United Kingdom · Technology and data · Entry Level (0-2 years)

Associate HIPAA Compliance Analyst

As an Associate HIPAA Compliance Analyst, you become the guardian of patient data, ensuring every digital corner is secure and compliant.

Here is the whole job, in plain words. What it is, a real day, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

See how AI is changing this job, and get the full read by email.

Start my free AI Fluency module

As an Associate HIPAA Compliance Analyst, a good place to start on Prompt Engineering for Compliance Tasks is Using and Checking AI Tools in Daily Work, a free Future Fluency module at Level 3. You'd practise using everyday AI tools on real tasks from your own week, and checking what they produce before you use it.

Free to start, no card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, the new skills it asks for, where it leads, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Your employer, or 'self-employed'

Leading a team? Try this with up to five of them for 14 days, free.

  • Experience bandEntry Level (0-2 years)
  • Direct reportsNo direct reports
  • Reports toSenior HIPAA Compliance Engineer
  • UK framework levelUsually someone starting out, or keeping a process running

Also advertised as Junior Security Compliance Engineer · Entry-Level Privacy Analyst (Healthcare) · Compliance Support Engineer · Technical Compliance Assistant

Built on 43,079 real UK job descriptions we analysed · grounded in what real qualifications cover

1From this job to a course

The qualifications matched to this job

GQA PAA\VQ-SET Level 3 Diploma for a Bulk Storage Operator (Technician) GQA Qualifications Limited · Level 3 · covers 1 of 3 standards
Pearson BTEC Level 3 for Health Screeners Diploma Pearson Education Ltd · Level 3 · covers 1 of 3 standards
GQA PAA\VQ-SET Level 3 Certificate in Laboratory Technical Skills GQA Qualifications Limited · Level 3 · covers 1 of 3 standards
AIM Qualifications Level 2 Certificate in Employability and Development Skills AIM Qualifications · Level 2 · covers 1 of 3 standards
GQA Level 5 Diploma in the Practice of Process Safety Management GQA Qualifications Limited · Level 5 · covers 1 of 3 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Comply with External and Internal Obligations within a Bulk Storage Operations Environment GQA PAA\VQ-SET Level 3 Diploma for a Bulk Storage Operator (Technician)
Data Protection and Confidentiality Pearson BTEC Level 3 for Health Screeners Diploma
Good Manufacturing Practice GQA PAA\VQ-SET Level 3 Certificate in Laboratory Technical Skills
Data Protection and Confidentiality in a Working Environment AIM Qualifications Level 2 Certificate in Employability and Development Skills
Principles of Safe Manufacture of Quality Medicines in the Pharmaceutical Environment Open Awards Level 3 Technical Occupational Entry in the Principles and Practice for Pharmacy Technicians (Diploma)
Understand how to comply with the relevant Regulations, Industry Standards and Management Requirements for Process Safety GQA Level 5 Diploma in the Practice of Process Safety Management

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
AI Governance Fluency using AI responsibly
Systems Fluency seeing the whole picture
Your Plan Illustration

Built for Associate HIPAA Compliance Analyst

6 units that map to this job, from the qualifications that cover it.

  1. Comply with External and Internal Obligations within a Bulk Storage Operations Environment GQA Qualifications Limited · covers 1 of 3 standards Level 3
  2. Data Protection and Confidentiality Pearson Education Ltd · covers 1 of 3 standards Level 3
  3. Good Manufacturing Practice GQA Qualifications Limited · covers 1 of 3 standards Level 3
  4. Data Protection and Confidentiality in a Working Environment AIM Qualifications · covers 1 of 3 standards Level 2
  5. Principles of Safe Manufacture of Quality Medicines in the Pharmaceutical Environment Open Awards · covers 1 of 3 standards Level 3
  6. Understand how to comply with the relevant Regulations, Industry Standards and Management Requirements for Process Safety GQA Qualifications Limited · covers 1 of 3 standards Level 5
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as an Associate HIPAA Compliance Analyst?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

How the AI economy is changing work like this

A broad read on this kind of work, not an analysis of this job on its own. Roles that share a pattern get the same answer here.

Fading: AI does more of this

AI is taking over the repetitive task of summarising long technical documents and drafting initial responses for audits.

→
Rising: worth more because of AI

Your ability to critically evaluate AI-generated outputs for accuracy and relevance becomes more valuable than ever.

