Calm pricing for a stressful topic.
Free triage and self-check forever. Annual subscriptions for the full library and a 4-hour incident-response SLA on the Retainer tier.
Travis Barlow — 25+ years in incident response, 580+ engagements, founder of AtlSecCon, one of Canada's longest-running security conferences. No SDR, no junior associate — you talk to the person who's run this incident before.
Less than the fine for a 5-record breach with no documentation.
Get started →| What's included | Free | Practice | + Retainer |
|---|---|---|---|
| Triage tool | Included | Included | Included |
| HIPAA self-check | Included | Included | Included |
| Phase 1 playbooks (4 available now) | Included | Included | Included |
| All 12 incident playbooks | Included | Included | Included |
| Regulatory grid updates | Not included | Included | Included |
| Annual SRA checklist | Not included | Included | Included |
| BAA at signing | Not included | Included | Included |
| Annual tabletop exercise | Not included | Not included | Included |
| Priority incident response | Not included | Not included | 4-hr SLA |
| Insurer questionnaire help | Not included | Not included | Included |
| Named point of contact | Not included | Not included | Included |
Multi-location practices: location 2 at 60% of base rate, locations 3+ at 50%. Volume break begins at 3 sites.
Twelve playbooks, all live.
Every incident scenario in the library is published and open to everyone.
Browse the playbooks →Pricing FAQ
Does the free tier require a login?+
No. The triage tool and the HIPAA self-check are use-without-signing-in by design. Nothing you click on either page leaves your device.
What is a BAA and why does it matter?+
A Business Associate Agreement is a contract required under HIPAA between a covered entity (your practice) and any vendor that handles PHI on your behalf. Without a signed BAA, sharing PHI with the vendor is itself a HIPAA violation. We include a current BAA at signing on the paid tiers.
Is pricing under most state single-quote thresholds?+
Yes — pricing is designed to fall under the single-vendor-quote thresholds most Medicare-billing practices operate against, so procurement is straightforward.
Can I pay monthly?+
Yes, on the Practice tier (CA$85/month). The Retainer tier is annual only because it includes a tabletop exercise and a named contact.
What if I'm in an active incident — can I upgrade right now?+
Yes. Same-day upgrades from Free to Practice or Retainer are routine. Email hello@medical.hackfirstaid.com or use the contact form — we respond within one business hour during US Eastern business hours.