What should an MSP charge for HIPAA compliance?

Setting the price: the three inputs that actually decide it

Most MSPs price a compliance line by looking at what the platform costs and adding a multiple. That gets the number wrong in both directions, because the licence is the smallest of the three inputs.

• Your steady-state minutes per client, per month

  The one input worth measuring rather than guessing. At an hour a month a $129 flat fee is comfortable; at four hours it is a loss you will not notice until the third renewal. Time your first two clients before you publish a rate card.

• What the first month costs you, separately

  Setup, the assessment walkthrough and policy rollout are front-loaded and do not recur. Folding them into the monthly fee makes year one look thin and year three look generous. Most MSPs who price this well charge a one-off onboarding fee and a lower recurring one.

• What remediation is worth, billed apart

  The assessment surfaces work — encryption gaps, backup changes, access reviews. That is project work at your normal rate, and it is where the revenue actually is. A flat fee that silently absorbs it converts your best-paying work into unpaid overhead.

Questions MSPs ask

How much should an MSP charge for HIPAA compliance management?

Commonly $99–199 per client organization per month for the managed programme — running the assessment, tracking remediation, keeping policies and training current, and producing the evidence pack — with remediation projects billed hourly on top. The flat fee covers the recurring work; the hourly work covers whatever the assessment surfaces. Where you land in that band depends far more on your steady-state minutes per client than on what the platform costs you.

Should HIPAA compliance be priced per client or per seat?

Per client organization, in almost every case. The recurring work scales with the number of programmes you are keeping current — one risk assessment, one policy set, one vendor register, one evidence pack per client — not with headcount. Per-seat pricing tracks the wrong variable: a ten-person practice and a thirty-person practice take about the same monthly effort, and per-seat billing makes the larger one look expensive while underpricing the smaller. Charge per client and treat headcount as a factor in the initial setup fee instead.

How much time does a client's compliance programme actually take?

Front-loaded. Expect several hours in the first month for setup, the assessment walkthrough and policy rollout, then roughly an hour or two a month in steady state: chasing acknowledgements and training, reviewing new vendors, updating the register, and refreshing the evidence pack when a client is asked for it. Timing your first two clients honestly is the most reliable pricing input you can get.