Pricing

HIPAA Compliance Plans

Every plan is one flat rate per location, with no per-user fees and no add-on charges. Pay monthly, every 12 months, or every 24 months. HIPAA compliance is complicated enough. Pricing doesn't have to be.

Curious what the work actually looks like? See the HIPAA compliance process step by step.

Small practices typically budget $5,000 to $15,000 for HIPAA compliance consulting (source: Medcurity, 2026). Full-Scope is $1,300 a year, flat.

Trusted by healthcare practices nationwide

5.0on Google · 2 reviews

Diagram: the six ways to pay, Self-Guided monthly, 12 months and 24 months, then Full-Scope monthly, 12 months and 24 months.

Prepaid annually. 2-year loyalty pricing available.

For a breakdown of pricing in greater detail, please visit our pricing breakdown page.

For advanced users
Self-Guided
$675 / 12 months
Prepaid for 12 months. Also available at $60 / month.

The platform on its own. No consulting time included.

Start Self-Guided
Most Popular
Full-Scope
$1,300 / 12 months
Prepaid for 12 months. Also available at $120 / month.

Everything in Self-Guided, plus:

Get Full-Scope

Flat rate per location. Monthly plans have no long-term commitment. We never ask for patient information.

Secure checkout by Stripe. Your payment details go straight to Stripe and never touch our servers.

Still comparing plans? Book a free 30-minute intro call with Chuck first. No obligation, no pressure.

Side by side

Compare Service Plans with One Guy Consulting

FeatureSelf-GuidedFull-Scope
Security Risk Assessment✓✓
Gap Analysis & Remediation Plans✓✓
Policy & Procedure Templates✓✓
Staff Training (HIPAA 101, CyberSecurity, Policy Attestation, FWA, Bloodborne Pathogen, Sexual Harassment)✓✓
Training Progress Tracking & Reminders✓✓
IT Inventory, Network & Physical Site Audits✓✓
Vendor Management & Digital BAA Execution✓✓
Incident Management & Anonymous Reporting✓✓
Full-Scope Extras
4 Hours a Month of 1:1 Personalized Implementation–✓
Incident Response Guidance–✓
CMS Audit Response Support–✓
Key Terms

HIPAA Compliance Definitions

These terms appear throughout the HIPAA rules and in every OGC workflow. They help clarify which requirements each service addresses.

Security Risk Assessment (SRA)

A review of threats and weak points in how you protect electronic health data (ePHI). Required under 45 CFR § 164.308(a)(1), the SRA is the base of every HIPAA program and the first item OCR asks for in an audit.

Protected Health Information (PHI)

Any health data tied to a specific person, including medical records, billing data, and insurance details, that is created, received, stored, or sent by a covered entity or business associate. When it is in digital form, it is called ePHI.

Business Associate Agreement (BAA)

A required written contract between a covered entity and any vendor that touches PHI on its behalf. The BAA spells out allowed uses of PHI, required safeguards, and breach notice duties under 45 CFR § 164.502(e).

Gap Analysis

Built from your SRA answers, organized by the HIPAA Security Rule (45 CFR Part 164, Subpart C) and Privacy Rule (Subpart E). Shows what is strong, what is missing, and what poses the most risk if left unfixed.

What's Included

What Each Service Covers and Why It Matters

Every service and tool seen online is in either of the plans here at One Guy Consulting. They each have a purpose, and most tie to a HIPAA regulation specification. Below you will find what each service covers and its purpose. That way, you can check your audit readiness.

  1. 01

    Security Risk Assessment

    Guided risk analysis through the OGC portal. It finds threats, weak points, and current safeguards. Then it builds your documented risk analysis, required under 45 CFR §164.308(a)(1)(ii)(A).

    164.308(a)(1)(ii)(A)
  2. 02

    Gap Analysis & Remediation Plans

    Built from your SRA results. It compares your current controls to Security Rule and Privacy Rule standards, finds gaps, and creates a ranked fix plan. You will know what to fix and in what order. Under 45 CFR §164.308(a)(1)(ii)(B), covered entities must reduce risks and weak points. The fix plan is your proof of meeting this rule.

    164.308(a)(1)(ii)(B)
  3. 03

    Policy & Procedure Templates

    HIPAA policies covering the Privacy Rule, Security Rule, and Breach Notification Rule. Each policy is shaped to your org's size, type, and workflow, then posted to your branded portal. Written policies are required under 45 CFR §164.316. They must be kept for six years from the date they were created or last in effect, whichever is later.

