What HIPAA-Compliant IT Costs a Behavioral Health Practice

HIPAA-compliant IT for a behavioral health practice starts around $22 per user per month in licensing and $995 a month for managed IT, and the biggest variable is what you already have in place.

The first number is Microsoft’s list price. The second is our floor. Everything between them is where the quotes start disagreeing, usually because one vendor is pricing software, another is pricing people, and the owner is comparing the two as if they were the same product.

VJNetworks has managed systems that touch protected health information since 2008, signs a Business Associate Agreement with every healthcare client, and runs the healthcare IT program these numbers come from. This guide is for the group practice, the outpatient program, and the solo clinician who just hired a second and a third. Therapists, psychologists, psychiatric nurse practitioners, social workers, and the front desk that holds it together, somewhere between 5 and 60 people, in Rockland, Westchester, or Bergen. Nothing below is a hypothetical rate card. It is what the pieces cost today, from the vendors’ own pricing pages, and what changes when the records are psychotherapy notes and substance use histories instead of dermatology charts.

You have plenty of company. The 2025 federal employment count lists 96 offices of mental health practitioners in Rockland, 245 in Westchester, and 144 in Bergen, and the New Jersey total grew almost 23% in a single year. Most are small. Most sit on the same handful of EHR platforms. And most are being asked the same question right now by an insurer, a hospital referral partner, or a new hire who came over from a health system. What are you doing about security?

Three Layers, Priced Separately

HIPAA-compliant IT is three purchases that get quoted as one. Licensing is the software you rent from Microsoft or Google, your EHR vendor, and your telehealth platform. Controls are the safeguards the Security Rule expects, things like multi-factor authentication, encryption, endpoint protection, and tested backups. People are whoever configures, documents, and maintains all of it, and picks up when it breaks.

Most of the confusion I see comes from a quote that covers one layer being weighed against a quote that covers all three. A compliance-software subscription and a managed IT agreement are not competing products. One is a checklist. The other is the person who does the checklist.

Layer One. The Licensing You Can Price Today

Start with Microsoft, because most practices already sit there. Business Standard is $14 per user per month on an annual term. Business Premium is $22. The $8 between them is the compliance gap. Premium is where Intune, Defender for Business, Purview information protection, and the Entra ID features live, according to Microsoft’s own plan comparison, and every one of those is a safeguard the Security Rule expects you to have in some form. Standard gives you Outlook, Teams, and the Office apps and stops there. Microsoft also covers Exchange, Teams, OneDrive, SharePoint, Entra ID, and Intune under its HIPAA Business Associate Agreement, which sits inside the standard data protection terms for any covered entity. You do not negotiate it. You do have to know it exists, and then set up the tenant so the agreement means something.

Google Workspace Business Plus is also $22 per user at the regular price, and Google is blunt that a practice must accept its Business Associate Amendment before any patient information goes into Gmail, Drive, or Meet. Same price. Different toolbox. Our Microsoft 365 versus Google Workspace comparison covers which fits which kind of office.

Then the EHR, which in behavioral health is usually a per-clinician subscription rather than the six-figure implementation a hospital pictures. SimplePractice lists its Group Plus plan at $99 for the first practitioner and $74 for each additional one, telehealth included. TherapyNotes moved to $79 for the first clinician and $50 for each additional for billing cycles after December 1, 2025. ICANotes runs $75 a month for a full-time non-prescribing clinician and $213 for a prescriber. Ensora Health, the platform that used to be TheraNest, publishes tiers from $29 to $89 per therapist, plus $45 a month per therapist for e-prescribing with PMP checks. Every one of them signs a BAA, most of them automatically in the terms of service you clicked through on day one. The larger platforms built for outpatient programs, Valant, Kipu, Qualifacts, and Netsmart, all take a BAA too, and none of them publish a price. You get a quote. The two platforms my team has direct experience supporting in this space are AccuCare and PointClickCare, and the brand matters less than whether the person securing it understands how a clinician actually moves through it mid-session.

