HIPAA Compliance Cost in 2026: What Practices and Health-Tech Vendors Pay, Line by Line

HIPAA compliance cost in 2026 ranges from about $5,000 for a small practice that does most of the work in-house to more than $100,000 for a larger organization that outsources it. Published estimates differ because they count different things: Drata puts small and mid-sized organizations at $5,000 to $30,000, Secureframe at $25,000 to more than $100,000, and HIPAA Journal puts the mid-range at $80,000 to $120,000. By our line-item count, a 20-person single-site practice spends about $8,600 to $15,200 in year one before remediation. Below, each line is priced from cited sources, with our fixed prices for testing: validated vulnerability scans from $1,500 and penetration tests from $4,000.

There is no official HIPAA certification, so no certification fee to budget: HHS neither requires one nor recognizes private ones (HHS FAQ). Invadel sells one piece of this, the testing evidence, described on our HIPAA penetration testing page and priced in full on the pricing page.

HIPAA compliance cost by component

Component	Rule	Who provides it	Published cost range
Risk analysis and risk management plan	164.308(a)(1)(ii)(A) and (B)	Your security official or a consultant	$2,000 to $20,000 (Secureframe, Drata)
Gap closure and remediation	164.308(a)(1)(ii)(B)	Your IT team or provider	$1,000 to $10,000 (Drata, Secureframe); open-ended in practice
Policies and procedures	164.316	Your team or a consultant	$1,000 to $5,000 (Drata)
Workforce training	164.308(a)(5), 164.530(b)	A training vendor	About $15 to $50 per person (HIPAATraining.com, Secureframe)
Business associate agreements	164.308(b), 164.504(e)	Your counsel	Legal time; no benchmark
Vulnerability scanning and penetration testing	Evidence for 164.308(a)(1) and (a)(8)	An outside tester such as Invadel	$1,500 per scan; penetration tests from $4,000
Readiness assessment or mock audit	Not required today	A consultant or audit firm	$10,000 to $15,000; onsite audits from $40,000 (Drata)
Consultant advisory time	Not required	A HIPAA consultant	$250 to $300 an hour (Secureframe)
Compliance automation software	Not required	Platform vendors	Some publish monthly small-practice plans; audit platforms usually quote yearly

The ranges are wide because remediation, the line that decides the total, cannot be priced until the risk analysis says what needs fixing.

A note on these sources: the Drata, Secureframe and HIPAA Journal figures were read from the linked pages on November 11, 2026. Drata’s page is dated February 13, 2026, HIPAA Journal’s article March 13, 2025, and Secureframe’s carries no date. They are vendor and publisher estimates, not survey data, and they will drift. The only primary cost data is HHS’s own, in the next section.

HIPAA compliance cost by organization size

None of the three published sources breaks its range down by size; each says only that cost rises with size and complexity. The split below uses the line items in this guide and our published testing prices.

Organization	Year-one cost, before remediation	Of which testing, from
Small practice, one site, about 20 people	About $8,600 to $15,200 by our line-item count, inside Drata’s $5,000 to $30,000 for small and mid-sized organizations	$7,200
Multi-site practice or clinic group	The same lines scaled to headcount, sites and systems, usually with a consultant-led risk analysis in place of the free tool	$18,400
Health-tech vendor (business associate)	The same lines, plus a SOC 2 report or HITRUST assessment that customers ask for	$19,000

The testing figures are worked through in the sample budgets below.

What HHS itself estimates

HHS’s most recent estimate covers a rule that is not final; its older ones, such as those for the original rules and the 2013 Omnibus Rule, priced narrower changes or are too dated to budget from. For its January 2025 proposed Security Rule update, HHS put first-year costs at about $9 billion and roughly $6 billion a year for years two through five. About half the first-year figure, $4.66 billion, falls on 1,822,600 regulated entities (822,600 covered entities and about 1,000,000 business associates); the other half falls on an estimated 742,411 employers that sponsor self-insured group health plans (HHS proposed rule, 90 FR 898, tables 6 and 7). Spread evenly, regulated entities pay about $2,550 each in year one, our arithmetic from table 6.

The line items say more than the totals:

Proposed requirement	HHS’s assumption per organization	HHS’s total, year one
Penetration testing at least every 12 months	3 hours of information security analyst time (low 2, high 10)	$656 million
Network segmentation	4.5 hours (low 4, high 5)	$984 million
Compliance audit at least every 12 months	2 hours (low 0.25, high 2.5)	$437 million
Multi-factor authentication deployment	1.5 hours (low 1, high 1.75)	$328 million

HHS priced each hour at $119.94, the average information security analyst wage of $59.97 doubled for benefits and overhead. Three hours is about $360 of in-house labor, not the price of a test: a manual test of even a small network takes days of tester time plus reporting and a retest. Budget testing from market prices, such as those collected in our US penetration testing price index.

As of November 2026 the proposal is not final: the 2026 Unified Agenda lists it under long-term actions, with final action projected for July 2027 (reginfo.gov, RIN 0945-AA22). OCR enforces the current rule, so plan around it and budget for the proposed cadence.

The line items, one by one

HIPAA risk assessment cost

The risk analysis is required, and it is the failure OCR penalizes most often (HIPAA Journal). HHS’s Security Risk Assessment Tool, now version 3.7, is a free download aimed at small and medium providers; HHS notes it may not suit larger organizations and does not guarantee compliance (HealthIT.gov). For a single-site practice the real cost is the security official’s time.

Outside help runs $2,000 to $20,000, driven by the number of systems, locations and vendors touching ePHI; the method is in our HIPAA security risk assessment guide.

We do not sell or write risk analyses. But a questionnaire rates vulnerabilities it has not verified, and a vulnerability assessment from $1,500 or a penetration test supplies verified findings to rate.

Remediation: the line nobody can quote in advance

Drata and Secureframe put gap closure at $1,000 to $10,000, which holds only for small gaps. The items that make it expensive are predictable: multi-factor authentication on email and remote access, encryption for laptops and backups, central logging to meet the audit controls standard (164.312(b)), replacing unsupported systems, and segmenting clinical devices from the corporate network. The proposed rule would make encryption required rather than addressable and would add multi-factor authentication, which the current rule does not name, so budget for both now. Our HIPAA technical safeguards guide explains each control.

Policies, procedures and documentation

Written policies are required (164.316), kept for six years from creation or from when last in effect, whichever is later (164.316(b)(2)(i)). Templates cost little; tailoring them costs time, $1,000 to $5,000 by Drata’s range. The HIPAA compliance checklist and our guide to administrative and physical safeguards list what each policy covers.

Training

The Security Rule requires security awareness training for the whole workforce, management included (164.308(a)(5)); the Privacy Rule adds training on privacy policies (164.530(b)). HIPAATraining.com publishes $14.99 to $29.99 per person depending on seat count; Secureframe’s range is $30 to $50 per user. A 20-person practice spends roughly $400 to $1,000.

Business associate agreements

Every vendor that creates, receives, maintains or transmits PHI on your behalf needs a signed agreement, and each needs one with its own subcontractors. That can include your penetration testing firm, if testing may expose ePHI. The direct cost is counsel’s time. For health-tech vendors the larger cost arrives through the agreement: customers ask for an independent penetration test and often a SOC 2 report or HITRUST certification, compared in HITRUST vs SOC 2 and HITRUST penetration testing. The proposed rule would add yearly written verification of each business associate’s technical safeguards (proposed 164.308(b)(2)(ii)).

HIPAA compliance audit cost

The current rule requires no third-party HIPAA audit; OCR’s own audits, run under the HITECH Act, are regulator reviews, not a service you can buy. What organizations buy is a readiness assessment or mock audit, $10,000 to $15,000 by Drata’s figures, or an onsite audit from $40,000. Business associates asked by customers for a “HIPAA audit” usually buy a SOC 2 report with the Security Rule mapped in, or a HITRUST assessment. Any mock audit should follow OCR’s free audit protocol. The proposed rule would require an annual compliance audit (proposed 164.308(a)(14)) but does not say a third party must perform it.

HIPAA penetration testing cost

This is the line we sell; scope and method are on our HIPAA penetration testing page. Every penetration test below is priced in writing before work starts and includes a free retest of remediated findings, an attestation letter, and a report mapped to the Security Rule.

