HIPAA guide
HIPAA compliance cost: what moves the price, and what you are paying for
HIPAA compliance has no certificate and no tariff, so its cost is the work your organisation needs: the programme, the remediation the risk analysis finds and the upkeep. The eight factors that move it, the optional assessment costs and how to compare proposals.
Key points
- HIPAA compliance cost has no list price, because there is no certificate to price: you pay for building a programme, fixing what the risk analysis finds, and keeping the evidence current.
- The biggest drivers are your status as a covered entity or business associate, how many systems hold ePHI, how mature your security already is, and how much remediation the risk analysis reveals.
- The Security Rule itself lets size, complexity, infrastructure and cost shape your safeguards, so a proportionate programme is allowed; a generic one is not.
- A SOC 2 examination, HITRUST assessment or ISO/IEC 27001 certification is optional and priced separately by the firm that performs it.
- Compare proposals on what the risk analysis covers, what evidence you will hold and what happens after year one, not on the headline fee.
Why HIPAA compliance has no list price
HIPAA compliance cost depends on what you have to build and fix, not on a fee schedule. HHS recognises no HIPAA certification, so no certification body sets audit days and no scheme publishes a tariff. What you pay for is a working programme: a risk analysis, safeguards, policies, agreements, training, breach procedures and the records that prove each of them operates.
That spend falls into five buckets: the programme build, by your team, a consultant or both; remediation of the safeguards your risk analysis finds missing; your people's time; an independent assessment, only if you choose one; and the recurring effort of keeping it all current.
Two quotes for the same organisation can differ widely without either being wrong; ask which buckets each covers and which it leaves to you. The sequence of the work is set out in HIPAA compliance process, step by step.
What moves the price
Eight factors explain most of the difference between one HIPAA programme and another. Each changes the amount of work, not the rate.
| Factor | Why it moves the price | How to keep it proportionate |
|---|---|---|
| Your status | A covered entity carries the full Privacy Rule, including patient rights and the notice of privacy practices; a business associate is directly liable for the Security Rule and for the Privacy Rule duties its contracts pass on | Settle status per client and per service before anything is priced |
| Systems holding ePHI | Every application, database, endpoint fleet and cloud account in scope needs its threats, safeguards, access and logging assessed | Map where PHI enters, sits and leaves; retire copies nobody needs |
| Services and contracts touching PHI | Each client relationship brings its own agreement, reporting duties and often its own questionnaire | Standardise one control set that answers every client |
| Sites and countries | Physical safeguards, facility access and workforce controls are checked site by site | Apply one set of rules across sites and sample sensibly |
| Current maturity | An audited ISMS or SOC 2 control set already covers much of the Security Rule; a start from spreadsheets does not | Reuse what works; the gap analysis records it |
| Remediation found | Missing encryption, multi-factor authentication, central logging or tested backups become projects with their own tooling and effort | Prioritise by risk level and record addressable decisions |
| Workforce size and turnover | Training, access provisioning and removal, sanctions and access reviews scale with headcount | Role-based access and training delivered through one platform |
| Vendors and subcontractors | Every subcontractor handling PHI needs an agreement with the same restrictions flowed down, and someone to check it | Keep a single register of business associates with review dates |
Two choices move only the consulting share: how much work your people take on (Sterling's Design™ guided or Drive™ managed route) and whether an independent assessment is prepared on the same evidence.
The risk analysis decides most of the bill
The Security Rule prescribes no product list. Under its general rules (164.306), safeguards are chosen in the light of size, complexity and capabilities, technical infrastructure, cost and the risks themselves. Cost is a legitimate input; ignoring a risk because the fix is expensive is not.
That is why the risk analysis, a required specification under the administrative safeguards, sets most of what follows. A thorough one shows which gaps are serious, which addressable specifications an equivalent measure can meet, and where spending would be wasted. A template one leaves you overspending on controls you did not need and exposed where you did. How to run one is covered in The Security Rule risk analysis: how to conduct one.
A worked comparison
Take two business associates serving the same US health plan. A contact centre with a certified ISMS, reviewed logs and tested recovery mostly needs agreements, breach procedures and a PHI-focused risk analysis. A billing firm keeping claims data in shared drives and mailboxes, with no inventory or logging, faces a far larger programme, because its risk analysis will surface remediation the first firm finished years ago.
Independent assessment: a separate and optional cost
Many US healthcare customers want more than a questionnaire: a SOC 2 report from a CPA firm, a HITRUST assessment by an approved external assessor, or ISO/IEC 27001 certification from an accredited certification body. Each is priced by whoever performs it and renews on its own cycle.
None is a HIPAA certificate; their value is independent evidence for customers. The cost lever is one control set and one evidence base for HIPAA and the chosen framework, so the assessment tests what already runs. Which route suits which buyer is compared in HIPAA vs SOC 2, HITRUST and ISO/IEC 27001.