Telehealth is the line that surprises people, because the free video app that got everybody through 2020 is not a free pass anymore. HHS’s enforcement discretion for consumer video tools expired on August 9, 2023, and the standing rule is that any telehealth vendor that is more than a mere conduit needs a BAA. Zoom offers one on its paid plans, at $14.16 per user per month on an annual term. Doxy.me includes a BAA and still offers a free tier for providers just getting started. SimplePractice and TherapyNotes fold basic telehealth into the EHR subscription, which for a lot of small groups makes the separate video line disappear.

Two more lines, both small. BitWarden is our recommended system for shared credentials, and its Teams plan is $4 per user per month. Encrypted email for what cannot go through a portal, a referral to a psychiatrist, a records request from a school, runs from a flat monthly rate for tiny teams. Virtru’s starter plan is $119 a month for five users, BAA included.

So, a twelve-person group. Eight clinicians, two intake and billing staff, an office manager, and the owner. On Business Premium that is $264 a month. BitWarden for twelve is $48. An EHR on SimplePractice’s group plan for eight clinicians is $99 plus seven times $74, or $617, with telehealth included. Call it $929 a month in licensing before anyone has configured anything, before a single control is enforced, and before anyone is on the hook to answer the phone.

Layer Two. The Controls the Rule Expects

Here is the part practices tend to get backwards. The controls are mostly not a separate purchase. Multi-factor authentication, disk encryption, endpoint detection, device management, and information protection are all inside Business Premium. What costs money is enforcing them, documenting that you did, and keeping them enforced after the new hire who just needs it off for a week.

The Security Rule today has two kinds of specifications. Required ones, like the risk analysis, the data backup plan, and written business associate contracts. And addressable ones, like encryption at rest and in transit, which HHS says plainly does not mean optional. Addressable means you assess it, implement it or document a reasonable alternative, and can show your work. Most small practices skip the assessment and the documentation both, and that is the gap OCR keeps finding.

That two-tier structure is on its way out. HHS proposed a rewrite of the Security Rule in January 2025. Nearly every specification would become required. MFA, mandatory. Encryption, mandatory. Add a written asset inventory and a network map, a procedure to get systems back inside 72 hours, vulnerability scans twice a year, a penetration test once a year, and a compliance audit every twelve months. It is not final. The comment period closed in March 2025, and the federal regulatory agenda now lists final action for July 2027, so the current rule is the one you are held to today. I would not build to the current rule anyway. Your cyber insurer already wants the proposed version. Marsh’s US market update lists the dozen controls carriers treat as essential, with MFA, endpoint detection and response, and encrypted, tested backups at the top, and US cyber insurance rates fell another 2% in the second quarter of 2026. The controls are the price of admission to a policy at all, and the softer market only helps the practices that can answer the questionnaire. Our cyber insurance readiness audit exists for exactly that questionnaire.

If you are not on Premium, standalone endpoint detection runs from $3 per user for Defender for Business to roughly $8 per endpoint at Huntress’s published example pricing. Cheap either way. The expensive version is the one where nobody reads what the tool reports, which is a people problem and belongs in layer three. Backup is the same story. The software is inexpensive. A backup and disaster recovery plan that has been restored from, on purpose, with a stopwatch running, is what the proposed 72-hour rule is really asking for.

What Behavioral Health Adds to the Bill

Psychotherapy notes get a protection nothing else in HIPAA gets. Under 45 CFR 164.508, with very few exceptions, a practice needs the patient’s specific authorization before disclosing them for any reason, including treatment. The catch is in the definition. Notes only qualify if they are kept separate from the rest of the record. Blend them into the progress note and the special protection evaporates. In IT terms, the EHR has to be configured with a distinct notes area and tighter access than the chart itself, and staff have to use it that way. Configuration time, training time, and an access review that treats clinicians and the front desk differently.

