Last updated: Oct 16, 2026
These Terms and Conditions (the “Terms”) govern your use of HealthData DueCare (the “Service”), provided by MTC Group LLC (“MTC Group,” “we,” “us”). You accept these Terms and our Privacy Policy when you create an account, after reviewing both, and again when you make a purchase. If you use the Service for an organization, you confirm that you are authorized to accept these Terms on its behalf, and “you” includes that organization. If you do not agree, do not use the Service.
The Service helps organizations build, run and evidence an information security and privacy compliance program. It includes:
Features and plans may change over time. A paid plan includes the features described when you buy it.
Who the platform is for. The platform is built for organizations that HIPAA applies to: covered entities and business associates. Before your first platform subscription, retainer or assessment purchase we ask four questions to determine which your organization is. If your answers show it is neither, HIPAA does not apply to it, the platform would give it a program it has no obligation to meet, and we do not sell it a subscription. You are responsible for answering accurately: setup asks the same questions again, and an organization HIPAA does not apply to cannot be created. Template packs are sold separately, need no HIPAA status, and are covered by section 9.
The Service, its templates and MTC Group’s fCISO and RSP Assessment services support your own compliance program. They are not legal advice, and MTC Group is not a law firm. Readiness percentages, status indicators, generated documents, the RSP Assessment Report and anything published on a Trust Hub reflect the information your organization provides and MTC Group’s professional review of it. None of them is a certification, an audit opinion or a determination by any regulator. In particular:
MTC Group does not perform those examinations or audits and does not guarantee their outcome.
You must give accurate information and keep it current, keep your sign-in credentials confidential, and are responsible for activity under your account. Your organization’s administrators decide who is invited and what each person can do, and are responsible for the users they invite. People invited as general workforce can reach only their own training, policy reading and acknowledgments, questions about the policies, and their own support tickets; they cannot see or change the organization’s program records. Tell us promptly if you believe an account has been compromised.
Information you enter or upload about your organization (“Your Data”) remains yours. You allow MTC Group to host, process and display Your Data to provide and support the Service and to perform the fCISO and RSP Assessment services you buy.
The Service tracks a compliance program; it is not a system of record for patient information. Do not enter or upload protected health information (PHI), patient names or other patient identifiers. Where a record must refer to a patient matter, use an internal reference number. Because the Service is not designed to receive PHI, MTC Group does not act as your business associate by providing it. The RSP Assessment, InfoSec Advisor and fCISO services never require MTC Group to receive PHI, but the professional may see it on your own systems; before any of them begins, your Executive Sponsor or Privacy Official signs MTC Group’s business associate agreement online, in the Service (Accounts and access).
You are responsible for the accuracy of Your Data and for having the right to enter information about other people, such as your workforce, vendor contacts and the people named in your registers.
Evidence uploads are limited to common document, image, spreadsheet and text formats. We check a file’s contents against its type and may refuse one that does not match.
AI features. AI features are off until your Site Admin turns them on in Settings, acknowledging that files, questions and records sent to AI review must not contain patient information. When they are on, each file you upload as evidence is read by an AI model against what the record it is attached to asks for, and you are shown points to check, such as a missing approval, a review more than 12 months old, or a document that does not cover the requirement. These points are suggestions for a person at your organization to consider. They are not a determination of compliance, they change no status in the Service, and they are not part of an RSP Assessment’s conclusions. Before anything is sent, the Service checks it for patient information and sends nothing it flags; images and scanned PDFs are not sent. A file that appears to contain patient information is flagged so your Site Admin or Privacy or Security Official can remove it.
Prices are those shown at checkout, plus any applicable taxes. Payments are processed by Stripe; MTC Group does not receive or store full card numbers.
The fCISO retainer is an add-on to a qualifying platform subscription, in tiers matching the platform plan (HIPAA, SOC 2 and ISO/IEC 27001/2). It is billed monthly with a minimum commitment of three months for the HIPAA tier and six months for the SOC 2 and ISO/IEC 27001/2 tiers, which you accept at checkout, and cannot be cancelled before the minimum term ends. When you end a retainer, it continues, and is billed, until the later of the end of the minimum term and the end of the current billing period, then stops. There is no refund and no early termination fee. If you change platform plans, the retainer either moves to the matching tier, which starts that tier's minimum term again from the date of the move (six months for SOC 2 or ISO/IEC 27001/2, and never ending earlier than the current minimum term), or ends on the same basis. If you cancel your platform subscription, the retainer ends on the same basis and the platform subscription continues until the retainer ends. An organization holds one retainer at a time.
The retainer is delivered by an fCISO MTC Group engages, whom your organization adds to its account and may remove at any time. No retainer tier includes the Recognized Security Practices Assessment: it is always its own fee, performed by an independent RSP Assessor, never by your own fCISO (see section 8). For SOC 2 and ISO/IEC 27001, the retainer covers readiness support and coordination with your chosen CPA firm or certification body; it never replaces their examination or audit.
Recommendations from an fCISO, InfoSec Advisor or RSP Assessor are professional opinions based on the information your organization provides. Your organization makes, and is solely responsible for, every decision about its program, including whether and how to act on a recommendation. MTC Group does not guarantee any regulatory, audit, certification or security outcome. The professionals MTC Group engages are independent contractors, bound to MTC Group by written agreements that include confidentiality and a subcontractor business associate agreement; they have no authority to bind MTC Group.
The InfoSec Advisor is an add-on to any platform subscription: a credentialed professional MTC Group engages who coaches your own team through your program, read only. Your team does the work and remains responsible for the program; the InfoSec Advisor is not your organization’s designated security official. It is billed monthly with a minimum commitment of three months, which you accept at checkout, and cannot be cancelled before the minimum term ends. When you end it, it continues, and is billed, until the later of the end of the minimum term and the end of the current billing period, then stops, and the advisor leaves your account; the same happens if you cancel your platform subscription. There is no refund and no early termination fee. It does not include the Recognized Security Practices Assessment, which is purchased separately, and your InfoSec Advisor never performs it. An organization has an fCISO retainer or the InfoSec Advisor, not both. You can move from the InfoSec Advisor to an fCISO retainer once the Advisor’s minimum term has ended; the minimum term remains payable and there is no refund.
Your organization chooses, once for its whole HIPAA program, between the OCR minimum (the standards and implementation specifications of the HIPAA Security Rule) and NIST (the same standards carried out to NIST SP 800-66 Rev. 2’s key activities). A program on the OCR minimum files a self-attestation by management, with no independent assessment, and cannot receive an RSP Assessment or any RSP report. Only a NIST program can.
For a NIST program, filing is free. For 30 days after your organization files, you may buy the RSP Program Established Report, which records that the NIST program is in place as of the report’s date. If you do not, the next RSP report is the RSP Actively Managed Report, available 12 months after that filing once your organization has held its platform subscription for 12 continuous months; it records that the practices were in place for the preceding 12 months. The RSP Actively Managed Report is good for 12 months. We send a renewal notice 90 days before it expires, and a renewal must be bought at least 30 days before it expires. If it is not, one RSP Bridge Letter may be bought, before expiry, to extend the distinction by 90 days, and the renewal must then be bought within 30 days after the Bridge Letter ends; otherwise the distinction lapses and your organization starts again from a new filing and a new RSP Program Established Report. Each RSP report costs $1,449 and the Bridge Letter $449.
Every RSP report requires an active platform subscription when it is bought. No RSP report is included in a platform plan, a retainer or the InfoSec Advisor. Before paying you acknowledge that a report is issued only when its conditions are met and that gaps come back as findings for you to address. Each assessment includes a one-hour virtual interview. An independent RSP Assessor engaged by MTC Group assesses the program as filed, may record findings for you to address, and issues the report, which records the assessment as of its date (see section 3). The RSP Assessor is never an fCISO who helps build or run your program, now or in the twelve months before. RSP fees are not refundable.
A template pack is a one-time purchase of downloadable files. It grants your organization a non-exclusive, non-transferable license to use and adapt the files for its own internal compliance program. You may not resell, redistribute or publish the templates, or use them to provide services to others, unless MTC Group agrees in writing. Because packs are delivered digitally, template pack purchases are not refundable. The templates are starting points to adapt to your organization (see section 3).
You choose whether to publish a Trust Hub page and what appears on it. Anything you publish can be seen by anyone with the link. You are responsible for its accuracy and for having the right to share it. MTC Group may remove published content that breaches these Terms.
The Service may list independent CPA firms, certification bodies and penetration testing firms that MTC Group has vetted and has an agreement with. They are independent businesses, not MTC Group’s agents. You contact and contract with any firm directly. MTC Group is not a party to that engagement and is not responsible for the firm’s work, fees or results. Listing is free for firms. When you engage a listed firm through the Service, the firm pays MTC Group a platform fee of ten percent (10%) of the fees for that engagement under its agreement with MTC Group, and discloses the fee to you in writing before you engage it; MTC Group charges you nothing for it. The fee does not affect which firms are listed or their order, and MTC Group receives nothing else of value from any listed firm. Firms are listed alphabetically and never ranked or recommended over one another; a firm is listed only while it meets MTC Group’s published vetting criteria, and is removed from the list when a required item lapses. Prices shown are the prices the firm published and agreed to honor; an estimate is calculated only from those prices and the figures you enter, and the firm’s own quote governs your engagement. If MTC Group ever has another relationship with a listed firm, it will be disclosed on that firm’s listing. The Service records when you choose or contact a firm, so MTC Group can support the relationship and re-verify the firm.