The new skill this role is being asked for

  • Prompt Engineering for Compliance Tasks
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your Associate HIPAA Compliance Analyst plan as you set up, starting with the free AI Fluency module. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Keep this read. One email with what AI is changing in this job, the new skills it asks for and where to start free. Nothing else follows unless you confirm your address.

3What this role really is

We see you

You often wonder if AI will make your role obsolete, yet you see its potential to make your work more efficient. It's a balancing act between embracing new tools and maintaining a human touch in compliance.

This job involves checking systems and processes to keep patient data safe and meet HIPAA rules. You work closely with audits, helping to show that systems are secure and compliant. It suits someone who wants to start out in technical compliance and learn the detail of the work.

4A day in the life

Not a job advert. A real day, built from what this role actually holds.

08:45
You start your day by reviewing the latest security alerts, sifting through them to identify those that might affect ePHI.
11:00
Under the guidance of a Senior Engineer, you gather evidence for an upcoming audit, meticulously documenting AWS configurations.
14:15
You participate in a team meeting, discussing the outcomes of a recent incident response exercise and noting down action items.
16:30
Your day winds down with routine checks on cloud environments, ensuring encryption settings are up-to-date and IAM policies are correctly configured.

5What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

AWS: CloudTrail, GuardDuty, Config Intermediate

Navigating the AWS console to investigate security alerts, verify specific service configurations (e.g., S3 bucket policies, EC2 security groups), and pull logs for audit evidence based on instructions.

GRC Platforms (e.g., Drata, Vanta) Basic

Responding to evidence requests within the platform, uploading documentation, and linking controls to specific assets as directed by a Senior Engineer.

IaC (Terraform) - Reading Basic

Reading and understanding existing Terraform code to identify how infrastructure is provisioned and configured, especially for security-related settings. You won't be writing it from scratch, but you should be able to follow along.

SIEM / Log Management (e.g., Splunk, Datadog) Intermediate

Monitoring pre-built dashboards for security alerts, performing basic search queries (e.g., Splunk SPL) to investigate suspicious activity, and exporting logs for evidence collection.

Vulnerability Management (e.g., Nessus, Qualys) Basic

Running scheduled vulnerability scans, triaging the results based on severity, and creating remediation tickets in Jira for the engineering teams.

Collaboration/Docs (Confluence, Jira) Intermediate

Creating and updating Jira tickets for compliance tasks and findings, and documenting procedures, policies, and audit evidence on Confluence using existing templates.

6What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Technical Configuration Changes (e.g., firewall rules, IAM policies) Inform manager of proposed changes, seek approval before any action. Do not implement independently. Propose changes to manager, implement after approval. Escalate complex or high-risk changes. Design and implement changes within defined scope, inform manager. Consult on cross-functional impact.
Audit Evidence Collection Strategy Follow explicit instructions from manager on what evidence to collect and where. Independently identify and collect evidence for routine requests, propose alternative sources if primary is unavailable. Define the evidence collection strategy for specific controls or audit requests, ensuring completeness and efficiency.
Prioritisation of Daily Tasks Prioritise tasks based on manager's guidance and established deadlines. Escalate conflicts. Manage own daily task prioritisation within project deadlines, flag potential delays to manager. Set priorities for own workstreams and mentor junior team members on prioritisation, aligning with project goals.
Communication with External Auditors No direct communication with external auditors. All interactions are handled by senior staff. May provide direct evidence to auditors under supervision, but not engage in interpretative discussions. Lead discussions with auditors on specific technical controls and evidence, representing the team's position.

7How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

Vulnerability Remediation SLA Adherence (Initial Triage)
The speed at which you identify a newly reported vulnerability, confirm its relevance, and create a ticket for the engineering team to address it.
Target · 95% of critical/high vulnerabilities triaged and ticketed within 24 hours of discovery.

If Nessus flags 10 critical vulnerabilities on Monday, you'll have reviewed and created Jira tickets for at least 9 of them by Tuesday afternoon.

Evidence Collection Accuracy
The correctness and completeness of the evidence (e.g., screenshots, log exports, configuration files) you gather for audit requests.
Target · < 5% error rate on evidence submitted for internal or external audit preparation.

You're asked for an AWS S3 bucket policy screenshot, and you provide the correct bucket, the full policy, and the date/time stamp, rather than a partial or incorrect one.