Test	When a HIPAA budget needs it	Invadel, from
Vulnerability scanning, validated by an analyst	Every six months under the proposed rule; up to 250 devices ($2,500 up to 1,000; tiers on the vulnerability scanning pricing page)	$1,500 per scan
External network penetration test	Internet-facing VPN, remote access or mail	$4,200
Internal network penetration test	Offices with workstations, Active Directory and clinical systems	$6,000
Web application penetration test	A patient portal, scheduling or billing app, or a health-tech product	$5,200
API penetration test	Any FHIR, HL7 or partner integration that returns patient records	$4,000
Cloud penetration test	ePHI stored or processed in AWS, Azure or GCP	$6,800
Phishing campaign	Measuring whether training works (no retest)	$3,600

We also assess Microsoft 365 or Google Workspace tenants holding ePHI, from $4,200.

Vendor guides quote $800 to $5,000 for vulnerability scanning or penetration testing (Drata; Secureframe says $1,000 to $5,000). A quote far below the table above is usually a scan labeled as a penetration test (our guide to penetration testing vs vulnerability scanning explains the difference); if a scan is what you need, buy one labeled honestly.

Sample testing budgets for three typical organizations

These are year-one testing budgets at our published starting prices, with two scans a year to match the proposed rule’s six-month cadence; under the current rule, your risk analysis sets the frequency.

	Small practice, one site, cloud-hosted EHR	Multi-site practice or clinic group	Health-tech vendor (business associate)
External network test	$4,200	$4,200	Covered by the web and cloud tests unless you expose VPN or SFTP hosts (add $4,200)
Internal network test	Not usually needed	$6,000	Not usually needed
Web application test (portal or product)	Not usually needed	$5,200	$5,200
API test (FHIR, integrations)	Not usually needed	Not usually needed	$4,000
Cloud test	Not usually needed	Not usually needed	$6,800
Validated scans, twice a year	$3,000	$3,000	$3,000
Testing budget, year one, from	$7,200	$18,400	$19,000

Larger scopes cost more; the price calculator adds up any combination. A clinic group or health-tech vendor adds the component table’s other lines, scaled to headcount and systems. A health-tech vendor usually adds a SOC 2 report or HITRUST assessment (budget it from our SOC 2 audit cost guide) and may need pricier hosting, email and SaaS plans, since many providers sign business associate agreements only on some tiers. New York general hospitals have a separate obligation: an annual penetration test under the state’s hospital cybersecurity regulation.

Worked example: a 20-person, single-site practice

Line	Year one
Risk analysis with the free HHS tool, or a consultant at the low end	$0 to $2,000, plus staff time
Policies and procedures	$1,000 to $5,000
Training, 20 people	$400 to $1,000
External test plus two validated scans	$7,200
Total before remediation	About $8,600 to $15,200

Remediation sits on top, and the risk analysis decides how much.

Costs that recur every year

Most organizations budget each year for a risk analysis review, a penetration test (plus another after significant change), new-staff training, policy review and business associate tracking; the proposed rule would make the review and test annual and add six-monthly scans. Most budgets leave out staff time for the security and privacy officials the rules require you to name (164.308(a)(2) and 164.530(a)).

Year two and beyond: the recurring HIPAA budget

For the same 20-person, single-site practice, year two looks like this once the policies exist and the first risk analysis is done:

Line	Year two
Risk analysis review and update with the free HHS tool	Staff time
Policy review	Staff time
Training refresh for 20 people, if you retrain everyone yearly	$400 to $1,000
External test plus two validated scans	$7,200
Total before remediation	$7,200 for testing, plus $400 to $1,000 for training and staff time

Testing is most of the recurring out-of-pocket cost, and it is the one line with a fixed price. A change of EHR, a new office or a new patient-facing application adds a test for that change on top.

What non-compliance costs

HIPAA civil money penalties are set by culpability tier, currently at these amounts (45 CFR 102.3, as last adjusted for inflation on January 28, 2026 at 91 FR 3665):

Culpability	Per violation, minimum	Per violation, maximum	Calendar-year cap
Did not know, and could not have known with reasonable diligence	$145	$73,011	$2,190,294
Reasonable cause, not willful neglect	$1,461	$73,011	$2,190,294
Willful neglect, corrected within 30 days	$14,602	$73,011	$2,190,294
Willful neglect, not corrected within 30 days	$73,011	$2,190,294	$2,190,294

In a 2019 notice of enforcement discretion, HHS said it would apply lower calendar-year caps to the first three tiers until further notice: $25,000, $100,000 and $250,000, adjusted for inflation (84 FR 18151).

