HIPAA compliance has no fixed price or duration, because there is no single certificate to buy. Cost and time follow five drivers: how much ePHI you handle, how many systems and vendors touch it, the depth of your risk analysis, the gaps you must close and how well you document. We give no dollar figures because the sources do not.
Is there a HIPAA certification?
The Security Rule, in 45 CFR Part 164, sets requirements for covered entities and business associates. It does not establish a certification you apply for. Some firms offer attestations or assessments, which are useful evidence, but they are not issued by the regulator. This means your cost is mostly the cost of doing the work and documenting it, not a fee.
NIST SP 800-66 Revision 2, from February 2024, is a cybersecurity resource guide for implementing the Security Rule. It says it offers practical guidance for organizations of all sizes to protect ePHI. It is a guide, not a requirement.
What are the five drivers?
1. Scope of ePHI. Where is it created, received, maintained or transmitted? A small clinic with one records system has a smaller scope than a platform with data in several clouds, logs and analytics tools. Every extra place ePHI lives adds analysis, controls and evidence.
2. Risk analysis depth. The rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI, and risk management that reduces them to a reasonable and appropriate level. Both are marked required. A rushed spreadsheet is cheap and weak; a method that covers every system and is repeated when things change takes more effort.
3. Gaps to close. The rule also covers a sanction policy, regular review of system activity such as audit logs, a designated security official, workforce training, incident procedures and a contingency plan with data backup, disaster recovery and emergency mode operation. If you have none of these, building them is the largest cost. If you have them informally, writing and testing them is cheaper.
4. Vendors and business associates. A covered entity may let a business associate handle ePHI only after obtaining satisfactory assurances, in writing, and business associates need similar assurances from their subcontractors. Count your vendors. Each needs an agreement and some review, and cloud and AI tools are easy to forget.
5. Evidence and breach readiness. The breach notification rule requires notice to affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery. For breaches affecting 500 or more people, the Secretary is notified at the same time; for fewer, breaches are logged and reported within 60 days after the end of the calendar year. Being able to scope an incident quickly depends on inventory and logging, which take time to build.
What drives the timeline specifically?
Calendar time is usually set by people, not tools: scheduling interviews, getting vendor agreements signed, waiting for engineering to change logging, and running a training cycle. Technical items such as encrypting a store may take days, but approvals and procurement take weeks. A realistic plan puts the longest lead items, vendor agreements and risk analysis, at the start.
How do you estimate your own?
Count four things: the systems that hold ePHI, the vendors that touch it, the number of required policies you lack, and the number of people to train. Multiply attention by each. Ask two providers for a scoped estimate and ask what is excluded.
Safeguard's compliance automation can help collect and organize evidence, but it does not make you compliant on its own, and Safeguard does not certify anyone for HIPAA.
What to do
- List every place ePHI is stored or sent, including logs, backups and analytics.
- List every vendor with access and check each has a written agreement.
- Start the risk analysis early and record its method.
- Compare your policies against the rule's required list and mark gaps.
- Schedule training and a backup restore test.
- Draft an incident plan using the 60 day outer limit as a ceiling, not a target.
- Ask for scoped quotes from outside help and compare exclusions.
Quick check
Can I buy a HIPAA certificate?
No regulator issues one. You can obtain independent assessments as evidence.
Is 60 days the standard notification time?
It is the outer limit. The rule says without unreasonable delay and no later than 60 calendar days after discovery.
Sources
- 45 CFR 164.308 (Cornell LII)
- 45 CFR 164.404 (Cornell LII)
- 45 CFR 164.408 (Cornell LII)
- NIST SP 800-66 Rev. 2
Last reviewed: 18 October 2026.
