Terms of service

CoreFolio is self-assessment software for US healthcare practices. The first product, HIPAA CoreFolio, guides you through an annual HIPAA risk analysis under 45 CFR § 164.308(a)(1)(ii)(A) and a matching risk management plan under 45 CFR § 164.308(a)(1)(ii)(B). It produces structured, dated documentation you can use internally and share with your privacy officer or counsel.

CoreFolio is not legal advice. It is not an audit, an attestation, or a certification. No use of CoreFolio constitutes a representation to HHS, OCR, or any other body that your practice is in compliance with any law or regulation. A determination of HIPAA compliance is made by HHS OCR, not by software.

CoreFolio is intended for US-based covered entities and business associates as defined under HIPAA. You represent that you have authority to conduct a risk analysis on behalf of the practice or organization you are assessing. CoreFolio is not intended for use by individuals assessing practices they do not represent.

Assessment answers stay in your browser. We do not receive or store them. See our Privacy notice for the full account of what we do and do not collect.

Reports you generate are yours. You may use, share, and retain them for any internal compliance purpose. We make no claim to the content of the reports you produce.

Paid tiers are billed monthly or annually via Stripe. You can cancel at any time; cancellation takes effect at the end of the current billing period. No setup fees, no cancellation penalties. Reports you have downloaded are yours to keep after cancellation.

Prices are in US dollars. We reserve the right to change pricing with 30 days’ notice to active subscribers.

You agree not to:

• Use CoreFolio to produce documentation you represent as attorney-reviewed, HHS-approved, or officially certified
• Resell, sublicense, or otherwise commercialize CoreFolio’s output on behalf of third parties without written agreement with us
• Attempt to reverse-engineer, scrape, or extract the assessment question bank or content in bulk
• Use automated tools to submit forms or interact with the assessment outside of a real browser session

CoreFolio is provided “as is.” We make no warranty, express or implied, that using CoreFolio will satisfy any legal obligation, prevent an OCR investigation, or produce a specific audit outcome. The regulatory landscape changes; we work to keep our content current but cannot guarantee that every question reflects the most recent guidance at the moment you use it.

We recommend that any ambiguous findings be reviewed with a qualified privacy officer or healthcare attorney before you act on them.

To the maximum extent permitted by law, CoreFolio’s liability to you for any claim arising from your use of the service is limited to the amount you paid us in the 12 months preceding the claim. We are not liable for indirect, incidental, consequential, or punitive damages.

We may update these terms. If the change is material, we will notify active subscribers by email with at least 14 days’ notice before the new terms take effect. Continued use after the effective date constitutes acceptance. The “Last reviewed” date at the top of this page is updated whenever the terms change.

These terms are governed by the laws of the State of California, without regard to conflict of law provisions. Any dispute arising from these terms will be resolved in the state or federal courts located in California.