Recurring costs after the first year
HIPAA has no end date. The Security Rule expects periodic evaluation, documentation kept for six years and reviewed as the environment changes, and a risk analysis that follows your systems. Budget for these as annual work.
| Cost component | Who is paid | One-off or recurring |
|---|---|---|
| Programme build and gap analysis | Consultant and your own team | Mainly one-off |
| Remediation and security tooling | Vendors and your IT team | One-off set-up, recurring licences and upkeep |
| Workforce training | Training provider or internal | Recurring, with every new starter |
| Risk analysis update, evaluation and internal audit | Consultant or internal | Recurring |
| SOC 2, HITRUST or ISO/IEC 27001, if chosen | CPA firm, assessor or certification body | Recurring on that framework's cycle |
The Security Rule update proposed in January 2025 is still a proposal. If it is finalised in its proposed form, items such as encryption, multi-factor authentication, six-monthly vulnerability scans, annual penetration tests and an annual compliance audit would become recurring costs for anyone not already doing them. The proposed Security Rule update, explained tracks its status.
What cheap offers leave out
A low price usually means a template policy pack with no risk analysis, a seal no regulator recognises, or a quote that leaves remediation, agreements and training to you. Each moves the cost to a later, less convenient moment.
That moment is usually a vendor audit, a breach or a complaint. OCR investigates complaints and runs compliance reviews; settlements generally bind the organisation to corrective obligations and reports to HHS for three years, and civil money penalties follow four tiers adjusted for inflation each year. A breach adds the four-factor assessment and notifications against a sixty-day clock. The documents you need to have ready are listed in HIPAA documentation: what you need and what you do not.
How to compare HIPAA compliance proposals
Put every proposal through the same questions before looking at the total:
- Which systems, sites and services does the risk analysis cover, and who performs it?
- Which policies will be written for your operation, and which are generic?
- Are business associate agreements reviewed in both directions, with clients and with your own vendors?
- Who trains your people, and what evidence will you hold at the end?
- What is excluded: tooling, legal review, assessment fees, travel?
- What support exists after the first year, and on what terms?
How Sterling prices HIPAA
An all-inclusive proposal for an agreed scope, with every third-party cost named.
Sterling's proposal is priced from your status, the PHI-handling services and systems in scope, your sites and your route, Design™ or Drive™, with deliverables and exclusions stated. Effivity runs the programme and Sterling Academy access covers your people, both included in the engagement at no additional cost, with users, courses and access period confirmed in the proposal. Fees for a SOC 2 examination, HITRUST assessment or ISO/IEC 27001 certification are shown separately. Sterling does not certify or attest HIPAA compliance: we prepare the programme and its evidence, which regulators and your customers' auditors assess. We ensure a successful compliance programme for our clients.
Book a free discovery callHIPAA compliance cost: questions buyers ask
How much does HIPAA compliance cost?
There is no standard figure, because the cost is set by the work your organisation needs, not by a fee schedule. Status, systems holding ePHI, maturity and remediation explain most of the difference, so a credible proposal follows a scoping conversation.
Is HIPAA compliance cheaper for a business associate than for a covered entity?
Often, but not always. A business associate usually carries less of the Privacy Rule, since patient-facing duties such as the notice of privacy practices sit with covered entities, yet it holds the full Security Rule; a service provider with many systems and clients can face more work than a small clinic.
Can we reduce HIPAA compliance cost if we already have ISO/IEC 27001 or SOC 2?
Yes, usually by a large margin, because much of the Security Rule is already covered by those controls. The remaining work is the PHI-specific risk analysis, the Privacy Rule duties that apply to you, agreements and breach procedures, mapped onto the evidence you already keep.
What are the ongoing costs of HIPAA compliance?
Expect recurring effort for risk analysis updates, training, periodic evaluation, business associate reviews, breach rehearsals and six-year document retention, plus any SOC 2, HITRUST or ISO/IEC 27001 renewal.
Will the proposed Security Rule update make HIPAA compliance more expensive?
It could, but only for organisations not already running the controls it proposes, and only if it is finalised. Encryption, multi-factor authentication, regular vulnerability scanning, penetration testing and an annual compliance audit are the items most likely to add cost; a mature programme already has most of them.
More HIPAA guides
Every guide in the HIPAA series is written for one question and links back to the hub for the whole picture.
- Business associate agreements: what to sign and what to issue
- HIPAA compliance process, step by step
- HIPAA compliance cost: what moves the price
- HIPAA documentation: what you need and what you do not
- Effivity for HIPAA: the guide
- HIPAA vs GDPR
- HIPAA vs SOC 2, HITRUST and ISO/IEC 27001
- HIPAA requirements explained, rule by rule
- The Security Rule risk analysis: how to conduct one
- The proposed Security Rule update, explained
Keep exploring
Explore more about HIPAA
Watch a video on how to comply with HIPAA here.
Watch a video on HIPAA requirements here.
HIPAA resources
Services for HIPAA
Talk to a consultant
Ask for an all-inclusive HIPAA proposal built around your PHI and your systems.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice