Terms of Service

---

  1\. Acceptance of Terms  These Terms of Service (\"Terms\") constitute a legally binding agreement between you (\"User,\" \"you,\" or \"your\") and Vanguard Advisory LLC (\"Vanguard Advisory LLC,\" \"we,\" \"us,\" or \"our\"), an independent consulting firm, governing your access to and use of the HIPAA Security Risk Assessment Tool, any related reports and outputs, and Vanguard Advisory LLC\'s consulting services (collectively, the \"Services\").  By accessing or using the Tool in any manner, including by clicking \"Begin Assessment,\" you represent that: (a) you have read and agree to these Terms; (b) you have the authority to bind yourself and, if applicable, your organization; and (c) you are at least 18 years of age. If you do not agree to these Terms, you must not access or use the Tool.  2\. Description of Services  Vanguard Advisory LLC offers the following services. Each is described below and governed by these Terms unless a separate written agreement applies.  2.1 Free HIPAA Readiness Assessment  The web-based assessment tool allows any user to complete a 36-question readiness assessment aligned with the HealthIT.gov SRA v3.6 framework. Upon submitting contact information, users receive a free readiness score, section-by-section breakdown, top findings, and three priority recommendations. The free assessment is a self-reported preliminary gap analysis only.  2.2 PDF Report --- \$299  A branded, 6-page Vanguard Advisory LLC PDF report documenting your readiness score, all findings with HIPAA CFR citations, top remediation priorities, and a complete question-and-answer log formatted for board presentations, investor due diligence, and audit documentation. Delivered by digital download upon payment.  2.3 PDF Report + Comprehensive Remediation Plan --- \$599  Everything in the \$299 PDF Report, plus a full step-by-step remediation plan for every identified gap. The plan is organized into three phases (0--30 Days, 30--90 Days, 90+ Days) and includes assigned owner, timeline, estimated effort, evidence requirements, and policy template identification for each action item.  2.4 Reviewed Assessment --- \$999  Everything in the \$599 bundle, plus review and validation of findings by a named Vanguard Advisory LLC advisor. The advisor applies professional judgment to the AI-generated analysis, adjusts findings as appropriate based on organizational context, and provides a signed report. This tier produces a stronger, advisor-validated deliverable suitable for stakeholder reporting and regulatory documentation.  2.5 Full Risk Analysis Engagement --- \$2,500 to \$5,000+  A complete, six-phase HIPAA Security Rule risk analysis engagement conducted by a Vanguard Advisory LLC advisor. This engagement is governed by a separate Consulting Services Agreement executed between the parties and includes: (a) AI-assisted readiness assessment; (b) document review; (c) structured stakeholder interviews; (d) technical spot verification; (e) a comprehensive advisor-reviewed risk analysis report addressing all eight components required under OCR guidance at 45 CFR § 164.308(a)(1)(ii)(A); and (f) a 60-minute delivery call. Pricing is based on organization size. The Full Risk Analysis Engagement is advisory only --- Vanguard Advisory LLC does not implement security controls, write policies, or configure systems as part of this engagement.  The Full Risk Analysis Engagement is the only Vanguard service that is designed and intended to contribute to satisfying the HIPAA Security Rule\'s risk analysis requirement. All other tiers described in Sections 2.1--2.4 are gap assessments and readiness tools, not complete risk analyses.  3\. Informational Purposes Only --- No Legal Advice  **THE TOOL AND ALL OUTPUTS ARE PROVIDED FOR INFORMATIONAL PURPOSES ONLY. NOTHING IN THE TOOL, ITS OUTPUTS, OR ANY RELATED COMMUNICATIONS FROM VANGUARD ADVISORY CONSTITUTES LEGAL ADVICE, COMPLIANCE CERTIFICATION, OR A GUARANTEE OF HIPAA COMPLIANCE.**  Specifically, you acknowledge and agree that:  -   Sections 2.1 through 2.4 of the Tool do not constitute a     comprehensive HIPAA risk analysis as defined under 45 CFR §     164.308(a)(1)(ii)(A) and are not a substitute for one conducted by a     qualified compliance professional;  -   Results generated by the Tool are based solely on your self-reported     responses and AI-assisted analysis, and may not reflect all risks,     vulnerabilities, or compliance gaps applicable to your organization;  -   Use of the Tool does not ensure, certify, or demonstrate compliance     with HIPAA, the HITECH Act, or any federal, state, or local law or     regulation;  -   Vanguard Advisory LLC is not a law firm, and no attorney-client     relationship is formed through your use of the Tool or any related     services;  -   You should consult with a qualified attorney, compliance officer, or     healthcare compliance professional before making decisions based on     the Tool\'s output.  4\. User Representations and Responsibilities  By using the Tool, you represent, warrant, and agree that:  -   You will provide accurate, complete, and truthful responses to all     assessment questions;  -   You will not enter actual Protected Health Information (PHI) or     personally identifiable patient data into any field within the Tool,     including the notes fields;  -   You are using the Tool solely for your own organization\'s internal     assessment purposes and not on behalf of a third party without     authorization;  -   You will not resell, redistribute, sublicense, or share access to     the Tool or its outputs for commercial purposes without prior     written consent from Vanguard Advisory LLC;  -   You will not attempt to reverse-engineer, copy, or replicate the     Tool\'s methodology, scoring logic, or proprietary framework;  -   You will not use the Tool for any unlawful purpose or in violation     of any applicable law or regulation.  5\. Prohibition on Entry of Protected Health Information  The Tool is designed to assess organizational security practices and policies --- not to process, store, or transmit actual patient data. You must not enter any Protected Health Information (PHI), as defined under 45 CFR § 160.103, into any field within the Tool, including but not limited to patient names, dates of birth, medical record numbers, diagnosis codes, or any other individually identifiable health information.  