In partnership with

Year-End Compliance Checkpoint

Q4 is here—and with it comes deadlines, audits, contract renewals, and last-minute scrambles. But for compliance, there’s no reason to wait until December to act. Taking the time now to run a quick checkpoint can help your organization close 2025 clean and set up 2026 for success.

Here’s your quick-start guide to getting it done:

✅ Finish Required Trainings Before the Year Ends

Don’t let expired certifications catch your team off guard. Many regulatory frameworks require annual training or documentation of ongoing education. That means September–November is your sprint window.

Training Completion Checklist:

• HIPAA – General, Compliance Officer, Operators, Business Associates

• Cybersecurity Awareness – includes phishing, ransomware, AI threats

• FERPA – for education-facing teams

• Texas HB 300 – required for Texas providers or clients

• Role-based training (IT, Billing, Answering Services, etc.)

📂 Clean Up Your Evidence Trail

You’ve probably done the work. But can you prove it?

Evidence Hygiene Tips:

• Confirm policies are reviewed and signed for 2025

• Upload new vendor agreements (BAAs, DPAs, MSA updates)

• Recheck system logs and backups are still active and documented

• Store screenshots of risk assessments, access reviews, and audits

• Use consistent naming (e.g., “HIPAA Training Completion – John Smith – 08.2025”)

🛡️ Prepare for Risk Reviews & Incident Response

No one likes emergencies. But the clients, regulators, and insurers that trust you expect readiness.

What to Review Now:

• When was your last risk assessment? If it’s >12 months ago—redo it.

• Do you have an active Incident Response Plan (IRP)?

• Have you tested it this year? Tabletop exercises are ideal for Q4.

• Do you have a named breach contact? Are they still employed?

• Bonus: Update your DR/BCP plan—especially if it hasn't been revised since 2023.

📋 Simple Year-End Compliance Checklist

Here’s a snapshot you can screenshot or save:

✅ Training completion for all required roles
✅ All 2025 policies updated, signed, and uploaded
✅ Evidence folders organized and complete
✅ Risk assessment reviewed or refreshed
✅ IRP and DR/BCP plans tested and updated
✅ Team knows what’s due before year-end

Let’s Wrap 2025 Right

The final stretch of the year is your chance to secure every win and close every gap. Whether it’s completing overdue trainings, organizing evidence, or refreshing your risk strategy, the actions you take now directly shape your compliance story for 2026. Don’t wait for surprises. Take control, finish strong, and show your clients, partners, and auditors that you’re not just compliant—you’re ready.

👉 Book your Year-End Compliance Sprint
Let’s check your training, evidence, risks, and readiness—all in one call.

HHS: Updated Security Risk Assessment Tool Now Available

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR), in collaboration with the Assistant Secretary for Technology Policy (ASTP), has just released Version 3.6 of the Security Risk Assessment (SRA) Tool—a vital resource for organizations working toward HIPAA compliance.

What’s New in Version 3.6:

• ✅ “Reviewed-by” button to record approvals and audit dates

• 📊 Updated NIST-aligned risk scale (“medium” now “moderate”)

• 🧾 Enhanced reports with section-level details

• 🔄 Refreshed library files to reduce vulnerabilities

• 📘 Improved guidance across questions and educational content

This is the perfect opportunity to refresh your HIPAA risk assessments before the end of the year.

Your career will thank you.

Over 4 million professionals start their day with Morning Brew—because business news doesn’t have to be boring.

Each daily email breaks down the biggest stories in business, tech, and finance with clarity, wit, and relevance—so you're not just informed, you're actually interested.

Whether you’re leading meetings or just trying to keep up, Morning Brew helps you talk the talk without digging through social media or jargon-packed articles. And odds are, it’s already sitting in your coworker’s inbox—so you’ll have plenty to chat about.

It’s 100% free and takes less than 15 seconds to sign up, so try it today and see how Morning Brew is transforming business media for the better.

Check it out

ASTAA Conference
📍 Hilton Baltimore, MD
📅 Tuesday-Thursday, September 16–18

ChiroFEST
📍 Hilton Vancouver, WA
📅 Friday-Saturday, September 19–20

👋 Come Visit the VRC Booth!

Plan Ahead:
Budgeting for Compliance Success in 2026

As the year winds down, many organizations are already mapping out their budgets for 2026—and for good reason. Budget season isn’t just about crunching numbers; it’s about planning for growth, stability, and risk management. If compliance isn't already part of your financial roadmap, now is the time to make it a priority.

You Should Budget for Compliance—Now

Compliance is no longer a nice-to-have. It's a critical business function that protects your organization, customers, and reputation. Whether it’s HIPAA, SOC 2, ISO 27001, GDPR, or state privacy laws, regulators expect you to prove that your compliance program is more than just a checklist—it’s a living, breathing part of your operations.

And let’s not forget: if you don’t allocate your 2025 budget dollars before the year ends, you lose them. Use what’s left to get a jumpstart on 2026 and avoid scrambling come Q1.

What to Include in Your 2026 Compliance Budget

Start with these core line items:

• Compliance Program Services – Whether you're starting from scratch or maintaining your status, set aside funds for services that help you manage audits, documentation, training, and ongoing remediation.

• Training & Education – Build in the cost of annual team training for HIPAA, Cybersecurity, PCI, FERPA, and more.

• Security Tools & Assessments – Include penetration tests, tabletop exercises, policy packages, and risk assessments.

• Technology & Platforms – Subscription fees for secure platforms like VRC1 help manage your workflows and audit prep.

• Advisory Support – Fractional CISO or Virtual Compliance Officer services can provide expert guidance without a full-time hire.

Compliance Cost Ranges to Help You Estimate

Here’s a rough ballpark of typical ranges depending on your organization’s size, complexity, and risk profile:

• HIPAA Compliance: $5,000–$15,000

• SOC 2 or ISO 27001: $15,000–$30,000+

• Comprehensive Packages (HIPAA + ISO/SOC + vCISO): $30,000–$60,000+ annually

📌 These ranges cover a mix of services: audit prep, training, policy development, security reviews, platform access, and ongoing support.

Don’t Just Budget—Build a Strategy

Budgeting isn’t just about dollars—it's about direction. Use this season to reassess your risk posture, plan your milestones, and build momentum toward your 2026 goals. And if you’re not sure what to budget or where to start, we’re here to help.

📣 Ready to plan ahead? Schedule a call to get a tailored quote.