How Much Does HIPAA Compliance Cost?

HIPAA compliance costs anywhere from $0 to about $60,000 in the first year, or $579 a year on Stampwell for a practice of up to 100 staff. The number depends on how big your practice is, and how much of the HIPAA work you do yourself rather than pay someone else to do. Building your own HIPAA compliance program costs $0 and about 100 hours of your operations manager's time.

Prices and time for anything that is not Stampwell are our estimates from published vendor pricing and consultant price sheets, and vendors change their prices. Consultant figures are for the first year; later years typically run 20 to 40 percent of the first-year price. Technical fixes the HIPAA risk assessment turns up, like encryption or backups, are a separate bill on every path.

Many people search for "how much does HIPAA certification cost." For one person who needs a HIPAA training certificate, the answer is $0: the HIPAA certification course on Stampwell is free. For a practice, no government body issues a HIPAA certification. What a practice pays for is HIPAA compliance, and the numbers above are the price of HIPAA compliance.

So the best way to think about the cost is to think about the work. Here is what the work is, roughly how long each piece takes, and what each of the common ways of getting it done costs.

What You Are Actually Paying For

A HIPAA compliance program starts with research. Which parts of HIPAA apply to you depends on what kind of organization you are, so the first job is figuring that out. Expect 1 to 2 hours.

HIPAA compliance is not an on-off switch. You do not become compliant one day and stay that way. It is more like going for a run every morning: you put a program in place, and you keep it going.

Once you know which HIPAA rules apply to your practice, you build your HIPAA compliance program. Every HIPAA compliance program has a few key parts, and each part costs your team hours.

Training. Your whole team has to be trained on HIPAA. Someone at your practice has to learn HIPAA well enough to teach your staff, and HIPAA is a big law. Building a good training program for your team from scratch is roughly 50 hours of work. HIPAA also asks that the training fit your organization, so one generic HIPAA course for everyone does not meet the rule.

Policies. Your practice has to write its own HIPAA policies, and HIPAA asks for a lot of policies. If you are comfortable writing legally framed documents, expect about 10 hours. Most practices hand HIPAA policy writing to an attorney or a HIPAA consultant.

Records. HIPAA produces paperwork. You have to document who was trained, when, and on what, keep the evidence, and collect a signed acknowledgment from each team member that they will follow your policies. Setting the records up is about 10 hours. After that, enrolling each person, chasing them, and collecting their signature takes about 30 minutes a person each year.

Risk assessment. HIPAA requires every practice to complete a written HIPAA risk assessment: a review of where patient information could leak, from who can see the front-desk screen, to where paper charts are stored, to how the computers and backups are set up. The HIPAA risk assessment is required, not optional, and the HIPAA risk assessment covers your physical office as well as your computers.

Optionally, a consultant on site. Some practices pay a HIPAA consultant to do the physical part of the HIPAA risk assessment in person: walk the office, check how the computers are set up, and deliver the HIPAA training face to face. Hiring the HIPAA consultant is optional. The HIPAA risk assessment is not.

Path One: Do It Yourself

Cost in dollars: $0. Cost in time: about 100 hours for a practice of 50 staff. That is 2 hours of HIPAA research, 50 to build the HIPAA training, 10 to write the HIPAA policies, 10 to set up the training records, and 25 to enroll, chase, and sign off 50 people at 30 minutes each. Building your own HIPAA compliance program is entirely possible. 100 hours is a lot to ask of an operations manager who has other work to do.

Path Two: Stampwell

Stampwell gives your practice a ready-made HIPAA compliance program. The HIPAA research is done, the HIPAA training is built, and you can customize the training to your organization the way HIPAA asks. Stampwell Free trains up to 25 staff for $0, and saves you the 50 hours of building HIPAA training.

Stampwell Pro adds the HIPAA policies and your staff's signed acknowledgments. Stampwell Pro's price is set by the size of your team, not per person: $39 a year for one person, $79 for up to five, $179 for up to 25, and $579 for up to 100. You get the HIPAA policy templates already written, our e-signer to collect your team's signed acknowledgments, and your HIPAA compliance documentation kept in one place.

For comparison, other HIPAA compliance software typically runs $3,000 to $10,000 a year for a practice of 50 staff. Nobody can tell you the exact figure, because other HIPAA compliance software is sold through a sales call. A sales rep asks how many staff you have, quotes a starting price, and then adds to the quote: extra modules, premium support, a longer contract. The price you pay is the price you negotiate.

Stampwell does not do that. Stampwell Pro has one published price for your team size. There is no sales call, no negotiation, and no add-ons. You sign up without talking to anyone, and your HIPAA compliance program is ready out of the box.

Path Three: A Compliance Consultant

When Stampwell customers have gone the consultant route, a remote HIPAA consultant, who runs the HIPAA risk assessment over video, writes the HIPAA policies, and delivers the staff training, has typically cost them $15,000 to $40,000 in the first year, for a practice of about 50 staff. Later years typically run 20 to 40 percent of the first-year price.

An on-site HIPAA consultant, who travels to your office, walks the physical space, and trains your team in person, usually runs $25,000 to $60,000. Most of the difference between the remote price and the on-site price is travel and about two days at your office.

Time or Money: Where Stampwell Sits

As with most things, building your own HIPAA compliance program is free and slow. Paying a HIPAA consultant to build the program is fast and expensive. Stampwell sits in the middle. Stampwell is software, not a team of consultants, so Stampwell Pro can cost $579 a year.

Stampwell partners with HIPAA consultants, and many HIPAA consultants run their clients' HIPAA training on Stampwell. If you use Stampwell and decide you also want a consultant to visit, tell us. We are glad to make the introduction.

Frequently Asked Questions