HIPAA security for small practices: costs and what drives them

What HIPAA security for small medical and dental practices requires and costs

The HIPAA Security Rule applies to a small practice's electronic protected health information (ePHI), and it is scalable: HHS does not dictate specific measures, so a practice chooses safeguards based on its size, complexity, technical infrastructure, costs and the likelihood and impact of risks. There is no HIPAA certification. A payer, contract or OCR inquiry that asks for proof should receive the practice's own documented risk analysis, written policies and evidence that its safeguards operate, not a certificate. HHS has stated that it does not endorse or recognize private certifications, and no Security Rule standard requires a certificate.

Cost and effort depend on how many systems hold ePHI, how many locations and workstations exist, how many staff need access, and how many third parties store or process patient data, such as a practice management vendor, a cloud host or a billing service. A practice with one site and a single electronic record system faces a very different workload than one with several offices and remote staff. The practice owns its controls and makes the decisions, including the designated security official required by 45 CFR 164.308(a)(2). A managed service provider (MSP) or consultant can configure systems, collect logs and prepare evidence, but the practice must confirm that the work matches its own risk analysis. Ask any provider for a written scope listing the systems covered, the deliverables, who signs the business associate agreement, and which tasks recur each year. The free HHS Security Risk Assessment Tool gives a starting structure for a practice that wants to estimate its own effort before getting quotes.

Who gets paid for what in a small practice HIPAA project

This table shows who is paid for each part of a small practice's HIPAA Security Rule work, whether the cost is one-time or recurring, and what pushes it up or down. Use it to build a written quote request, since HIPAA has no certificate and no certification fee exists.

Cost component	Who is paid or who does the work	One-time or recurring, and what drives it
Security official time	The practice owns this role under 45 CFR 164.308(a)(2); the work may be done by a staff member or an outside person	Recurring. Drives: practice size, how many systems hold ePHI, and how much policy upkeep the practice takes on itself
Front office and clinician time	Practice staff, paid through existing payroll	Recurring. Drives: staff turnover, the number of training sessions, and how many workflows touch patient records
Risk analysis	Practice staff using the free HHS SRA Tool, or an MSP or consultant paid by the practice	One-time to start, then recurring updates. Drives: number of locations, software in use, and whether outside help is needed to map where ePHI lives
MSP or consultant for technical safeguards	A managed service provider or consultant paid by the practice to configure access, backups, encryption and logging	Mostly one-time setup, then recurring monitoring and support. Drives: number of endpoints, cloud use, and the scope of services in the contract
Software and hardware	Vendors and resellers paid by the practice, including any business associate terms the vendor will sign	One-time purchase or setup, plus recurring licenses and renewals. Drives: device count, licensing model and replacement cycles
Training	Internal staff time, or an outside trainer or MSP paid by the practice	Recurring. Drives: workforce size, new hires and whether training is delivered in-house or outsourced
Outside assessment, if chosen	An independent assessor paid by the practice to test specific controls and report on what was tested	One-time or periodic. Drives: scope, number of systems tested and the level of detail in the report. Note that no certification fee exists because HIPAA has no certificate

What makes HIPAA security work in a small practice bigger or smaller

Six drivers decide how large the Security Rule job is for a small practice. Most of them can be shaped before the risk analysis begins, by consolidating systems, documenting vendors and writing down the rules the practice already follows. Control the drivers first and the risk analysis becomes a bounded exercise rather than an open-ended one.

Locations and workstations

Every site and every device that opens ePHI adds assets the risk analysis must inventory, and each one needs access controls, workstation security and device and media handling under the physical and technical standards. Two sites with a shared server are a different job from two independent offices with local files. Before the analysis starts, list each location, each computer, tablet and phone that touches patient records, and any shared printers or scanners. Ask which devices are personally owned. Consolidating to fewer, managed endpoints shrinks the inventory and the number of configurations you must document and maintain.

Where ePHI is stored

A practice with an on-premises server carries hardware, patching, physical access and backup duties that a cloud practice management system moves to the vendor. Many practices run both, with imaging or document storage on a local machine and scheduling in the cloud. Map every location where ePHI is created, stored, transmitted or printed, including email, texting tools and exported spreadsheets. Retiring stray copies is often the cheapest risk reduction available, and it makes the risk analysis shorter and more accurate.

Business associates handling PHI

Each vendor that creates, receives, maintains or transmits PHI for the practice is a business associate, and the Security Rule requires satisfactory assurances in writing before that vendor touches the data. A practice with a billing company, an IT provider, a transcription service and a cloud host has four contracts to review, while a practice with one all-in-one vendor has one. List every vendor and confirm a signed business associate agreement exists for each. Missing agreements are a gap you should fix before the risk analysis, not discover during it.

