What a HIPAA Risk Analysis Costs and What Moves the Price

What does a HIPAA risk analysis cost?

It costs what the analyst's time costs, scaled by how many places ePHI lives in your practice, and nothing is owed to HHS at the end. There is no certificate to buy, so the fee is for the work and the quality of the document you keep. We quote it as a fixed fee in writing within 24 hours of the intake form, and this post explains what moves that number.

First, the thing people search for and never find. There is no HIPAA certification. According to HHS, it does not endorse or otherwise recognize private organizations' HIPAA certifications, and OCR does not ask for one. OCR asks instead, under 45 CFR 164.308(a)(1)(ii)(A), for an accurate and thorough risk analysis. Our guide to the risk analysis covers what that document contains.

The cost drivers, in words

Every quote we write comes down to a short list of questions.

Driver	Pushes the fee down	Pushes the fee up
Systems holding ePHI	One cloud EHR, one billing platform	EHR, billing, imaging, lab interfaces, email, texting, local file shares
Locations and staff	One site, a dozen people	Several sites, shared devices, remote staff
Existing inventory	You know every device and account	Nobody is sure what the old server does
Hosting	Cloud services with signed BAAs	On-premises servers, backups on drives, home routers
Vendors	A handful of business associates with BAAs on file	Dozens, several with no agreement
Prior analysis	An update to a sound one from last year	A first analysis, or one that only covered the EHR
Technical testing	Configuration review only	Vulnerability scan or penetration test included
Output	The analysis alone	Analysis plus a risk management plan and policies

The biggest single driver is the first row. HHS guidance says the analysis must cover all ePHI the practice creates, receives, maintains or transmits. A practice that has moved everything into two cloud platforms is a small job. A practice with a server closet is not.

The four parts you pay for

A risk analysis has four parts and each takes time.

1. Scoping: an inventory of systems, devices, data flows and vendors that touch ePHI. This is usually half the effort on a first analysis.
2. Threat and vulnerability identification: what could go wrong with each, from ransomware to a lost phone to a departed employee with a live login.
3. Risk rating: likelihood and impact, so the practice knows which five things to fix first.
4. The written document, in a form OCR can read and your insurer can accept.

The risk management plan, 164.308(a)(1)(ii)(B), is a separate deliverable. Some providers include it, some charge extra and some leave it out, which leaves you with a list of problems and no plan. Ask.

Three ways to buy it

The free route. The HHS and ONC Security Risk Assessment Tool costs nothing. It walks you through the Security Rule questions and produces a report. Its weakness is the honest answer to a question like "is encryption at rest enabled on every device that stores ePHI" when nobody in the practice knows.

Software. Compliance platforms sell a subscription that includes a risk assessment module. They are good at reminders and evidence storage. They do not know your network. Software vs a consultant vs a partner who does both compares the options.

A consultant. Someone walks your systems, interviews staff, reads configurations and writes the analysis. This costs the most up front and is the only route where the document reflects the practice you run rather than the one you described in a form.

The price of a cheap one, later

OCR's Risk Analysis Initiative, announced in October 2024, targets exactly one failure: no accurate and thorough analysis on file. The settlements HHS has published under it since fall on small providers as well as large ones. The dollar amounts vary case by case and HHS lists each one on its enforcement page, so we will not quote a range here; the point is that the penalty for a missing analysis is set by OCR, while the price of a real one is set by you, in advance.

A hospital's vendor review, a payer's onboarding and a cyber insurance renewal each ask for the analysis too, and each stalls without it.

How we price it

You fill in the intake form, which asks the questions in the table above. Within 24 hours you have a fixed fee in writing. The fee covers the analysis and the risk management plan, and implementation and remediation are included rather than sold back to you as a second project. If you want to know whether you need the analysis alone or the whole program, Risk analysis vs a full compliance program answers that.

Where AccuSights fits

We prepare the analysis and the plan with a named engineer rather than a ticket queue, and because no one can certify HIPAA compliance, we never claim to. The healthcare HIPAA package shows what is included. Start with the HIPAA framework page or book a free Risk Diagnosis and we will scope it with you on the call.