If any part of the practice is a substance use disorder program, 42 CFR Part 2 has been fully enforceable since February 16, 2026. The 2024 final rule pulled Part 2 closer to HIPAA. A single consent can now cover treatment, payment, and operations, the HIPAA breach notification rule applies to Part 2 records, and the rule now says plainly that segregating those records is not required. What did not go away is the separate consent for SUD counseling notes, the patient notice, and the tracking that proves which consent covered which disclosure. OCR opened a complaint and breach-reporting channel for Part 2 the same week. Budget this as EHR configuration, staff training, and a consent workflow. Not new hardware.

Most of your clinicians are not in the building all week. The American Psychological Association’s 2025 practitioner survey found 65% of psychologists practicing hybrid and 21% fully by telehealth. That is a device problem before it is a compliance problem. A laptop that leaves the office needs enforced encryption, a managed login, endpoint protection, and a way back into the practice network, which for us is a VPN. Personal devices are where the plan usually breaks. There is no clean statistic on how common they are in small practices, which tells you something on its own.

The website is part of the surface now. In 2023 the FTC finalized a $7.8 million order against BetterHelp for sharing email addresses, IP addresses, and health questionnaire answers with Facebook, Snapchat, Criteo, and Pinterest through advertising trackers. In 2024 it followed with Cerebral, where tracking tools handed third parties names and prescription histories for nearly 3.2 million people. HHS and the FTC sent a joint warning to about 130 hospitals and telehealth providers that same summer. A book-a-session form with a Meta pixel on the page is the exact pattern they went after. Ask whoever runs your website to list every tracker on every page. Short conversation. Cheap fix.

Prescribers carry one more line. New York requires electronic prescribing through a registered, certified application, plus a PMP check before writing for Schedule II through IV controlled substances. New Jersey runs its own PMP checks. The DEA, meanwhile, extended its telemedicine prescribing flexibilities a fourth time, through December 31, 2026, while it finishes the special registration rule. That is why the EHR vendors price e-prescribing as an add-on. Certified module, its own identity requirements, not a checkbox.

New York layers its own rule on top. The SHIELD Act requires any business holding a New York resident’s private information to keep reasonable administrative, technical, and physical safeguards, and it scales the standard for businesses under 50 employees rather than exempting them. OMH and OASAS clinic regulations point back at the Mental Hygiene Law, HIPAA, and Part 2 for confidentiality instead of adding a separate technical standard, so there is no hidden fourth rulebook. Just more people reading the same three.

Layer Three. The People, and What Managed IT Costs

Managed IT from VJNetworks starts at $995 a month. That covers unlimited support. Endpoint security, with the monitoring and advisement that goes with it. Management and security of your Microsoft 365 or Google Workspace tenant. Network security and maintenance. Help meeting your compliance goals, a hand in onboarding and offboarding, and vCIO strategy and roadmapping. Hardware, materials, and toner are not in it. Someone from my team responds within 15 minutes during business hours. Our general guide to what managed IT costs a small business walks through the base model, and everything below is what changes when the client is a regulated practice.

A regulated practice prices above an unregulated office of the same size, because the documentation, the access reviews, and the enforcement work are real hours every month. In the regulated work we have quoted, the per-seat number has landed a little over $200, and I have not seen it need to go past $300 a seat. Anyone who hands you a per-seat figure before asking what you already have is guessing.

What you already have is the whole game. Mike Stoveken, our vice president, puts it plainly. A one-person practice with nothing in place will usually cost less to bring up to standard than a twenty-person office that already has most of it. The twenty-person office has more seats, more devices, more history to untangle, and more people who have to change a habit. The one-person practice gets built right the first time and never has to unlearn anything.

The other thing that moves the per-seat price more than your specialty does is how the desktop is delivered. Workstations in the office with the data in Microsoft 365 come in at one price. An Azure environment with a terminal server, where the desktop lives centrally and a clinician’s laptop is just a window into it, costs meaningfully more per seat and builds disaster recovery into the design instead of bolting it on. We run that for regulated and unregulated clients alike. It is an architecture choice. If a provider frames it as a HIPAA charge, ask why. Our Microsoft 365 and Azure page covers what belongs in each model.