Maturity of existing policies

A practice that already has written security policies, a named security official and dated training records starts the Security Rule work with documentation it can test. A practice that has never written anything faces drafting every policy, which is the documentation standard in its own right. Gather what exists, including employee handbook sections, vendor onboarding notes and past incident records, and check each against the requirement it claims to meet. The security official role under the administrative standards must be assigned to a named person whatever the size of the practice.

Backups and remote access

Whether the practice runs its own backups and remote access sets the scope of the contingency planning and access control work. Self-managed backups require documented restore testing, offsite or immutable copies and encryption, while a vendor-managed service shifts part of that work to a contract you must review. Remote access through a home router, a shared login or a remote desktop tool exposed to the Internet is a common finding in enforcement cases. Ask who holds backup credentials, when a restore was last tested, and which remote access paths exist.

Who maintains the controls

A practice with one owner-dentist and no IT staff depends on an outside provider, a part-time office manager or both to keep controls running after the assessment ends. Scope grows when controls depend on people who are not written down or trained. Assign each safeguard an owner, a review frequency and a record of completion. Where an outside managed service provider handles technical tasks, the practice still owns the policies and the security official role, and the division of duties should appear in writing.

What the Security Rule asks a small practice to do

The Security Rule asks a small practice to protect electronic protected health information with measures chosen for its own size, complexity, technical infrastructure, costs, and the likelihood and impact of threats. HHS describes the rule as flexible, scalable and technology neutral, so it does not dictate a fixed product list or a single configuration. A two-dentist office with one server and a cloud scheduling system faces a different set of decisions than a multi-site group, and the rule expects those decisions to be made deliberately and written down. The practical starting point is a clear answer to who is responsible for security, followed by an honest look at where patient data actually lives.

Under 45 CFR 164.308(a)(2), the practice must identify one security official responsible for developing and implementing its Security Rule policies and procedures. This can be an owner, a office manager or an outside person, but the name must be documented and the role must have real authority over the systems and staff. Next comes the risk analysis, which HHS treats as the foundation for every other choice. The practice should list every system, device, account and vendor that creates, receives, maintains or transmits ePHI, then record the threats and vulnerabilities for each. The free HHS Security Risk Assessment Tool can structure this work, and the practice should confirm the current version and system requirements before installing it.

Many implementation specifications are addressable rather than required. Under 45 CFR 164.306(d), the practice must assess whether each addressable measure is reasonable and appropriate in its setting. If it is not, the practice must document why and implement an equivalent alternative if one is reasonable and appropriate. This documentation is where a small practice shows its reasoning, so a short, dated record explaining a decision, such as why a particular logging or device control was deferred and what compensating step was taken, is more useful to an assessor than an undocumented gap. Practices working with an outside IT or compliance provider should ask that provider to draft these decisions for the owner's review, since the decisions belong to the practice.

How a small practice moves from risk analysis to documented safeguards

This sequence takes a small practice from knowing where electronic protected health information lives to a set of written, assigned and reviewed safeguards it can show to an assessor or OCR. Each phase produces a record, and the records build on one another.

