The Cost of a HIPAA Assessment

ou've maybe been asked by a current customer or you've determined internally that you want to do a HIPAA assessment. In this video, I will cover the different factors that go into the cost of a HIPAA assessment.

Hi, I'm Doug Kanney, principal and HIPAA practice lead at Schellman. I've been in this industry for over 17 years, performing everything from SOC examinations to HIPAA assessments and HITRUST assessments. So maybe one of your customers has asked you to do a HIPAA assessment or you've decided internally you want to do a HIPAA assessment. The cost of a hip assessment is really going to range anywhere from $20,000 up to $80,000. And I know that's a wide range. There are some various factors that impact that number.

The first one is how deep do you want the assessment to go?
We have some clients that want a full-blown examination where we're getting print screens, getting evidence for every requirement, saying the security rule. We have others that really just want to kind of kick the tires, walk through the policies, procedures, and understand where there might be gaps, and maybe spend a little more time on the risk assessment area.

The number of systems in scope
If it's a large health care organization that has 10 applications, that's going to take much more time than one that has one or two.

Do you want the scope of that HIPAA assessment to include all of the rules?
So the security, privacy, and breach notification rules, we have many clients that are business associates that really want to focus on just the security rule, because the privacy rule, given that they aren't covered entities, has a low amount of applicability. So depending on that, but if you're a covered entity and you have all the privacy rule apply to you, that adds quite a bit of time to the assessment as well.

Outsourcing to third parties
If there are cloud providers that are used where certain requirements are on their end that we don't then have to assess on the organization's end, that also plays a factor in the scope.

If there is any physical site review requirement
Where if there are a lot of locations that need to be visited as part of the assessment, if there's a sampling approach that's used, or if it's more of a virtual kind of walk-through approach.

Those are really the factors that can make that range go up or down, depending on what the organization chooses. We got to that number anywhere from $20,000 to $80,000 in terms of the cost. In order to determine what costs would be appropriate for your organization based on your internal needs, fill out the form on our website and we'll get right back to you.