If you inadvertently enter PHI into the Tool, you must notify Vanguard Advisory LLC immediately at faiz@vanguardadvisory.co. Vanguard Advisory LLC will take reasonable steps to delete such information from its systems and from the systems of its third-party processors.  6\. Artificial Intelligence and Third-Party Processing  The Tool uses artificial intelligence technology provided by Anthropic, PBC to analyze your assessment responses and generate reports. By using the Tool, you acknowledge and consent to your assessment responses being transmitted to and processed by Anthropic\'s systems in accordance with Anthropic\'s Privacy Policy and Terms of Service.  Vanguard Advisory LLC has entered into, or will enter into prior to processing any data that may constitute ePHI, a Business Associate Agreement (BAA) with Anthropic as required under HIPAA. However, you are solely responsible for ensuring that your use of the Tool complies with your own HIPAA obligations.  AI-generated outputs may contain errors, omissions, or inaccuracies. All outputs for the \$999 Reviewed tier and the Full Risk Analysis Engagement are reviewed and approved by a named Vanguard Advisory LLC advisor before delivery. For tiers 2.1 through 2.3, AI-generated outputs are not independently reviewed by a human advisor. Vanguard Advisory LLC does not warrant the accuracy, completeness, or reliability of any AI-generated content.  7\. Intellectual Property  The Tool, including but not limited to its design, methodology, risk scoring framework, question bank, report templates, software, and all associated content, is the exclusive proprietary property of Vanguard Advisory LLC and is protected by applicable intellectual property laws.  Subject to your compliance with these Terms, Vanguard Advisory LLC grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Tool solely for your organization\'s internal compliance assessment purposes.  You retain ownership of the specific report generated from your individual assessment responses. Vanguard Advisory LLC retains all rights to the Tool, its methodology, and the underlying framework.  8\. Payment Terms and Refund Policy  Certain tiers of the Tool require payment. By submitting payment, you agree to pay all applicable fees at the rates displayed at the time of purchase. All prices are in U.S. dollars.  Refund Policy: Because the Tool generates a digital report upon completion of the assessment, all sales are final. No refunds will be issued after a report has been generated. If you experience a technical failure that prevents report generation, please contact us at faiz@vanguardadvisory.co within 48 hours and we will investigate and, at our discretion, provide a credit or re-generate your report.  Full Risk Analysis Engagements are governed by the payment terms in the separate Consulting Services Agreement. The refund policy in this Section does not apply to Full Risk Analysis Engagements.  Vanguard Advisory LLC uses Stripe, Inc. for payment processing. Your payment information is collected and stored by Stripe and is subject to Stripe\'s Privacy Policy and Terms of Service. Vanguard Advisory LLC does not store your full credit card information.  9\. Disclaimers of Warranties  **THE TOOL IS PROVIDED \"AS IS\" AND \"AS AVAILABLE\" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, OR NON-INFRINGEMENT.**  Vanguard Advisory LLC does not warrant that: (a) the Tool will be uninterrupted, timely, secure, or error-free; (b) the results obtained from the Tool will be accurate, complete, reliable, or current; (c) the Tool will identify all security risks, vulnerabilities, or compliance gaps in your organization; or (d) any errors in the Tool will be corrected.  10\. Limitation of Liability  **TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, VANGUARD ADVISORY SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, GOODWILL, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF THE TOOL.**  In no event shall Vanguard Advisory LLC\'s total cumulative liability to you for all claims arising out of or related to these Terms or your use of the Tool exceed the greater of: (a) the total amount paid by you to Vanguard Advisory LLC in the twelve (12) months preceding the claim; or (b) one hundred U.S. dollars (\$100).  11\. Indemnification  You agree to indemnify, defend, and hold harmless Vanguard Advisory LLC and its officers, directors, employees, agents, and contractors from and against any claims, liabilities, damages, losses, and expenses, including reasonable attorneys\' fees, arising out of or in any way connected with: (a) your access to or use of the Tool; (b) your violation of these Terms; (c) your violation of any applicable law or regulation; (d) the inaccuracy of any information you provide through the Tool; or (e) any actual or alleged infringement of any third-party rights by you.  12\. Modifications to Terms and Tool  Vanguard Advisory LLC reserves the right to modify these Terms at any time. We will notify you of material changes by updating the \"Effective Date\" at the top of this document and, where practicable, by providing notice through the Tool or via email. Your continued use of the Tool after any such modification constitutes your acceptance of the revised Terms.  13\. Governing Law and Dispute Resolution  These Terms shall be governed by and construed in accordance with the laws of the State of Maryland, without regard to its conflict of law provisions. Any dispute arising under these Terms shall first be subject to good-faith negotiation. If unresolved within thirty (30) days, disputes shall be submitted to binding arbitration under the rules of the American Arbitration Association, conducted in English in Howard County, Maryland. Judgment on any arbitration award may be entered in any court of competent jurisdiction.  14\. Contact Information  For questions about these Terms of Service, to report a potential PHI entry, or to request support, please contact Vanguard Advisory LLC at:  **Vanguard Advisory LLC**  **Email:** faiz@vanguardadvisory.co  **Website:** vanguardadvisory.co  **Date of Last Revision:** March 16, 2026