One more thing, because it saves money. HIPAA, Part 2, the SHIELD Act, and your insurer’s questionnaire are asking for the same controls under different names. Mike’s line for it is that the frameworks are plug-and-play components, the same practices and technologies, and each industry just picks the ones it needs. Build the controls once and the paperwork for every framework mostly falls out of the same evidence. And nobody certifies you. HHS does not certify practices or vendors. Any provider selling a HIPAA certification is selling a word. What we do is implement the safeguards, document them, sign the BAA, and keep the documentation current. The documentation is the product. We wrote separately about what HIPAA actually requires from your IT provider, and the business associate test in that post applies to every vendor on the licensing list above.

The One-Time Costs Nobody Puts in the Monthly

• Remediation. The risk analysis finds things. Old accounts that still work, a laptop nobody encrypted, a backup nobody has restored from. Closing those is a scoped project, priced once, and it belongs on its own line so the monthly number stays honest.
• Hardware that cannot run a supported operating system. Windows 10 reached end of support on October 14, 2025. A machine that cannot take Windows 11 is a machine you cannot patch, and an unpatched machine with patient records on it is a finding waiting to be written up.
• Drives. When a laptop leaves, the drive gets wiped or destroyed and somebody files the certificate. Cheap. Skipped constantly.
• The risk analysis itself, if you do it yourselves. HHS publishes a free Security Risk Assessment Tool aimed at small and medium practices. Its 405(d) program also publishes a cybersecurity practices volume for small healthcare organizations with no IT staff, and that volume names 42 CFR Part 2 among the obligations a small behavioral health provider carries. Both are good. Neither fixes what it finds or updates itself next year. Our risk assessment is free as well, and it comes before any quote.

What Skipping It Costs

The penalties were adjusted for inflation in January 2026. A violation the practice did not know about starts at $145 and runs to $73,011 per violation. Willful neglect left uncorrected starts at $73,011, and every tier caps at $2,190,294 per calendar year for the same provision.

The enforcement pattern matters more than the ceiling. OCR has been running what it calls a Risk Analysis Initiative, and the settlements read like a directory of small providers. Top of the World Ranch, a substance use treatment center in Illinois, paid $103,000 in February 2026 after a phishing attack on one email account exposed 1,980 patients, and OCR found it had never done an accurate and thorough risk analysis. Deer Oaks, a behavioral health provider serving long-term care residents, paid $225,000 in July 2025 on the same finding. Comprehensive Neurology, described by OCR as a small New York practice, paid $25,000 after a ransomware attack that reached 6,800 people. Different sizes, different specialties, the same sentence in every press release.

The breaches behind those settlements are not exotic. OCR’s most recent report to Congress counted 663 large breaches in 2024, 81% of them hacking or IT incidents. Verizon’s 2026 breach report puts ransomware at 48% of all breaches and says small organizations are hit disproportionately, with fewer resources to absorb it. Richmond Behavioral Health Authority in Virginia disclosed a ransomware attack in December 2025 that reached up to 113,232 people. And on the insurance side, Coalition’s 2026 claims report says initial ransom demands now average more than $1 million, 86% of its policyholders refused to pay, and 64% of closed claims ended with no out-of-pocket loss. Look at that last number. Refusing to pay is only an option for the practice that can restore.

Where to Spend First If the Budget Is Tight

In order. Each one makes the next one cheaper.

1. Turn on multi-factor authentication for every account, the owner included. It is in the license you already pay for.
2. Move from Business Standard to Business Premium. Eight dollars a seat buys the encryption, device management, and endpoint protection the rest of this list depends on.
3. Do the risk analysis and write it down. Free tool, or ours.
4. Back up the EHR exports, the file share, and the mailboxes. Then restore something on purpose and time it.
5. List every vendor that touches patient information and find the BAA for each one. EHR, telehealth, billing, transcription, the answering service, and your IT company.
6. Pull the advertising trackers off the website.
7. Put the shared passwords in BitWarden and take them off the sticky note.

Seven items. Two of them cost nothing. None of them wait for a final rule. If you want the same list checked against your actual tenant, our healthcare cybersecurity program starts there.

What Practice Owners Ask When They See the Number