What a HIPAA risk assessment costs, and why we quote it on a call
The fee depends on a few things you can see coming: how many sites you have, whether any work is on site, how many systems and vendors hold patient data, and how soon you need the report. What doesn't change: one fixed fee, agreed in writing, for a defined scope, a plain-English report, and a ranked roadmap in 2 to 4 weeks for a typical single site.
The short version
Harborline’s typical single-site HIPAA / 360° risk assessment is a fixed fee, scoped on a short call. Delivery is usually 2 to 4 weeks after kickoff for a remote engagement. You get guided sessions with your team, a plain-English report, and a prioritized roadmap a practice admin can use with leadership, counsel, or a broker. Extra locations and out-of-footprint scope are confirmed on the scoping call before any SOW.
How a full assessment compares with templates and low-cost vendors
Same question practice admins ask. Here is what each option usually is, facts only.
DIY and software questionnaires
Self-serve tools built around a checklist or self-attestation. Your practice does the work and owns the judgment calls. Often not auditor or insurance ready in the way a report led by a former healthcare CISO is.
CIPP and privacy checklist engagements
Faster and cheaper compliance paperwork. Typically not a full 360 risk analysis, led by a former healthcare CISO, across technical, administrative, and physical safeguards.
Harborline 360 Risk Assessment
Fixed fee, scoped on a short callLed by a former healthcare CISO. Delivered in 2 to 4 weeks. Plain-English findings and a prioritized plan, dual-use for insurance renewal and OCR or audit evidence. Extra sites are a fixed fee, scoped on a short call. The optional Physical Security Walkthrough is a separate line.
What the fixed fee covers for a single site
One fixed fee, agreed in writing before we start, so small and mid-size practices (roughly 5 to 100 staff) can plan the budget with no surprise invoices.
- 1A HIPAA / 360 risk assessment led by a former healthcare CISO, covering breach readiness, compliance documentation, and privacy risk in one engagement
- 2Guided sessions with your team, not a questionnaire dump
- 3A plain-English report and a prioritized roadmap
- 4Flat fee with no hourly meter and no surprise invoice for the agreed scope
What can change the price
More than one location
Fixed fee, scoped on a short call, plus travel at cost on-site, per additional assessment site. This covers reviewing another location as part of the assessment scope.
Physical Security Walkthrough
Fixed fee, scoped on a short call, as an add-on with the assessment. We look at doors, badges, clinics, and how the waiting room really works. You get observed physical-safeguard findings and a sit-down with the people who run the office. Your IT contact or MSP still implements. Remote remains the default for the assessment. This is separate from additional-site pricing.
Scope outside a standard practice footprint
Multi-entity groups, heavy vendor estates, or unusual systems get confirmed on the scoping call before any SOW.
Add-on work
Penetration testing, tabletops, and ongoing advisory are separate catalog items when needed. Hands-on control work stays with your IT or MSP; Harborline guides that work and verifies evidence.
Annual continuity
After the assessment, many practices move to the Annual Security Program.
We don't post a number that might not fit your practice. On the free 30-minute scoping call we confirm your scope and quote one fixed fee, in writing, before you spend anything.
What you get in 2 to 4 weeks
- A current security risk analysis you can show leadership, counsel, or your broker when asked
- Findings ranked by what to fix first, in language a practice admin can use
- A clear handoff into annual rhythm if you want continuity, not a one-time binder
Free from Harborline means educational content and a scoping call only. Assessments are always paid engagements.
Cost questions we hear most
Is the Physical Security Walkthrough the same as an additional site?
No. Additional assessment sites are a fixed fee, scoped on a short call, plus travel at cost on-site. That covers reviewing another location as part of the assessment scope. The Physical Security Walkthrough is an optional on-the-floor physical-safeguards visit offered as an add-on with the assessment. Remote remains the default for the assessment.
How much does a HIPAA risk assessment cost for a small clinic?
Every Harborline HIPAA / 360° risk assessment is a fixed fee. We confirm it on a free 30-minute scoping call, after we understand your sites, systems and deadlines, and you get it in writing before any work starts. Multi-site practices and unusual setups are scoped the same way.
How long does a remote HIPAA risk assessment take?
Typical single-site remote assessment: 2 to 4 weeks after kickoff, paced by your team’s availability for sessions and documents.
What do we get for the fixed fee?
Guided analysis (not a questionnaire dump), a plain-English report, and a ranked roadmap. Flat fee for the agreed single-site scope. No hourly meter for that agreed work.
Does the fee include fixing the findings?
The assessment covers guided analysis, a plain-English report, and a ranked remediation roadmap. Fixing findings is the Remediate step: usually your MSP or practice IT implements while Harborline verifies evidence. Harborline can also discuss implementation options when you want us closer to the work. Remediation pricing is not inside the assessment fee; it is quoted separately after scoping.
Do we need a pen test or a risk analysis?
Most outpatient practices need a risk analysis first. A pen test tries to exploit specific systems; a risk assessment maps risks, controls, and documentation across the practice. Harborline can clarify fit on the scoping call (see also risk-assessment vs penetration-test page).
What if we only need this for insurance or a payer questionnaire?
A current assessment and ranked plan often help those conversations. Harborline does not issue fake audit opinions. We deliver evidence-minded reporting a practice admin can reuse. Book a 30-minute scoping call to confirm timing against your renewal or questionnaire deadline.
If a single-site assessment sounds like the right next step, book a scoping call and we will confirm fit before any SOW.
Related pages
One-time assessment vs Annual Security Program
Which flat fee fits: the one-time report now, or a year of light continuity.
Risk assessment vs penetration test
What each one answers, and which one your renewal or auditor is actually asking for.
HIPAA risk assessment cost and requirements
What the Security Rule asks for and how a defensible risk analysis is built.
HIPAA Security Rule risk assessment
The full service description, deliverables, and how the engagement runs.
Annual Security Program
Fixed fee, scoped on a short call. Reassessment, four quarterly check-ins, and capped async questions.
About Harborline
Led by senior healthcare security practitioners with former CISO experience.
Questions? Use our contact form.
Scope your assessment
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.