    164.316
  4. 04

    Staff Training & Progress Tracking

    Role-based training with progress tracking and sign-off records. HIPAA 101, Cybersecurity and Policy Attestation cover HIPAA's training rules: the Security Rule training program (45 CFR §164.308(a)(5)) and Privacy Rule training (45 CFR §164.530(b)). FWA, Bloodborne Pathogen and Sexual Harassment are extra modules outside HIPAA.

    164.308(a)(5)164.530(b)
  5. 05

    Vendor Management & Digital BAAs

    Vendor list with risk ratings, BAA creation and tracking, and due diligence records for each vendor. Meets the business associate contract rule under 45 CFR § 164.502(e).

    164.502(e)
  6. 06

    Incident Management & Anonymous Reporting

    Tools to log, review, and respond to security events and possible breaches. Supports the Breach Notification Rule (45 CFR §§ 164.400 to 414). Affected individuals must be notified without unreasonable delay and no later than 60 days after a breach of unsecured PHI is discovered. HHS is notified at the same time for breaches affecting 500 or more people; smaller breaches go in a log reported to HHS within 60 days after the end of the calendar year.

    164.404164.408
Regulatory References

Authoritative Sources

  • HHS.gov: Risk Analysis guidance
  • HHS.gov: Security Rule overview
  • HHS.gov: Business Associate guidance
  • HHS.gov: Breach Notification Rule
  • 45 CFR Part 164: Full regulatory text
  • HHS.gov: HIPAA Enforcement overview
Common Questions

Frequently Asked Questions

Common questions about HIPAA costs, rules, and what each plan includes.

What HIPAA requirements drive the cost of compliance?+
HIPAA costs come from required tasks under the Security Rule (45 CFR Part 164, Subpart C) and Privacy Rule (Subpart E). At a minimum you must complete: a Security Risk Assessment under §164.308(a)(1)(ii)(A), written policies, staff training under §164.308(a)(5), physical and technical safeguards, and BAAs for every vendor that touches PHI under §164.502(e). Skip any of these and you risk fines from HHS.
Is a Security Risk Assessment required every year?+
HHS says a Security Risk Assessment is not a one-time task. Under 45 CFR §164.308(a)(1)(ii)(A), covered entities must review risks and weak points on an ongoing basis. OCR expects a fresh SRA when systems, staff, or workflows change, and expects reassessment on a regular basis. OGC supports ongoing risk analysis, not a once-a-year checkbox.
Why do HIPAA compliance costs vary so much between vendors?+
Costs vary because the Security Rule sets goals but lets each entity decide how to meet them based on size and needs (45 CFR §164.306(b)). Many vendors charge per user, per module, or for consulting by the hour. OGC charges one flat rate for all required tasks (risk assessment, gap analysis, policy templates, staff training, vendor BAA tracking, and incident management) with no per-user fees or surprise add-ons. The HIPAA compliance pricing page shows what each flat plan includes.
What happens if a covered entity does not have a Business Associate Agreement with a vendor?+
Not having a BAA with a vendor that handles PHI breaks 45 CFR §164.502(e) and §164.504(e). OCR does issue fines for missing BAAs. Fines range from $145 to $73,011 per violation based on fault, with a yearly cap of $2,190,294 per category. OGC includes digital BAA creation, tracking, and vendor risk ratings so no vendor goes undocumented.
Does HIPAA require staff training, and what must it cover?+
Yes. The Security Rule requires a training program for all staff under 45 CFR §164.308(a)(5). The Privacy Rule under §164.530(b) also requires training on your policies. The Security Rule lists security reminders, protection from malicious software, log-in monitoring and password management as addressable parts of that program (45 CFR §164.308(a)(5)(ii)). OGC offers role-based training modules (HIPAA 101, Cybersecurity and Policy Attestation, plus FWA, Bloodborne Pathogen and Sexual Harassment, which go beyond HIPAA) with progress tracking and sign-off records for audit readiness.
Not sure which plan fits?

Talk it through with Chuck first.

A free 30-minute review covers where your program stands and which plan makes sense for your size.

Book your free 30-minute intro callSee the pricing breakdown
Related Reading

Recommended HIPAA Guides

HIPAA Breach Notification Rule Guide What Is HIPAA? A Guide for Healthcare Teams
OGC-BotHi! What can I help you with?