When it comes to HIPAA compliance, it can be challenging to determine if the costs are worth it.  Many healthcare organizations struggle with the costs of HIPAA compliance and the technology solutions required for data security.  In this blog post, we will break down the associated HIPAA compliance costs, including the cost of the technology solutions needed for compliance, the cost of non-compliance, and the cost of data breaches.  By the end, you will better understand the costs of becoming and staying compliant.

The Cost of HIPAA Compliance

According to the Department of Health and Human Services (HHS), the cost of complying with HIPAA can range from hundreds to thousands of dollars.  However, these costs are usually far less than the penalties associated with not being compliant.  We’ll discuss the potential cost of noncompliance later in this article.

There are a few factors that affect the cost of compliance with HIPAA.  These include the number of staff members involved in processing protected health information (PHI), the technical infrastructure needed to comply with data protection requirements, and employee training costs.  Additionally, organizations may need to purchase software or hardware solutions that provide adequate security features, such as data encryption and breach notification protocols. 

Many healthcare organizations lack the in-house expertise to implement properly the security features required for compliance.   Outsourcing the handling of HIPAA security is another cost associated with compliance.  It’s important to note that the cost of HIPAA compliance may be more than initially expected, as there are often hidden costs associated with implementing various measures.

HHS’ Estimate of HIPAA Compliance Costs

Shortly after the HIPAA Final Rule came out in 2013, HHS provided an estimation of how much HIPAA compliance may cost.  The estimates provided per organization were:

• Updated Notice of Privacy Practices: $80
• Breach Notification Requirement Updates: $763
• Business Associate Agreement Updates: $84
• Security Rule Compliance for Business Associates: $113
• GRAND TOTAL: $1,040

It’s important to note that these estimates are woefully inaccurate, not to mention out of date.  The estimated costs, which can be viewed in Table 1 of Federal Register Vol. 78, No. 17, fail to account for expenses associated with covered entities that have insufficient or no security measures in place as dictated by HIPAA.  Moreover, the estimates are ten years old; technology has become considerably more complex and, in some cases, more costly to implement and maintain.  More recent estimates put the annual cost of maintaining HIPAA compliance at $35,000.  In reality, it isn’t easy to provide an accurate estimate given the different variables involved in achieving & maintaining compliance.

Variables That Affect the Cost of HIPAA Compliance

There are direct and indirect costs to consider when considering the costs associated with HIPAA compliance.

Direct Costs of HIPAA Compliance

Direct costs include any out-of-pocket expenses associated with attaining & maintaining HIPAA compliance.  These include:

• Internal audits & assessments
• Employee costs, particularly those roles dedicated to compliance & technology
• Technology equipment
• Security software, hardware, and consulting costs
• Subscriptions to security solutions (firewall, antivirus, antimalware, etc.)

Myriad factors affect the costs associated with the above list.  In addition to the size of your organization (including the number of employees and the number of devices), things like the architecture of your IT infrastructure, the age of the devices on your network, how your organization interacts with PHI (e.g., is your EHR/EMR system hosted by the software vendor, or does it reside on servers on-site?), and many other factors will dictate the cost for your organization.

Indirect Costs of HIPAA Compliance

As if trying to figure out the direct costs weren’t maddening enough, the indirect costs of HIPAA compliance are even more challenging to quantify.  These costs include the time and effort to implement and maintain compliance programs, productivity time that is shifted from day-to-day tasks to HIPAA awareness training, etc.

The Cost of Non-Compliance & Data Breaches

While the costs associated with HIPAA compliance may seem difficult to accept, the cost of non-compliance is staggering by comparison.  Like the costs of compliance, non-compliance has both direct and indirect costs.

Direct Costs of Non-Compliance

Perhaps the most significant direct cost of non-compliance is the heavy fines levied by the HHS Office for Civil Rights (OCR), the enforcement arm of HHS responsible for HIPAA.  Organizations found to be violating HIPAA can expect to face fines of up to $50,000 per violation, with a maximum of $1.5 million per year.  Additionally, they may be subject to criminal penalties ranging from up to one-year imprisonment to a fine of up to $50,000 per violation with a maximum penalty of $250,000 per year.

It’s not just OCR that can issue fines against an organization for noncompliance.  State attorneys general can fine organizations under state health privacy and other laws.  The potential penalties vary from state to state, but you can expect them to be in the tens of thousands of dollars at a minimum.

Additional direct costs include:

• Attorney’s fees
• Free credit & identity theft monitoring for individuals affected by the data breach
• Consultant fees for incident response, data recovery, forensic investigation, etc.
• New technologies required to meet compliance requirements

Indirect Costs of Non-Compliance

The indirect costs of being non-compliant and suffering a data breach are perhaps the most insidious of the costs discussed here.  Damage to reputation and patient loss due to a breach can (and has) shuttered medical providers’ practices.  There’s also the possibility of legal action (or even a class action lawsuit) from patients who have experienced harm due to a data breach.  It can take years for organizations to recover from the lingering effects of a data breach.

Pick Your Cost

When it comes to HIPAA compliance, you ultimately must decide to what extent you’re willing to invest in securing your organization and your patients’ data.  Compliance with the regulations will help protect PHI and ensure you remain in good standing with the HHS.  Non-compliance can result in hefty fines, not to mention reputation damage and lost business if a breach occurs.

At the end of the day, it’s crucial to weigh all of the costs against one another before deciding on implementing systems and solutions to be HIPAA compliant.  It’s possible to reduce the cost by investing in the right technology solutions and implementing appropriate policies and procedures.  However, no matter what, you must ensure you comply with HIPAA regulations or face the consequences.

HIPAA compliance is a daunting task and not one to be taken lightly.  At Axeleos, we are intimately familiar with guiding an organization through the complexities of implementing the right tools for compliance.  Our flagship HIPAA security service, MediGuard, is designed for covered entities & business associates of all sizes.  And the best part is that our enterprise-grade service comes at a fraction of the cost of our competitors.  Contact us today for a free initial consultation!