Ratings. When an engagement with a firm through the Service closes, when an RSP Assessment Report is issued, and every six months that an fCISO or InfoSec Advisor works with you, you may rate the firm or the advisor in a short survey with an optional comment. MTC Group reviews each rating and comment before it is published. It publishes every rating and comment on the Service’s What clients say page, with the firm’s or advisor’s name, the service and the date, attributed to your organization only by its type and size, never by its name, unless the rating or comment: contains protected health information, a person’s name or a client’s confidential information; is abusive, obscene, harassing, defamatory or discriminatory; makes a statement MTC Group reasonably believes is clearly false; is, in MTC Group’s reasonable belief, not genuine; or is unrelated to the engagement. On those grounds alone MTC Group may decline to publish a rating or comment, or remove it later. MTC Group never declines or removes a rating or comment because it is negative or low, and never edits ratings or comments; this applies equally to ratings of the advisors whose services MTC Group sells. A score shows once three ratings are published, or sooner if the firm or advisor chooses. A rating, once given, cannot be changed. Do not include patient information, a person’s name or confidential information in a comment. A firm or advisor cannot remove, edit or suppress ratings.
You agree not to share accounts or credentials; access another organization’s data; probe, scan or test the Service’s security without MTC Group’s written permission; try to get around its access controls or request limits; scrape, copy or resell the Service or its content; upload malicious code; upload PHI (section 5); or use the Service unlawfully.
The Service, its software, its catalog of requirements and controls, its templates, training content and document formats belong to MTC Group and its licensors. Your subscription gives your organization a non-exclusive, non-transferable right to use the Service for its own compliance program while the subscription is active. MTC Group may use suggestions you send without obligation to you.
We may suspend or end access for non-payment or a material breach of these Terms, with notice where practical. You may stop using the Service at any time; section 6 covers billing. Your Site Admin can download a complete export of Your Data, every file and all the information entered in the Service, from Settings. When your last paid subscription ends, your organization becomes read only and the export stays available for 30 days. After those 30 days the organization and the export are no longer accessible unless you subscribe again, which restores full access, and on or after 90 days after the subscription ended the organization is permanently deleted, after reminder emails before that date. A trial or free-access organization that ends without a subscription becomes read only, and is permanently deleted on or after 90 days later, after reminder emails 30, 10 and 3 days before. Your Site Admin may instead delete the organization in Settings at any time after downloading the export, once no subscription, retainer or assessment is active. You are responsible for keeping your own records for as long as the law requires you to; the export is how you take them with you.
The Service is provided “as is” and “as available.” To the extent the law allows, MTC Group disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement, and does not promise that the Service will be uninterrupted or error-free.
To the extent the law allows, MTC Group is not liable for indirect, incidental, special, consequential or punitive damages, lost profits or lost data, or for any regulatory, audit or certification outcome. MTC Group’s total liability for all claims relating to the Service is limited to the fees you paid MTC Group in the 12 months before the claim arose. For the fCISO, InfoSec Advisor and RSP Assessment services, including any act or omission of the professional who performs them, MTC Group’s total liability is limited to the fees paid for that service in the 12 months before the claim arose, and your sole remedy is re-performance of the deficient work or a refund of the fees paid for it. Nothing in this section limits liability for gross negligence or willful misconduct, or anything else the law does not allow to be limited.
You will defend and indemnify MTC Group against third-party claims arising from Your Data, including PHI uploaded contrary to section 5; from your organization’s decisions about its program, including decisions made on a professional’s recommendation; or from your breach of these Terms.
These Terms are governed by the laws of the Commonwealth of Virginia, without regard to conflict-of-laws rules. Disputes will be resolved in the state or federal courts serving Chesterfield County, Virginia.
We aim for the Service to be usable by people with disabilities. If you meet an accessibility barrier, contact us and we will work to address it.
We may update these Terms. We will post the new version with its date and, for a material change, notify account holders by email or in the Service before it takes effect. Continuing to use the Service after the effective date means you accept the updated Terms.
MTC Group LLC · support@mtcgroupllc.com