Compliance Checklist Completion
The timely completion of routine compliance tasks, like access reviews or system configuration checks, using our established checklists.
Target · 100% of assigned quarterly access reviews and weekly configuration checks completed on time.

You complete all 15 assigned user access reviews for the Q1 cycle by the deadline of 31 March, ensuring no overdue items.

Proactive Learning & Questioning
How quickly you grasp new concepts, ask clarifying questions, and show initiative in understanding the 'why' behind tasks.
  • You'll regularly ask your manager 'why' we do things a certain way, not just 'how'. You'll bring up new articles or training you've found on HIPAA or cloud security. You'll show you've tried to solve a problem yourself before asking for help, but know when to escalate.
Documentation Quality & Clarity
The precision and readability of the internal documentation you create or update, ensuring it's easy for others to follow and audit.
  • Your Confluence pages are well-structured, use clear language, and follow our templates. A colleague can pick up your documentation and understand the process without needing to ask you follow-up questions. You catch typos and formatting errors before they're published.
Team Collaboration & Support
Your willingness to help out team members, communicate issues, and contribute positively to our team's working environment.
  • You're responsive on Slack, offer to help colleagues when your own tasks are complete, and proactively share information you think might be useful. You give clear updates on your progress and any blockers.

8Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Making a Real Impact on Security

You'll feel genuinely satisfied when you find a misconfiguration that could have exposed data, or when your diligent evidence collection helps us pass an audit. You're driven by the tangible outcome of keeping sensitive information safe.

You spot an S3 bucket that's publicly accessible during a routine check, flag it, and see it fixed within hours, preventing a potential breach. That's a good day for you.

Continuous Learning & Growth

You're excited by the idea of diving deep into HIPAA regulations, cloud security best practices, and new technologies. You enjoy the challenge of understanding complex systems and how to secure them.

You spend your lunch break reading up on the latest AWS security features or a recent OCR enforcement action, genuinely interested in how it applies to our work.

Structured Problem Solving

You enjoy the methodical process of breaking down a compliance requirement, figuring out what evidence is needed, and then systematically gathering it. You like bringing order to complex, sometimes messy, information.

Presented with a new HIPAA control, you'll immediately start thinking about a checklist or a workflow to ensure we meet it, rather than feeling overwhelmed.

What frustrates people
  • The 'Compliance Police' Stigma: Being seen as the department that says 'no' rather than enabling safe innovation.
  • Chasing Evidence: The endless follow-ups needed to get simple screenshots or logs from busy teams.
  • Interpreting 20-Year-Old Rules for Serverless Tech: Trying to figure out how a regulation written for physical servers applies to a Lambda function that runs for milliseconds.
  • Alert Fatigue: Sifting through hundreds of low-priority alerts to find the one that actually matters.
  • The 'It's Just an Internal Tool' Argument: Explaining why internal systems handling ePHI need the same rigorous security as public-facing ones.
What this role does not give you
  • High-level strategic decision-making (not yet, anyway).
  • Building new security tools from scratch.
  • Direct management of a team (you'll be an individual contributor).
  • A quiet, entirely predictable workload (expect some urgent curveballs).

9Who you work with

This role directly supports the organisation's ability to maintain HIPAA compliance, which is non-negotiable for us operating in healthcare. Your accurate and timely evidence collection means our senior engineers can focus on strategy, and we can confidently demonstrate our security posture to regulators and customers. Frankly, without this foundational work, our entire compliance programme would struggle.

Inside the business
  • Senior HIPAA Compliance Engineer (your direct manager)
  • Cloud Engineering Team (for evidence gathering)
  • Product Development Teams (for understanding new features)
  • IT Operations (for system configurations and logs)
  • Legal & Privacy Teams (for policy interpretation)
Outside the business
  • External Auditors (indirectly, through evidence collection)

10What you need before you start

Not a wish list. The things you would be expected to already have.

  • A foundational understanding of IT infrastructure and networking concepts (e.g., what's an IP address, a firewall, a server, a database).
  • Some exposure to cloud platforms, ideally AWS, even if it's just through personal projects or online courses.
  • Basic knowledge of information security principles (e.g., confidentiality, integrity, availability).
  • Strong organisational skills and a methodical approach to tasks.
  • Excellent written and verbal communication skills in English.
  • A genuine curiosity about healthcare regulations and technical compliance.
  • The ability to learn quickly and adapt to new information and tools.

11What to practise next

Where the job is going, and what to do about it starting this week.