Inventory ePHI systems and vendors
Start by listing every place electronic protected health information is created, received, stored or sent. That covers the practice management system, imaging or lab interfaces, email, phones and tablets, backup media, and any outside vendor that hosts or touches the data. The practice owner or the designated security official usually leads this work, with input from front-desk and clinical staff who know how records actually move. The output is a written inventory with a named owner for each system and a list of vendors that will need business associate agreements if they do not already have them. The step is done when someone outside the workflow could read the list and find every system that holds patient data.
Complete the risk analysis with the SRA Tool
Work through the free HHS Security Risk Assessment Tool, or a guided risk analysis if the practice prefers, using the inventory as the scope. The assessment asks which threats and vulnerabilities could affect each system, how likely they are, and how much harm they could cause. The security official records the answers, the rating given to each risk and the reasoning behind it. The output is a dated risk analysis record that states the scope, method, threats considered and results. Confirm with any outside helper what the written scope includes, how the deliverable is formatted, and when it will be delivered.
Build a risk management plan with owners
Turn the highest-rated risks into a plan that says what will be done about each one. For every item, the plan names an owner, the measure chosen, the reason for that measure, and how completion will be checked. Where a required safeguard is addressable, the plan records whether it is reasonable and appropriate for this practice and, if it is not, the equivalent measure being used instead. Cost and time commitments should be agreed in the written scope, not assumed. The output is a risk management plan signed off by the practice owner, with a status column that can be updated later.
Implement safeguards and write the policies
Carry out the measures in the plan. Typical examples include access controls tied to job roles, unique user accounts, multi-factor authentication where the plan requires it, encryption on portable devices, automatic logoff, secured backups, and a documented process for disposing of old hardware. Each safeguard needs a written policy or procedure that explains what staff must do and who checks it. The output is a set of policies and procedures, plus configuration or vendor records that show the controls exist. Where a managed service provider performs part of the work, the practice should keep copies of its records and the agreement that governs them.
Train staff and record attendance
Deliver security awareness and role-based training to everyone who touches patient data, including temporary staff and clinicians who work part time. Cover the policies that apply to their jobs, how to spot phishing, how to report a suspected incident, and how to handle records on paper and on screens. The training lead keeps a log with the date, topic, attendees and the material used, and repeats training when policies change or new staff join. The output is a training log and signed acknowledgments of the policies. Ask any outside trainer to provide the materials and attendance records in a form the practice can keep.
Set a review routine and record each review
Schedule a recurring review of the risk analysis, the risk management plan, the policies and the vendor list, and trigger an extra review after a new system, a new vendor, a move to a new location or a security incident. The reviewer checks whether each risk rating still holds, whether planned measures are complete, and whether training and access lists are current. The output is a review record with the date, reviewer, findings and changes made, kept alongside the earlier versions of the risk analysis. Documentation under the Security Rule must be retained and kept current, so the review record is part of the evidence, not an afterthought.

Who owns the controls, who does the work, and who issues nothing

The covered entity remains responsible for Security Rule compliance, whatever it outsources. The practice decides how its electronic protected health information is used and protected, and under 45 CFR 164.308(a)(2) it must identify a security official who is responsible for developing and implementing the required policies and procedures. That person does not have to be a full-time security hire, but the role must be named and the work must actually happen.

Security official: Name one person in writing, give them time for the role, and make sure they can explain the practice's safeguards to staff and to an investigator.
Policies and procedures: Approve the written policies that the rule requires, then review them when systems or staff change.
Risk management plan: Own the decisions on which risks to reduce, accept or transfer, and record the reasons for addressable specifications that are not implemented as written.
Workforce actions: Handle onboarding, role changes, termination, training and sanctions, which no vendor can perform on the staff's behalf.
Business associate contracts: Confirm that every vendor that touches ePHI has signed an agreement and is listed in the practice's inventory.

Check that the security official can name the current risk management plan, its owner and the date of its last review.

Self-service, MSP-led or consultant-led: which option fits

This table compares three ways a small practice can cover HIPAA Security Rule work: running it internally with HHS materials, handing technical safeguards to a managed service provider, or bringing in a consultant for risk analysis and policy. Read each row against your own staffing and history, then check what the practice still owns under each model, because no option transfers responsibility for the Security Rule itself.

Option	When it fits	What the practice still owns
Self-service with the SRA Tool and HHS small provider materials	Single-site office with a capable managing partner who can give time to the work, and no prior findings or payer demands	Completing the risk analysis, naming the security official under 45 CFR 164.308(a)(2), writing policies, training staff and approving every decision
MSP-led technical safeguards using HICP Volume 1 as the main reference	Practice with limited IT staff that needs backups, patching, endpoint protection, access control and monitoring run on a managed basis	Risk analysis inputs, the security official role, workforce access decisions, training completion and reviewing the MSP's reports
Consultant-led risk analysis and policy work	Practice with prior findings, an OCR inquiry, a payer or contract demand for documented assurance, or a recent change in systems	Acting on findings, funding remediation, keeping documentation current and answering staff and patient questions
Hybrid: consultant for the risk analysis, MSP for operations	Practice that wants an outside view of its risks and also lacks in-house technical capacity	Coordinating both parties, approving the risk management plan and confirming the MSP's contract covers the safeguards the analysis identified
What to ask any MSP before signing	Every MSP handling PHI, including those with HIPAA-branded service packages	Confirm in writing that the MSP will sign a business associate agreement, describe how it supports the practice's risk analysis, and state which Security Rule safeguards it runs and which remain with the practice
What to ask any consultant before signing	Any consultant offering a HIPAA assessment or certificate	Ask for the scope, deliverables and written statement that the work is a readiness review, since HHS does not recognize private HIPAA certifications
Cost drivers to request in a quote	All three models, as the basis for comparing proposals	Ask whether the quote is one-time or recurring, what systems and locations are included, and how changes in scope are priced

What OCR enforcement cases show about small practice risk

The clearest lesson from OCR's recent cases for a small practice is that the missing risk analysis and an exposed system are the failures that lead to penalties. In May 2025, Vision Upright MRI, a single-site imaging provider, paid $25,000 after medical images stored on a PACS server were reachable over the Internet. OCR found the company had never conducted a risk analysis and had not notified affected individuals within 60 days. Neither failure required sophisticated attackers. Both were visible from a basic inventory of where ePHI lives and which systems face the Internet. These cases do not all involve small practices, and an imaging provider is not a dental office, but the control gaps map directly onto small clinics that run a server, a shared drive or a remote access tool.

