Disclosure & methodology
How we make money, in plain terms.
Last updated: July 12, 2026
The short version: when we connect you with a specialist, their firm may pay us for the referral. That never changes what your Scorecard or review tells you. Here are the details.
How the free review is paid for
The Scorecard and the written review are free to you. If your review surfaces gaps you want help with, we may introduce you to a compliance specialist who does that work, when there’s a fit. If we make that introduction, their firm may pay us a referral fee.
You never pay us, and the fee never changes what your review says. If the honest finding is that your practice is in good shape, that is what we tell you, referral or not.
How we choose a specialist
We will not hand you to whoever pays the most. A specialist has to clear a real bar before we introduce you to them:
Coverage where you are. They can serve a practice in your area, not just one distant region.
Built for small practices. A one-to-ten-person office, not a hospital system with its own compliance team.
Clear, upfront pricing. A written quote before you commit.
A clean reputation. No pattern of complaints or bad-faith dealing.
The introduction is ours to make; the decision is yours. Do your own due diligence before hiring anyone. We do not control how a specialist runs their business, and we do not warrant their work, their conduct, or any result.
How we handle your information
We run the review ourselves, and your answers come to us. We share your details with a specialist only if we refer you after that review, and only that one partner. We do not sell or rent your information to data brokers, hand it to multiple companies, or share it for unrelated advertising. What we collect, why, how long we keep it, and how to have it deleted is laid out on our Privacy page.
How we decide what to tell you
Whether we are scoring your practice or writing about a tool, we use the same yardstick: what the HIPAA Security Rule actually requires, what fits a one-to-ten-person practice, the real cost over a year, and how much day-to-day friction it adds.
The referral fee is not on that list. When the right answer earns us nothing, that is still the answer we give.
What we will not do
We will not bury disclosures in tiny gray text. We will not accept payment in exchange for a better score or a favorable write-up. We will not call any product “100% HIPAA compliant,” because none is. Compliance depends on how you configure and use it, and anyone who tells you otherwise is selling something.
Educational content disclaimer
Hipsana provides informational content about cybersecurity and HIPAA compliance. We are not attorneys, compliance officers, or healthcare professionals. Nothing here is legal, regulatory, medical, or financial advice. For questions specific to your practice, consult a qualified professional. Regulations change; verify current requirements with the relevant regulator (HHS, OCR, FTC) before acting.
Questions or corrections
If you spot an error we should fix, or a conflict of interest we should disclose, email hello@hipsana.com. We respond to corrections within a few business days and note material changes with a date.
And if you want to see the review this page describes, start with the free Scorecard. It scores your practice and names your biggest gap in about three minutes. It is a starting point, not a full audit.