Cloud Security Automation (Scripting)

Manual checks are slow and error-prone. Being able to write simple scripts (e.g., in Python or PowerShell) to automate evidence collection, configuration checks, or even basic remediation tasks will make you incredibly efficient and valuable.

AWS CLI/SDK Basics · Basic Scripting Logic · API Interaction

  • This week: Complete an online 'Python for Beginners' course, focusing on basic syntax and data structures.
  • This month: Learn how to use the AWS CLI to list S3 buckets and their public access settings.
  • Month 2: Write a simple Python script to check if a list of specific S3 buckets has public access enabled.
  • Month 3: Automate one of your weekly checklist items using a script and demonstrate the time savings.

Quick win: Start using the AWS CLI for tasks you currently do in the console. It's faster and helps you learn the underlying commands.

12Staying current once you are in

What people here do to keep up
  • Regularly read industry blogs and news sources focused on cloud security, data privacy, and HIPAA enforcement actions (e.g., KrebsOnSecurity, AWS Security Blog, HHS OCR enforcement news).
  • Participate in online courses or tutorials on AWS security features, Python scripting for automation, or specific GRC platform training.
  • Attend relevant webinars or virtual conferences to stay updated on emerging threats and compliance best practices.
  • Engage with security communities online (e.g., Reddit's r/cybersecurity, LinkedIn groups) to learn from peers and ask questions.
  • Seek out mentorship opportunities within our team or through professional networks to guide your career development.

13The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

Prompt Engineering for Compliance Tasks

AI models are getting incredibly good at understanding and generating text. If you can ask the right questions (write effective 'prompts'), you can get AI to help you draft policies, summarise complex regulations, or even generate initial audit responses. Analysts who master this will be significantly more productive.

  • Clear & Specific Prompting
  • Context Provisioning
  • Output Validation
  • Iterative Prompting

14What you’ll use

What you’ll use

Skills this role draws on

Technical

  • HIPAA Security & Privacy Rule Interpretation
  • Threat Modeling Fundamentals
  • Risk Assessment & Management Basics
  • Security Control Mapping & Auditing Support
  • Incident Response Lifecycle Awareness

15The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    IT Support / Helpdesk Technician

    1-2 years

    Skills to master

    • Troubleshooting technical issues, understanding user access management, basic networking, customer service, documentation.

    You're ready to move on when

    • You've moved beyond basic password resets to diagnosing more complex system issues.
    • You're curious about the 'why' behind security policies and access controls.
    • You enjoy the methodical process of investigating problems and documenting solutions.
  2. 2

    Junior Software Developer / QA Engineer

    0-2 years

    Skills to master

    • Understanding code structure, testing methodologies, debugging, familiarity with development lifecycles, attention to detail.

    You're ready to move on when

    • You have an interest in how security is built into software, not just added on.
    • You're meticulous in identifying bugs and ensuring quality, which translates well to finding compliance gaps.
    • You understand the developer's perspective, which is crucial for getting security measures implemented.
  3. 3

    Recent Graduate (Technical Degree)

    0 years

    Skills to master

    • Theoretical knowledge of computer science, algorithms, data structures, networking, and potentially some exposure to security concepts.

    You're ready to move on when

    • You've excelled in security or networking modules during your degree.
    • You've completed personal projects involving cloud platforms or security tools.
    • You're eager to apply academic knowledge to real-world compliance challenges.

16How people get here · where they go next

Came from
IT Support / Helpdesk Technician
1-2 years
You mastered troubleshooting technical issues and developed a keen eye for detail, essential for compliance work.
You are here
Associate HIPAA Compliance Analyst
Entry Level (0-2 years)
This job involves checking systems and processes to keep patient data safe and meet HIPAA rules. You work closely with audits, helping to show that systems are secure and compliant. It suits someone who wants to start out in technical compliance and learn the detail of the work.
Goes to
HIPAA Compliance Engineer (Level 2)
2-3 years
This role involves independently managing compliance processes and making routine decisions, deepening your expertise in technical controls.

The long view: This work can lead to senior compliance engineering roles, and later to managing a compliance engineering team.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how Associate HIPAA Compliance Analyst is actually changing.

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Comply with External and Internal Obligations within a Bulk Storage Operations Environment, worked against Associate HIPAA Compliance Analyst.

