcare organizations. Directly comparable niche focus on HIPAA with a similar SaaS-plus-services delivery model.
• Clearwater Compliance: Healthcare cybersecurity and HIPAA compliance consultancy offering risk analysis, OCR audit support, and managed services. Comparable in healthcare-specific focus and services-led delivery model.
• Drata: Compliance automation platform that streamlines SOC 2, ISO 27001, HIPAA, and other audits through continuous monitoring. Targets the same compliance buyer with a more automated PLG approach compared to PrivaPlan's template-based toolkit.

Broad incumbents

• A-LIGN: Larger cybersecurity and compliance firm offering HIPAA assessments alongside SOC 2, ISO 27001, PCI, and HITRUST. Broader scope than PrivaPlan but competes in healthcare compliance risk analysis and certification.
• Coalfire: Major cybersecurity advisory and assessment firm with a dedicated healthcare practice covering HIPAA, HITRUST, and medical device security. Larger incumbent competing for healthcare risk analysis and compliance consulting work.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights6 records

Customer concentration

• YouTubevimeo.com/privaplan
• LinkedInlinkedin.com/company/privaplan-associates-inc-

Revenue estimate

Valuation estimate

Number of profiles

Profiles10 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about PrivaPlan