How to become HIPAA compliant

This page includes our own product, labeled Our product. It is judged on the same criteria and listed in the same order as everything else — how we make money.

The five routes side by side

1. Route 1

   Do it yourself

   $0 free

   Your timeMost

   You getFree forms, tools and guidance

   Best whenYou have time to start from your EHR's forms and free HHS materials and piece the rest together

   Wrong whenYou need a structured plan rather than assembling the materials yourself.

   Start with the checklist →

2. Route 2 · Our product

   Template pack

   $299 one-time · $249 launch price for the first 30 days after sales open

   Your timeModerate

   You getFull kit of documents

   Best whenYou can handle basic customization and updates yourself

   Wrong whenYou have no resources to adapt, apply and update them.

   Ours: $299, soon

3. Route 3

   Compliance software

   $1,900–$8,200 per year

   Your timeModerate

   You getProgram + reminders

   Best whenYou want reminders and evidence tracking, and can pay monthly

   Wrong whenBudget is tight and your setup is simple enough for templates.

   Compare platforms →

4. Route 4

   Consultant

   $1,500–$9,000 per engagement · estimate

   Your timeLess

   You getAs scoped

   Best whenYou lack time or know-how, or face complex systems or an incident

   Wrong whenYou only need documents, not hands-on help — templates are cheaper.

5. Route 5

   Healthcare attorney

   $500–$2,000 per focused review · estimate

   Your timeLow for the review

   You getLegal judgment

   Best whenContracts, state law, breach decisions or an OCR inquiry

   Wrong whenYou need someone to run the program, not legal advice.

   If OCR has written to you →

What every route still needs to cover

• Security risk analysis →§ 164.308(a)(1)(ii)(A)Every covered entity and business associate must document an accurate and thorough assessment of risks to the ePHI it holds — and then act on it. It is one of the most commonly missing pieces of HIPAA compliance, including in small practices.
• HIPAA policies and procedures →§ 164.316What written policies and procedures HIPAA requires, how to keep them current, and how long to keep them — for small practices and business associates.
• Workforce training and security awareness →§ 164.530(b) · 164.308(a)(5)Covered entities: training on their privacy and breach policies (164.530(b)). Covered entities and business associates: security awareness and training (164.308(a)(5)).
• Business associate agreements (BAAs) →§ 164.502(e)A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate, and you need a signed BAA with it before it touches patient data. No BAA means you should not put PHI in that tool.
• Notifying patients of a breach →§ 164.402An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented four-factor assessment shows a low probability of compromise. Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery.
• HIPAA documentation retention →§ 164.316(b)(2)What HIPAA requires you to keep and for how long — six years for compliance documentation — and why medical record retention is a state-law question.

The full list for your situation: therapy practice · medical practice · dental practice · business associate.

Start free: the HIPAA compliance checklist (no sign-up) — or the Vendor & BAA Register, because whichever route you choose, you will need to track the vendors that handle PHI and their BAAs.