HIPAA compliance for a small practice costs three things: a free federal tool, staff time, and a paid email service. The big quotes you may have seen, for a "HIPAA certification" or a penetration test, cover items HIPAA doesn't require today.

The required risk analysis can start with a free HHS tool

The HIPAA Security Rule requires a documented risk analysis. The HHS Office of the National Coordinator for Health IT and the Office for Civil Rights (OCR) give away a Security Risk Assessment Tool built for it. Version 3.7 came out in September 2026 as a free Windows application, also available as an Excel workbook.

The tool's intended audience is small and medium providers, and it walks you through threats, vulnerabilities, assets, and vendors. Paubox covered what changed in version 3.7, including remote access and telework.

Policies, training, and the risk analysis cost staff time

Using the tool takes staff hours. Someone at your practice has to answer its questions, write the policies it points to, and train staff on them. For a small practice, every one of those hours is an hour away from patients.

Time is where small practices say they run short. In Paubox's survey of healthcare organizations with fewer than 250 employees, more than 80% said they were confident in their compliance. One third also said they don't have enough time for compliance tasks, and the same share have no clear policies or procedures.

The paid part is email that covers every message

The email service itself is the paid line item. Before it handles patient information, the vendor must sign a business associate agreement (BAA) with your practice. Paubox's survey shows where small practices leave gaps.

Of the small healthcare organizations Paubox surveyed, 20% keep no email archive or record of what they sent, so they can't look back after an incident. About half have no phishing or spoofing protection beyond their email platform's default settings. HIPAA compliant email should encrypt every message without staff having to remember a step, and keep a record of what was sent and whether it was encrypted.

Certification and penetration tests are optional today

HHS says in its Security Rule FAQ that "there is no standard or implementation specification that requires a covered entity to 'certify' compliance." It "does not endorse or otherwise recognize private organizations' 'certifications'," and those certifications don't remove a practice's legal obligations.

The rule does require a periodic evaluation of your security policies, and HHS says it "can be performed internally by the covered entity or by an external organization." Paying an outside firm for it is your choice.

A penetration test is a hired attempt to break into your systems the way an attacker would. HIPAA doesn't specifically require one under the current Security Rule.

That may change. The proposed Security Rule update would require vulnerability scanning every six months and penetration testing annually. In July 2026, HHS moved its target date for finalizing the rule from May 2026 to July 2027. Your risk analysis will show which systems a test should cover when the time comes.

Skipping the risk analysis cost two providers $5,000 and $103,000

Vision Upright MRI, which HHS describes as "a small California health care provider," had never conducted a HIPAA risk analysis. It paid $5,000 and agreed to a corrective action plan that OCR will monitor for two years.

In February 2026, Top of the World Ranch Treatment Center, an Illinois substance use disorder treatment provider, paid $103,000 after a phishing attack on a staff member's email account exposed 1,980 patients' information. It had failed to conduct an accurate and thorough risk analysis, and its two-year corrective action plan requires one, along with a risk management plan, written policies, and annual staff training.

Paubox's small practice report notes that two years of monitoring and the required overhaul can cost a small practice more than the payment itself.

Where your compliance budget goes

Free

  • The HHS Security Risk Assessment Tool

Staff time

  • Completing and documenting the risk analysis
  • A risk management plan that fixes what the analysis finds
  • Written policies and procedures, plus annual staff training
  • A signed BAA with every vendor that handles patient information

Paid

  • Email that encrypts every message and keeps a record of what you sent

Optional for now

  • An outside evaluation or "certification"
  • A penetration test, which would become an annual requirement if the proposed rule is finalized

Each line is something you can check against your own setup today.