Two more recent settlements show the range of outcomes. Ambry Genetics agreed to pay $700,000 in September 2026 after a phishing attack, and MMG Fusion agreed to pay $10,000 in March 2026, where OCR considered the company's financial condition. Both resolutions include multi-year corrective action plans, which means the regulator monitors the organization after the payment. Ask any outside party to show you the corrective action terms in the published agreements before assuming a small organization would receive a lower standard. The HHS press release on the MMG Fusion breach is a useful starting point for reading how OCR weighed the company's circumstances.

Penalties are assessed per violation, and the amounts are set in 45 CFR 102.3 and adjusted for inflation. A single unaddressed gap can therefore be counted several times, and the calendar-year cap applies to identical violations. Confirm the current figures in the eCFR table before you build any budget, and ask your advisor how a regulator would count a missing risk analysis alongside an exposed server. Practically, a small practice should schedule its first documented risk analysis with the free SRA Tool, confirm that no clinical system is reachable from the Internet without a documented reason, and set a written breach response clock so notification does not depend on memory.

How to choose an MSP, consultant or assessor for a small practice

A small practice can buy help with its HIPAA Security Rule work, but the organization stays responsible for its safeguards and the risk analysis. The cards below are checks that separate a partner who will prepare your systems and evidence from one who will overpromise. No accreditation makes any partner HIPAA certified, because HHS does not recognize certifications.

Small covered entity experience

Ask for examples of work with practices of your size, such as dental offices or single-site clinics, and ask how they tailored the risk analysis to a small environment. A partner used to enterprise programs may hand you a generic policy set you cannot run. Ask who on the team has done the HHS SRA Tool or a comparable risk analysis before, and what they would expect to find in your office network. Confirm they can explain the Security Rule's flexible, scalable approach in plain terms.

Business associate agreement first

If a partner will create, receive, maintain or transmit your electronic protected health information, including remote access to your practice management system or backups, it is a business associate and needs a business associate agreement before any work begins. Ask for the signed agreement, review how it covers subcontractors, breach reporting and return or destruction of data at the end. A partner who will not sign one should not touch patient data.

Named contact for risk analysis

Ask who will own the risk analysis, the evidence files and the remediation tracking, and who your practice's security official will be. The Security Rule requires you to identify the security official responsible for policies and procedures, and that role cannot be handed off on paper alone. Require one named person at the partner for technical questions and one for documentation, with a stated way to reach them when a staff member reports a suspicious email.

Fixed scope in writing

Ask for a written scope that lists the locations, systems, devices, cloud services and staff training included, along with deliverables and dates. Ask what is excluded, such as penetration testing, staff phishing exercises or policy rewrites. A fixed scope lets you compare quotes on the same work. Ask how changes are priced if you add a second site or a new imaging device during the engagement.

Separation of duties

If the same firm sells you managed IT, configures your systems and then certifies that they are secure, nothing independent checks the work. Ask how the partner separates its implementation role from any assessment, and whether an outside assessor will review the findings. Only an independent auditor or assessor can issue a report on your compliance. Make sure the partner does not describe its own review as an official HIPAA attestation.

Handover at the end

Ask what you keep when the engagement ends: the risk analysis report, the risk management plan, written policies, the asset inventory, backup and restore records, training logs and the incident response steps. Confirm you own the documents and can give them to a future partner or regulator. Ask how long the partner will answer questions after handover and whether that support is included or billed separately.

Questions small practices ask before hiring outside help

How much effort should a small practice expect for HIPAA Security Rule work?

Effort depends on how many systems hold electronic protected health information, how many staff touch them, and how much policy and documentation the practice lacks today. The Security Rule is flexible and scalable, so HHS expects a small practice to choose measures that fit its size, complexity and capabilities rather than a fixed checklist. Owners need to make decisions: naming the security official required by 45 CFR 164.308(a)(2), approving written policies, and deciding how the practice will manage risk. Staff need to follow new access, training and device routines. Ask any outside party to list which tasks it will do, which the practice must do itself, and how many hours of staff time it expects each month.

