Why there is no one-size price
A HIPAA security audit is a review of the safeguards around electronic patient information. The work grows with the number of devices, people, systems and sites that handle that information. Two practices with the same specialty can need very different amounts of work.
That is why every engagement is quoted after a free consultation, once the scope is clear.
1. Workstation and device count
Every computer, laptop, tablet and server that touches patient data needs to be checked for encryption, updates, antivirus, screen locks and access settings. More devices means more scanning and more configuration review.
- Front desk and exam-room workstations
- Laptops that leave the office
- Servers, network storage and imaging equipment
- Phones and tablets used for practice email or apps
2. Number of providers and staff
Each user account is a door into patient data. More providers and staff means more accounts to review for unique logins, appropriate access levels and removal of former employees, and more people to include in workflow interviews and training records.
3. EHR and practice-management setup
A cloud-hosted EHR shifts some safeguards to the vendor, but the practice still needs a Business Associate Agreement, sensible access controls and logging on its own side. An EHR or practice-management server hosted in your office adds backup, patching and physical-security review.
Integrations — e-prescribing, patient portals, imaging, billing services, telehealth — each add a vendor relationship and a data flow to document.
4. How many locations
Each office has its own network, Wi-Fi, firewall, physical layout and day-to-day habits. Additional locations usually mean additional onsite time and a separate look at how the sites connect to each other.
Other things that change scope
A few other questions shape the work and are worth answering before a consultation:
- Do you already have a written risk analysis and policies, or are they being created for the first time?
- Do you need remediation help after the findings, or only the assessment?
- Is penetration testing or staff training part of the engagement?
- Is there a deadline, such as a vendor questionnaire or an insurance renewal?
What to have ready for a quote
A rough count of devices and users, the name of your EHR and how it is hosted, a list of locations and any existing policies or prior assessments. Approximate numbers are fine for a first conversation.