# HIPAA Audit & Assessment Pricing — Auditsuisse

> Standard starting fees for HIPAA audits and assessments from Auditsuisse Assurance, a US- and Switzerland-based AICPA CPA firm (enrolled in the AICPA Peer Review program). Fees are published openly, priced by company headcount, and cover the Security Risk Analysis required by the HIPAA Security Rule, Security Rule and Privacy Rule review, gap analysis, and a compliance attestation letter. The assessment can be completed 100% without a GRC platform.

- Canonical page: https://auditsuisse.com/hipaa-pricing
- Firm: Auditsuisse Assurance (https://auditsuisse.com)
- Currency: USD, fixed fee (no hourly billing)
- Pricing type: starting fees for standard engagements — final fee confirmed in the engagement letter, based on MSP involvement, GRC platform status, and observation-period length
- Pricing last updated: August 8, 2026

## Standard HIPAA audit and assessment fees

| Company headcount | HIPAA audit & assessment |
| --- | --- |
| 1–20 employees | From $2,000 |
| 21–35 employees | From $3,000 |
| 36–50 employees | From $4,000 |
| 51–100 employees | From $5,000 |
| 101–250 employees | From $10,000 |
| 251+ employees | Custom quote |

**These are starting fees for standard engagements.** The final fee is set at scoping by three published factors: whether the environment is managed by an MSP, whether the organization uses a GRC platform or no platform at all, and the length of the observation period chosen. Each engagement is priced individually and confirmed in the engagement letter.

In summary:

- A HIPAA audit and assessment from Auditsuisse starts at $2,000 for organizations with 1–20 employees.
- It starts at $3,000 for 21–35 employees, $4,000 for 36–50, $5,000 for 51–100, and $10,000 for 101–250 employees.
- Organizations with more than 250 employees receive a custom fixed-fee proposal.
- The assessment can be completed entirely without a GRC platform — no tooling purchase is required.
- A point-in-time assessment is standard; an optional observed period of 3, 6, or 12 months can be added, and longer windows increase the fee.

## What determines the final fee

- **MSP-managed environments** — a managed service provider centralizes evidence for infrastructure, patching, and access controls, which streamlines fieldwork but adds a coordination layer confirmed at scoping.
- **GRC platform — or no platform at all** — platform agnostic: Vanta, Drata, Secureframe, Sprinto, or any other platform works. A platform mostly changes how quickly evidence is collected, not the standard assessed against. No platform is equally fine — the entire assessment can be completed 100% without a GRC platform, using spreadsheets and evidence exported directly from the organization's systems.
- **Observation period** — a point-in-time assessment is the standard engagement. An observed period of 3, 6, or 12 months (similar to the SOC 2 Type I vs Type II distinction) can be added; longer windows increase fieldwork and fee.

## What standard pricing includes

- The Security Risk Analysis required by 45 CFR § 164.308(a)(1)(ii)(A), performed in line with NIST SP 800-66 and OCR guidance, covering ePHI systems, threats, and vulnerabilities.
- Security Rule and Privacy Rule review: administrative, physical, and technical safeguards, plus patient rights, minimum-necessary use, and authorization practices.
- Gap analysis with a prioritized remediation roadmap (risk ratings and practical implementation guidance).
- A compliance attestation letter from a licensed CPA firm — the due-diligence documentation OCR and enterprise customers ask for.
- A senior-led engagement team (no rotating junior staff).
- Fixed-fee certainty — the fee is set in the engagement letter.

## What is priced separately

- Remediation implementation (the roadmap and guidance are included; hands-on implementation is scoped separately).
- Penetration testing (available separately: https://auditsuisse.com/penetration-testing).
- SOC 2 and other frameworks — combined HIPAA + SOC 2 engagements reuse overlapping controls and are quoted together at scoping (crosswalk: https://auditsuisse.com/multi-framework-control-mapping-soc2-hipaa-gdpr).
- Compliance platform subscriptions (billed by the platform vendor; a GRC platform is optional, not a requirement for the assessment).

## Engagement conditions

These are Auditsuisse's standard starting fees, not a self-serve checkout. As a licensed CPA firm, every engagement requires individual approval before an engagement letter is issued. Pricing is confirmed in the engagement letter following a scoping call and reflects the three published factors — MSP involvement, platform status, and observation period — plus the circumstances of the environment.

Factors that commonly move a fee above the starting schedule:

- Longer observation periods (6- and 12-month observed windows require more fieldwork than a point-in-time assessment)
- Complex ePHI flows (multiple products handling ePHI, many third-party integrations, extensive business-associate chains)
- Complex or hybrid infrastructure (multi-cloud, on-premise servers, clinical systems)
- Multiple legal entities, many physical sites, or more than 250 employees (custom fixed-fee proposal)

## How this compares to the market

Industry guides put typical third-party HIPAA assessments at roughly $8,000–$25,000 for small and mid-size organizations, with full-scope engagements commonly reaching $20,000–$50,000 and consultants billing $250–$350 an hour. Auditsuisse prices below these ranges because its senior-led, automation-native methodology removes the junior-staff hours that inflate traditional engagements — the assessment follows NIST SP 800-66 and OCR guidance and is performed by a licensed US CPA firm.

## FAQ

**How much does a HIPAA audit cost?**
At Auditsuisse, a HIPAA audit and assessment starts at $2,000 for organizations with 1–20 employees, $3,000 for 21–35, $4,000 for 36–50, $5,000 for 51–100, and $10,000 for 101–250 employees. Organizations above 250 employees receive a custom proposal. The final fee depends on MSP involvement, GRC platform status, and observation-period length.

**How much does a HIPAA risk assessment cost?**
The Security Risk Analysis required by the HIPAA Security Rule is included in Auditsuisse's standard assessment fees, which start at $2,000 for organizations with 1–20 employees and scale by headcount to $10,000 for 101–250 employees.

**How much does HIPAA certification cost?**
There is no official government-issued HIPAA certification — no federal agency certifies organizations as compliant. What organizations obtain is an independent assessment with documentation. At Auditsuisse, that assessment — including the Security Risk Analysis and a compliance attestation letter from a licensed CPA firm — starts at $2,000.

**Do I need a GRC platform like Vanta or Drata for the assessment?**
No. Auditsuisse is platform agnostic: Vanta, Drata, Secureframe, Sprinto, or any other GRC platform works — or none at all. The entire assessment can be completed 100% without a platform, using spreadsheets and evidence exported directly from the organization's systems.

**Does the observation period change the price?**
Yes. A point-in-time assessment carries the published starting fee. An observed period of 3, 6, or 12 months increases fieldwork, and longer windows cost more; the exact fee is confirmed at scoping.

## Related resources

- HIPAA assessment services: https://auditsuisse.com/hipaa
- HIPAA risk assessment guide (method and evidence for the required Security Risk Analysis): https://auditsuisse.com/hipaa-risk-assessment-guide-2026
- HIPAA technical safeguards checklist (45 CFR § 164.312): https://auditsuisse.com/hipaa-technical-safeguards-checklist
- SOC 2 + HIPAA + GDPR control crosswalk: https://auditsuisse.com/multi-framework-control-mapping-soc2-hipaa-gdpr
- SOC 2 audit pricing: https://auditsuisse.com/soc-2-pricing
- Full resource library: https://auditsuisse.com/resources
- llms.txt: https://auditsuisse.com/llms.txt

## Contact

Schedule a 30-minute scoping call to confirm your tier, observation period, and engagement terms: https://cal.com/sebastien-auditsuisse/30min