In 2025, by HIPAA Journal’s count, OCR closed 21 enforcement actions and collected $8,330,066, and 76% of those actions included a penalty for a risk analysis failure (HIPAA Journal 2025 Healthcare Data Breach Report). Settlements ran from $5,000 (Vision Upright MRI) to $3,000,000 (Solara Medical Supplies). New York’s attorney general separately fined Orthopedics NY $500,000.

Penalties usually attach to a missing or superficial risk analysis, one of the cheapest lines here; our guide to data breach fines and penalties covers the cases.

How to keep HIPAA compliance costs down

1. Start with the free HHS tool if you are a small provider; pay a consultant only for the gaps.
2. Scope testing to where ePHI lives and moves.
3. Test once, use it several times. One report mapped to HIPAA, SOC 2 and HITRUST serves the risk analysis, auditors and customers.
4. Buy the retest in the price. A quote without it means a second invoice.
5. Test before the risk analysis update, so the findings feed it, and buy fixed prices, not day-rate estimates.

What Invadel provides, and who provides the rest

We provide penetration testing, vulnerability scanning and the attestation letter. Your security official or a HIPAA consultant owns the risk analysis, policies, training and program management, using our findings as evidence; counsel writes the agreements; a CPA firm issues SOC 2 reports; HITRUST certifies after an authorized External Assessor’s assessment.

Our senior in-house testers set healthcare scopes around patient safety: staging environments where possible, no disruptive testing of clinical systems, a named stop contact throughout. Reports map each finding to 164.308(a)(1), 164.308(a)(8) and 164.312; see a sample report. The price is fixed in writing the same day you send your scope, and onboarding starts within 24 hours of a signed proposal. Typical scopes are on our healthcare penetration testing page; our list of the best healthcare penetration testing companies sets out questions to ask any firm.

Frequently asked questions

How much does HIPAA compliance cost for a small practice? Drata puts small and mid-sized organizations at $5,000 to $30,000. A 20-person single-site practice using the free HHS risk assessment tool can expect roughly $8,600 to $15,200 in year one before remediation, of which $7,200 is an external penetration test and two validated scans at our prices.

Is HIPAA compliance a one-time cost? No. The risk analysis has to be kept current, policies reviewed, new staff trained and testing repeated. For a 20-person practice the recurring out-of-pocket cost before remediation is about $7,200 a year for the external test and two validated scans, plus $400 to $1,000 if everyone is retrained.

How much does a HIPAA certification cost? Nothing, because there is no official one. HHS does not require or recognize HIPAA certifications, and a private certificate does not relieve you of your Security Rule obligations or stop OCR from finding a violation.

How much does a HIPAA risk assessment cost? Zero out of pocket for small providers using the HHS Security Risk Assessment Tool, and $2,000 to $20,000 from a consultant. Testing that supplies verified findings is separate: a validated vulnerability assessment starts at $1,500 for up to 250 devices, and penetration tests at $4,000.

How much does a HIPAA compliance audit cost? No third-party audit is required today; a readiness assessment or mock audit runs $10,000 to $15,000, and an onsite audit from $40,000. The proposed rule would require an annual compliance audit, not necessarily by a third party.

How much should a HIPAA budget set aside for penetration testing? At our starting prices, about $7,200 in year one for a small practice (an external test and two validated scans) and about $18,400 to $19,000 for a clinic group or health-tech vendor. Each test includes a free retest, an attestation letter and a report mapped to the Security Rule; see HIPAA penetration testing.

What is the new HIPAA rule in 2026, and will it raise costs? The Security Rule update proposed in January 2025 would require annual penetration testing, scanning every six months, an annual compliance audit, encryption and multi-factor authentication. As of November 2026 it is not final; final action is projected for July 2027. HHS put its first-year cost at about $9 billion, split roughly evenly between HIPAA-regulated organizations and employers that sponsor self-insured group health plans.

The short version

HIPAA compliance cost is the sum of a risk analysis, remediation, policies, training, agreements and testing: published totals run from about $5,000 to over $100,000. The testing line is the one you can fix in advance, from $1,500 for a validated scan and $4,000 for a penetration test, each with a free retest, on our pricing page and mapped to the Security Rule on our HIPAA penetration testing page. Tell us which systems hold ePHI and scope your HIPAA test for a written fixed price the same day.