Can a small practice do its own risk analysis with the SRA Tool?

Yes, a practice can complete its own risk analysis with the HHS Security Risk Assessment Tool, which ONC and OCR developed for small and medium providers. The tool is available as a 64-bit Windows application and as an Excel workbook with a user guide, and the current version is 3.7. The tool walks through questions but does not decide what is reasonable for your environment, so the answers still need someone who knows where ePHI lives, including workstations, imaging, email and backups. HHS's paper *Basics of Risk Analysis and Risk Management* is a useful companion. Many practices do the first pass in-house and bring in help only to check gaps and document decisions.

Does a small practice need a managed service provider for HIPAA?

A practice is not required to hire an MSP, but many small practices rely on one for patching, backups, endpoint protection and account management. The HHS 405(d) Health Industry Cybersecurity Practices guide recommends that small organizations with a managed service provider give it the main document and Technical Volume 1. A covered entity remains responsible for its compliance, and an MSP that handles ePHI must sign a business associate agreement. Before signing, confirm which Security Rule safeguards the MSP operates, who holds administrator credentials, how incidents are reported to you, and how the contract ends and returns or destroys data.

Is there an official HIPAA certificate a practice can buy?

No. HHS states that no Security Rule standard requires an entity to certify compliance, and that HHS does not endorse or recognize private certifications. A vendor or consultant that offers a HIPAA certificate is selling a service, not a government credential, and such a document does not prevent OCR from later finding a violation. What a practice can obtain is an independent assessment report that describes the scope tested, the method used and the findings. Ask any provider to state exactly what the report covers and what it does not cover before paying for it.

How long does HIPAA Security Rule work take for a small practice?

The timeline depends on the number of systems in scope, the state of existing controls, and how quickly the practice can make decisions and approve changes. No standard duration is set by the Security Rule, so the answer should come from the written scope rather than a general rule of thumb. Ask the provider to break the schedule into phases: inventory, risk analysis, remediation, policy and training, and evidence collection. Confirm which phases depend on practice staff being available, and what happens to the schedule if a phase slips.

What can a third-party HIPAA assessment show, and what can it not?

A third-party assessment can show that a defined set of controls was examined at a specific point in time, with the method and findings written down. It cannot prove that the practice is compliant in the future, cannot replace the practice's own risk analysis or security official, and cannot bind OCR. A useful report lists the systems and locations in scope, the evidence reviewed, the gaps found and the remediation owner for each gap. Be cautious of any document that claims a blanket pass without describing its scope. OCR's enforcement record shows that failure to conduct an accurate risk analysis is a common finding in small-provider cases.

What drives the price of HIPAA help for a small practice?

The main drivers are the number of locations and systems in scope, the amount of existing documentation, how many staff must be trained, and whether the practice wants ongoing monitoring or a one-time assessment. One-time costs usually include the initial risk analysis, remediation work and policy drafting. Recurring costs include MSP services, security tooling, periodic risk reviews and training refreshes. DeployOpen does not publish a price list; a quote follows from a written scope. When comparing quotes, ask each provider to separate one-time from recurring fees and to list which tasks are excluded.

How DeployOpen scopes and prepares HIPAA security evidence for a small practice

DeployOpen works with small medical and dental practices as an implementation partner. We help prepare the systems, documentation and evidence the practice needs for its Security Rule program, while the practice keeps ownership of its safeguards and decisions and any independent assessment stays with an outside assessor.

How we scope

Agree a written scope listing the systems that hold ePHI, the locations and vendors involved, and the safeguards to be prepared.
Confirm the named security official and the practice staff who approve policies, access decisions and risk management actions.
Ask the practice to confirm its risk analysis status, since the written scope should state whether an existing analysis is updated or a new one is prepared.

How we build

Set up open-source tooling for access control, audit logging, backup and patch tracking inside the practice's chosen hosting environment.
Draft policies and procedures mapped to the practice's systems, and document where each safeguard is implemented and tested.
Test configurations against the written scope and record results so the practice can show what was checked and when.

How we hand over

Deliver the documented configurations, runbooks, policy set and test records named in the written scope.
Walk the practice's staff through how to operate, review and update the controls after handover.
Clarify that the practice owns its Security Rule program and that DeployOpen does not issue audit reports, attestations or certifications.

How we support

Engagements are fixed-scope, so changes to systems or vendors are handled through a written change to scope.
Ongoing support, upgrades and continuous testing are available as a retainer, which can cover periodic reviews of the risk analysis inputs.
Ask any quote to separate one-time setup work from recurring retainer work, and to name who performs each part.

HIPAA security for small medical and dental practices