HIPAA Risk Analysis Cost: What Small Practices Actually Pay

Three rough cost tiers

Small-practice spending on a HIPAA Security Risk Analysis falls into three rough tiers. The actual numbers vary year to year and by vendor; the structure of the tiers is durable.

Tier 1: free / DIY

• The HHS/ONC Security Risk Assessment Tool is free. Windows desktop or iPad.
• Public guidance is free: OCR Risk Analysis Guidance, NIST SP 800-66 r2, NIST SP 800-30.
• Direct cost: $0. Time cost: 10-40 hours depending on practice size and existing documentation. Plus the cost of any encryption, MFA, training, or backup remediation that the analysis surfaces.

The DIY tier works when there is staff time and someone willing to read the source documents. It does not solve for policy stacks, sanction logs, BAA tracking, or the broader binder; those are still the practice's job.

Tier 2: paid software / SaaS

• Small-practice SRA tools range roughly from low three-figure one-time fees through low four-figure annual subscriptions for solo and small-group offerings. Mid-tier offerings with policy automation, vendor inventory, and remediation tracking commonly sit in the low four-figures annually.
• D3rx publishes its tier pricing on the main SRA page. Other named entries in this space include Compliancy Group, Accountable HQ, HIPAA One, and HIPAATrek. Each has its own pricing model.
• The value is in guided workflow, generated documentation, BAA inventory, remediation tracking, and audit-style export.

This tier works when staff time is the bottleneck and the practice values guided output and structured documentation more than absolute cost minimization.

Tier 3: consultant-led engagement

• Independent consultants and accounting firms with HIPAA practices typically charge in the mid four-figures to low five-figures for a full SRA engagement at a small practice. Multi-site groups can move into mid-five-figures.
• The engagement usually includes interviews, walkthroughs, the written risk analysis, a remediation plan, and policy support.

This tier works when the practice needs a defensible third-party assessment for payer, investor, or post-breach reasons, or when leadership wants a hands-off path that produces a finished binder with minimal staff time.

What drives the actual price differences

Beyond the tier, several factors move the number:

• Number of sites: each location adds facility access review and may add a separate interview cycle.
• Provider count: more providers means more workforce records, more access reviews, more devices.
• Specialty complexity: telehealth-heavy, RPM-heavy, or research-active practices have more systems in scope.
• Existing documentation maturity: a practice that already has a current binder pays less to refresh than one starting from zero.
• Vendor sprawl: 30 vendors is much heavier to inventory and BAA-log than 8.
• Cyber insurance or payer requirements: some require specific assessment formats that constrain the tool or consultant choice.
• Last assessment date: longer gaps mean more remediation work falls inside the assessment scope.

What a fair scope of work includes

A complete SRA deliverable, regardless of tier, includes:

• A dated written risk analysis aligned to 45 CFR 164.308(a)(1)(ii)(A)(1)(ii)(A))
• An ePHI inventory and data flow description
• A threat and vulnerability register
• A safeguard inventory mapped to 164.308, 164.310, and 164.312
• Documented decisions for each addressable specification
• A risk register with likelihood, impact, residual risk, owner, and due date
• A risk management plan under 164.308(a)(1)(ii)(B)(1)(ii)(B))
• A vendor and BAA inventory
• A re-evaluation cadence per 164.308(a)(8)(8))
• Sign-off by the Security Official under 164.308(a)(2)(2))

If a paid tool or consultant proposes a scope missing any of these, treat that as a flag rather than a saving.

Buyer questions that prevent overpaying

Before committing to any paid option, the practice should be able to get a clear yes/no on each of these:

1. Does the deliverable cover every Security Rule standard and implementation specification?
2. Does it produce a written risk register, not just a yes/no checklist?
3. Does it support per-site facility detail for multi-location practices?
4. Does it generate the supporting policies referenced by 164.316?
5. Does it maintain a BAA log?
6. Does it preserve last year's binder for delta refresh next year?
7. Does it export a self-contained document set you can hand to a payer or OCR?
8. Does the marketing avoid promising a certified or guaranteed-compliance outcome? OCR has not granted that status to any tool, so a vendor promising it is misrepresenting what the Security Rule provides.
9. Does it explicitly source-cite back to HHS, OCR, eCFR, or NIST?
10. What does the practice keep if it cancels?

The cost of not doing it

The published OCR Resolution Agreements and the Right of Access Initiative settlements record dozens of small-practice outcomes with five- and six-figure settlements plus two-to-three-year Corrective Action Plans. The CAP cost is usually larger than the headline settlement because it requires the same work the practice would have done as ongoing compliance, compressed under deadline and with quarterly OCR reporting.

Spending nothing on SRA work is not free; it shifts the cost into the contingency where one breach, one patient complaint, or one OCR audit triggers everything at once.

Restraint about claims

No tool or consultant can promise an audit outcome. The Security Rule is a process. A reasonable spend on SRA work buys structured documentation, a remediation plan, and time saved at the next audit or payer request — it does not buy certification, because the regulation does not grant certification.

How D3rx fits

D3rx SRA Binder Studio sits in tier 2: guided workflow, generated documentation, vendor and BAA log, remediation tracking, source-cited binder export. Current pricing is on the main SRA page. It is a point-in-time administrative documentation aid; the practice remains responsible for the substance.