Comply with External and Internal Obligations within a Bulk Storage Operations Environment Level 3

Applied to your work in Associate HIPAA Compliance Analyst

The objective of this unit is to enable learners to comply with both external and internal obligations within a bulk storage operations environment. Learners will be able to perform audits, inspections, and safety sampling, adhere to safe systems of work, control systems for fiscal and excise compliance, and review and improve standard operating procedures.

The Navigator Last time, we talked about how your role supports the overall integrity of our compliance framework. How did your recent audit preparation go?

You It went well, but I had some challenges with understanding the technical controls.

The Navigator Let's focus on breaking down those controls together. We'll align them with HIPAA requirements to clarify their purpose and application.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

A year from now

A year from now, you see yourself as a confident analyst who uses AI to streamline compliance tasks while adding a human touch to critical decisions.

See Your Progress Grow Illustration
Associate HIPAA Compliance Analyst
  • HIPAA Security & Privacy Rule Interpretation
  • Threat Modeling Fundamentals
  • Risk Assessment & Management Basics
  • Security Control Mapping & Auditing Support
  • Incident Response Lifecycle Awareness
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

17The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

Associate HIPAA Compliance Analyst is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. HIPAA Compliance Engineer (Level 2)

    2-3 years in the Associate role

    You'll move from assisting and learning to independently owning specific compliance processes and taking responsibility for routine decisions.

    • Advanced Cloud Security Configuration Independently configuring and tuning security settings in AWS (e.g., GuardDuty rules, Config rules).
    • GRC Platform Management Managing specific modules within our GRC platform, including control mapping and evidence linking.
    • Scripting for Automation Writing simple scripts to automate evidence collection and compliance checks.
    • Basic Threat Modeling Conducting simple threat models for new features or minor system changes.
Working with AI on the job

Working with AI

Where AI is starting to help

Let's be real, a lot of compliance work can feel a bit like sifting through mountains of paperwork, or endlessly clicking through consoles. But what if you could cut down on the tedious bits and focus on the interesting challenges? That's where AI comes in. We're not talking about AI doing your job, but rather being your super-efficient assistant, freeing you up for more impactful work.

As an Associate HIPAA Compliance Analyst, you'll be on the front lines of evidence gathering and initial analysis. AI tools can significantly speed up these processes, helping you find what you need faster, summarise complex information, and even draft initial documents. It means less time on repetitive tasks and more time learning, growing, and actually understanding the 'why' behind what we do.

Policy & Procedure Drafting Assistant

Instead of staring at a blank page, use an AI model to generate a first draft of a new internal procedure or policy based on a specific HIPAA rule. You'll then refine it with our company's specifics, saving you hours of initial research and writing.

Smart Audit Evidence Finder

Imagine an auditor asks for 'evidence of quarterly access reviews for all production database administrators'. Instead of manually digging through Confluence and Jira, an AI agent can quickly search, identify, and provide direct links to the relevant documents and tickets. This means less frantic searching and more time for validation.

Log Anomaly Summariser

Reviewing daily access logs can be a chore. AI-powered SIEM tools can flag unusual events – like a user accessing records at an odd hour from an unfamiliar IP – and provide a concise summary, rather than just a stream of raw data. This helps you quickly spot potential issues that need investigation.

Risk Explanation Helper

Need to explain a technical vulnerability to a non-technical Product Manager? Feed the technical details into an AI and ask it to explain the potential impact to ePHI in plain English, referencing the HIPAA Breach Notification Rule. It'll help you articulate risks clearly and concisely, saving you prep time for meetings.

Common questions

Common questions

How do you become an Associate HIPAA Compliance Analyst?

Common routes in include IT Support / Helpdesk Technician (1-2 years), Junior Software Developer / QA Engineer (0-2 years) and Recent Graduate (Technical Degree) (0 years). Times vary with prior experience.

Where can an Associate HIPAA Compliance Analyst progress to?

This role can lead on to HIPAA Compliance Engineer (2-3 years in the Associate role), depending on the skills you build.

What new skills matter most for an Associate HIPAA Compliance Analyst?

Increasingly, Prompt Engineering for Compliance Tasks. These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

18Where to go from here

Other roles at Level 2

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

More jobs in technology and data

Stay in the field you know and move sideways rather than up.

If you leave this industry

The skills built here, including regulatory compliance, cloud security, risk management and technical auditing, apply beyond healthcare. Other regulated industries such as finance or government need the same skills. Some people move into cloud security architecture or specialise in privacy engineering.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my free AI Fluency module What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.