Where the money goes
Ranges below are for a practice of roughly two to ten providers at one location, from published price lists and typical consulting rates. Multi-site groups scale up; a solo office scales down.
| Item | Typical range | How often |
|---|---|---|
| Risk analysis, consultant-led | $1,500 to $6,000 | First year, then updates |
| Compliance software or service | $1,200 to $8,200 a year at published prices; managed services higher | Annual |
| Policies and procedures | $0 if included; $1,000 to $5,000 if drafted separately | First year, then reviews |
| Workforce training | $20 to $50 per person a year, often included | Annual |
| Security tools (MFA, encryption, endpoint protection, device management) | Often bundled: Microsoft 365 Business Premium is $22 per user a month on an annual plan on an annual plan | Monthly |
| Backups | $50 to $300 a month for a small practice | Monthly |
| Secure email or patient messaging with a BAA | $5 to $15 per user a month | Monthly |
| IT support, HIPAA share | Part of an existing MSP contract; $100 to $200 an hour ad hoc | Ongoing |
| Your own time | A few hours a month for the security officer | Ongoing |
Work out your practice's number
Your practice's first-year number
Untick what you already have:
First-year estimate from the ranges in the table. Items you untick drop out. This is a sketch for budgeting, not a quote.
HIPAA has no certification fee. It has a "we never did the risk analysis" fee, and it's larger.Your engineer
What a breach or a penalty costs instead
- OCR settlements with small practices, 2025 to 2026: $5,000 (an MRI practice), $10,000 (a surgical group), $25,000 (a neurology practice), $103,000 (a treatment center), $140,000 (a dental practice). Most with a corrective action plan of one to three years of OCR monitoring, and the consultant time to meet it.
- Breach notification: letters, a call center or toll-free line, credit monitoring if you offer it, legal review. For a few thousand patients, that's typically tens of thousands of dollars before any penalty.
- Ransomware: days of downtime, a forensics firm, a rebuilt network, and a cyber insurance deductible that commonly starts in the thousands.
- The quiet costs: a state licensing board inquiry, patients who leave, and the referral partner who stops sending.
How to keep the bill down
- Use what you already pay for. Business Premium, Google Workspace with endpoint management, and your EHR vendor's hosted backups cover several safeguards.
- Buy the risk analysis, not just the questionnaire. A score out of 100 is cheaper and worth less in an investigation.
- Get fixed fees. Hourly remediation is how a $5,000 project becomes $20,000.
- Train in-house, track in software. The tracking is what OCR asks for.
- Don't pay for a certificate. There is no HIPAA certification, and a badge doesn't shorten an OCR letter.
The proposed Security Rule update would add some cost: HHS estimated roughly $9 billion industry-wide in the first year, spread across several hundred thousand entities. For a practice that already has MFA, encryption and backups, the increment is mostly documentation time. See what's changing.
With AccuSights: one fixed fee covers the written risk analysis, the fix plan and in-house remediation, the platform, the endpoint agent, policies and training tracking, and a named engineer. The only things it doesn't replace are licences you already own. Tell us about the practice and the number arrives within 24 hours.