Most practice managers know a HIPAA breach is expensive. They have seen the headlines. They have heard the horror stories from colleagues. What very few have done is sit down with a spreadsheet and run the numbers for a practice their size.
This post does that. We are walking through the full cost of a hypothetical HIPAA breach at a 5-provider primary care practice, line by line: OCR civil monetary penalties, breach notification, patient churn, and operational recovery. Then we will show what a prevention program would have cost instead.
The conclusion is not subtle.
Meet Clearview Family Medicine
Clearview Family Medicine is a fictional 5-provider primary care practice with 3,000 active patients and a staff of 12.
The practice had no formal HIPAA risk analysis on file, staff had not completed annual security training, and remote access for two providers used a consumer-grade VPN without multi-factor authentication.
In October, a phishing email made it through. A staff member clicked. Ransomware encrypted the EHR and the shared drive. By the time the practice manager understood what had happened, 3,000 patient records, including names, dates of birth, diagnoses, and billing codes, had been exfiltrated.
The clock started. Here is what it cost.
Line Item 1: OCR Civil Monetary Penalties
The HHS Office for Civil Rights enforces HIPAA through a four-tier civil monetary penalty structure. The applicable tier depends on the covered entity's level of culpability.
For Clearview, the facts matter. No risk analysis. No security training. No documented access controls. OCR is likely to treat this as a Tier 2 violation. The practice should have known about the risks and had a reasonable obligation to address them.
Recent enforcement actions against small providers confirm that the realistic range for a practice this size is $25,000 to $103,000, depending on the breadth of documented noncompliance and the practice's cooperation during the investigation. OCR has the discretion to settle for less when a covered entity cooperates fully and demonstrates corrective action.
OCR Civil Monetary Penalty Estimate: $65,000
Line Item 2: Breach Notification Costs
Under the HIPAA Breach Notification Rule, covered entities must notify every affected individual, HHS, and any prominent local media outlets when a breach affects 500 or more individuals in a single state or jurisdiction, all within 60 days of discovery. For a detailed breakdown of the notification timelines and the multi-clock complexity, see our post on breach notification deadlines.
For Clearview, with 3,000 affected patients, the notification obligations include:
First-class mailing to 3,000 individuals, including printing, postage, and staff labor: approximately $9,000
Two years of credit monitoring and identity restoration services, now standard practice and often required in state attorney general settlements, at $15 per individual per year: $90,000
Legal counsel to draft the patient notification letter, review the required media notice, and advise on state-level notification obligations that may run alongside HHS requirements: $20,000 to $30,000
Outside counsel to respond to the OCR investigation, produce documentation, and manage the corrective action plan negotiation: $10,000 to $20,000
Breach Notification Subtotal: $130,000
Line Item 3: Patient Churn and Lost Revenue
This is the cost that never appears in any invoice, which is exactly why practice managers tend to undercount it.
A breach at a small practice is a community event. Local media coverage is required for breaches affecting 500 or more patients in a jurisdiction. Patients talk. The practice's name appears in a public OCR filing on the HHS Wall of Shame. Some patients leave immediately. Others wait until their next appointment, see a different provider, and never come back.
Research consistently shows that a significant share of patients consider switching providers following a healthcare data breach. Black Book Research found that 68% of patients surveyed said a data breach would cause them to seek care elsewhere. A more conservative working assumption, based on typical patient panel turnover in breach scenarios, is 20% patient attrition.
For Clearview:
3,000 patients x 20% = 600 patients who do not return
Average revenue per active primary care patient: $350 per year (visits, wellness appointments, chronic care management)
Year 1 lost revenue: 600 x $350 = $210,000
Healthcare reputation damage from a publicized security incident takes years to recover from. A 3-year horizon for patient attrition loss, assuming gradual recovery, puts the total between $420,000 and $630,000. For this analysis, we use only the year-one figure.
Patient Churn in 1 Year: $210,000
Line Item 4: Downtime and Operational Recovery
Ransomware attacks on small healthcare organizations result in an average of two to three weeks of significant clinical disruption. For Clearview, the recovery math looks like this:
Provider productivity loss during recovery: 5 providers generating approximately $150,000 each in annual billings, operating at reduced capacity for three weeks, represent roughly $52,000 in foregone revenue
IT forensics and system restoration: rebuilding a compromised EHR environment, recovering encrypted data where possible, and validating integrity before returning to clinical use typically costs $30,000 to $60,000 for a practice this size
Staff overtime for manual operations during downtime, including paper-based recordkeeping, patient rescheduling, and coordination with the IT incident response team: approximately $15,000
Incident response consultant fees, if no retainer was already in place: $15,000 to $25,000
Downtime and Operational Recovery: $120,000
The Running Total
Here is the full picture for Clearview, using conservative estimates at each line item:
This scenario does not include a ransom payment if one is made, state attorney general fines, civil litigation from affected patients, or the multi-year cost of operating under an OCR corrective action plan with mandatory monitoring. It also uses only year-one patient churn. The true 3-year cost of a breach at a practice this size could easily exceed $800,000.
What Prevention Would Have Cost
A HIPAA-compliant managed IT and cybersecurity program for a 5-provider practice covers the controls that directly reduce Clearview's exposure:
Managed detection and response and endpoint security that would have flagged the phishing email before it executed
HIPAA-compliant email filtering and remote access controls, eliminating the unsecured VPN entry point
A documented annual risk analysis, which is the single most commonly identified missing item in OCR breach investigations
Staff security awareness training, which addresses the root cause of most healthcare data breaches
An incident response plan that dramatically reduces recovery time and OCR penalty exposure when a breach does occur
The annual cost for a program like this, sized appropriately for a small practice, ranges from $2,000 to $3,500 per month. At $36,000 per year, Clearview would have needed to maintain that program for 14 years before reaching the estimated cost of a single breach. That is not a close decision.
The Real Risk Is Not Knowing Where You Stand
Clearview is fictional. The scenario is not.
The conditions that created the breach at Clearview, specifically no risk analysis, no security training, and no documented access controls, describe the current operating state of a significant share of small and mid-sized practices across the country. Hacking incidents now account for more than 80% of large healthcare data breaches reported to OCR, up from 49% in 2019. And 772 large healthcare data breaches were reported in 2025 alone, a new annual record.
The HIPAA Security Rule has required a documented risk analysis since 2005. OCR's own data confirms it is the single most commonly identified violation when a breach triggers an investigation. Every year a practice operates without one, it is not saving money. It is the accumulating exposure that the above numbers make concrete.
If you do not know what a risk analysis would find at your practice, that uncertainty is itself the answer to whether you need one. For more on what OCR expects your technical safeguards to cover, see our breakdown of the 18 HIPAA Security Rule technical safeguards. For more on the 2026 enforcement environment, see our post on why 2026 is the year healthcare organizations need real HIPAA accountability.
Schedule a HIPAA Risk Assessment with Techvera
A HIPAA risk assessment with Techvera takes the guesswork out of where your practice stands. We document your current technical safeguards against the full HIPAA Security Rule standard, identify the gaps that OCR looks for in an investigation, and build a remediation roadmap designed to close them before they become a $525,000 problem.
Techvera serves urgent care, dental, integrated health, and med spa practices across Dallas-Fort Worth and New York City. Learn more about our healthcare IT services and our Compliance Readiness program.
If you’re ready to schedule your HIPAA risk assessment, contact our team.
About the Author
Team Techvera
Techvera Team
Articles written collaboratively by the Techvera team, combining expertise across cybersecurity, managed services, and digital transformation.