SOC 2 Cost and Budget
How much does HIPAA certification cost?
How much does HIPAA certification cost?
There is no official HIPAA certification, so nothing you purchase makes you HIPAA certified. HHS does not certify, accredit, or endorse any organisation, product, or service as compliant. What money can buy is a third-party assessment against the HIPAA rules, typically $5,000 to $30,000, or HITRUST certification starting around $50,000. What compliance actually requires is a documented risk analysis, implemented safeguards, signed business associate agreements, and evidence that all of it operates.
What you can actually buy
| What | Typical cost | What it gives you |
|---|---|---|
| Third-party HIPAA assessment | $5,000 to $30,000 | A firm's written opinion on your safeguards. Not a certification. |
| HITRUST CSF certification | $50,000 and up | A real certification against a framework that incorporates HIPAA. Heavy. |
| SOC 2 with HIPAA mapped in | $10,000 to $60,000 audit fee | An independent auditor's opinion buyers already recognise |
| Internal program only | Staff time | Legally sufficient. Harder to prove to a buyer. |
Why the question keeps getting asked
Because vendors sell "HIPAA certified" badges, and because enterprise procurement asks for one. Both sides of that exchange are working from a premise the regulation does not support. HHS is explicit that it does not endorse or certify, and the enforcement mechanism is investigation after a complaint or breach, not a certificate you renew.
The practical consequence: a HIPAA certificate from a vendor carries whatever weight the buyer assigns to that vendor's name, which is usually little.
What buyers accept instead
In practice, a healthcare buyer asking for HIPAA assurance will accept:
- A signed BAA. Non-negotiable, and it is a contract rather than a certificate.
- A SOC 2 Type II report, often with HIPAA criteria mapped into the scope. This is the common answer because it carries an independent CPA firm's opinion.
- Your risk analysis and safeguard documentation, if they are technical enough to read it.
HITRUST appears when the buyer is a large health system or payer that mandates it. It is expensive and slow, and worth it only when a named customer requires it.
The real cost of HIPAA compliance
The assessment is rarely the largest line. The work is:
- Risk analysis. Required by the Security Rule, and the single most common enforcement finding when it is missing.
- Remediation. Encryption, access control, audit logging, whatever the analysis surfaces.
- Policies and training. Written, distributed, and recorded per person.
- BAAs. With every vendor touching PHI, and their subcontractors under the Omnibus Rule.
- Ongoing evidence. Access reviews, log review, incident records.
Screenata covers HIPAA at $499/month per framework for a company up to 50 employees, $1,000/month at 51 to 200. If you already run SOC 2 with us, HIPAA is 70% of that base rate, because the safeguards overlap heavily and the evidence crosswalks through a NIST 800-53 hub rather than being collected twice. The audit fee, if you pursue SOC 2, is separate and paid to your auditor, not to us.