What does HIPAA compliance help actually cost?

Short answer: nobody can quote you honestly without asking how many people touch your records, how you bill, how many vendors you use, and whether you want problems found or fixed. Anyone who names a price before asking is guessing.

I am Scott Derby, I am an attorney, and almost nobody in this industry will answer this question in public. So let me tell you what determines the number, which is more useful than a price anyway.

Four things drive it.

How many people touch your records. Every additional person means training, access management, documentation, and turnover.

Whether you bill electronically, or a billing service does it on your behalf. That decides how much of HIPAA applies to you at all, and therefore how much there is to do.

How many outside vendors create, receive, maintain, or transmit protected health information for you. Each one that qualifies as a business associate needs a signed business associate agreement, and somebody has to verify they are actually doing what it says.

Whether you are paying somebody just to find the problems, or to help fix them as well. Finding is the cheap half.

So this leads to the thing I would tell a friend. Anyone who quotes you a price before asking how many people touch your records is guessing.

Before you sign with any vendor, ask them six questions:

• Is a risk analysis included, or is it extra?
• If it finds gaps, does the price include fixing them, or only telling me about them?
• Will you sign a business associate agreement, and can I see it before I sign?
• What happens if a regulator contacts me? Is that included, or billed?
• Is staff training in the price?
• What does this cost me in year two?

That last one catches people. A low first year number with a high renewal fee is not a good deal. It is a deferred expense.

This is general information about federal HIPAA. It is accurate as of writing and it can change. Your state very likely has its own privacy rules that sit on top of HIPAA and can be stricter, so treat this as a starting point rather than the final word, and check what applies where you practice. This is education, not legal advice for your specific situation.