EHR HIPAA Cost in 2026

Three EHR vendors publish a real price. Epic, Oracle Health and MEDITECH are not among them, and federal law does not make them. This page gives you the prices that exist, the government data on who runs what, and the HIPAA work your EHR's BAA leaves on your desk regardless of which vendor you pick.

Federal law compels EHR cost disclosure. It produces no prices.

Certified health IT developers operate under a disclosure requirement most buyers have never read. 45 CFR 170.523(k)(1)(iii) requires, in plain language, “a detailed description of all known material information concerning additional types of costs or fees that a user may be required to pay to implement or use the Health IT Module's capabilities... whether fixed, recurring, transaction-based, or otherwise.”

The operative word is types. The rule compels the taxonomy of charges and never an amount, and the disclosures show it. Oracle Health's mandatory disclosure runs to dozens of pages without a single dollar figure. MEDITECH's page is titled Pricing Transparency and publishes no amounts. Greenway's discloses “Intergy: Ongoing monthly licensing cost per provider” as a category, with no number beside it. When the law compels disclosure and the answer is still a category rather than a price, that is the finding, and no estimate fills the gap honestly.

The EHR vendors that publish a price

All three are ambulatory and aimed at small to mid-size practices. Each figure below is attributed to the surface that published it, with the dimension it is actually priced on. Nothing here is summed: where a vendor publishes several dimensions, they stay separate, because the vendor publishes no combined total.

Vendor	Published figure	Exact dimension	Surface
eClinicalWorks	$449/mo	Per provider. “EHR Only” tier	Vendor pricing page, checked July 2026
	$599/mo	Per provider. “EHR with Practice Management” tier
	2.9%	Of practice collections. “RCM as a Service”, a separate line
AdvancedMD	$429 - $1,070/mo	Per provider. Medical package range	Vendor software pricing page, checked July 2026
	$130 - $399/mo	Per provider. Mental health
	$399/mo	Per provider. Physical medicine
	4% - 8%	Of collections. RCM, a separate line
Practice Fusion	from $199/mo	Per provider. A floor: “starting at just $199/month per provider with a required annual commitment”	Vendor pricing page, checked July 2026

Read the tiers precisely. eClinicalWorks' $599 is the EHR plus Practice Management bundle; entry to the EHR itself is $449, and quoting $599 as the vendor's price overstates the entry point by a third. Practice Fusion's $199 is explicitly a starting price and carries an annual commitment, so it is a floor rather than a rate. RCM percentages are a separate charge on a different basis from the per-provider fee, not an increment to it.

The vendors that publish nothing

Checked in July 2026 on each vendor's own site and on AWS Marketplace. No vendor in this list sells its EHR on AWS Marketplace; listings carrying these names are third-party integrators offering private quotes.

Vendor	What is published
Epic	No price. Its developer API pricing page requires sign-in.
Oracle Health (Cerner)	No price. Its federally mandated cost disclosure carries no dollar figures, noting only that licence rights are subscription-based and that recurring fees rise if data ingestion exceeds the contracted amount.
MEDITECH	No price. Publishes a page titled Pricing Transparency containing no amounts.
athenahealth	The billing model, not the rate. Its SEC filings describe billing monthly in arrears based either upon a percentage of collections, minimum fees, flat fees, or per-claim fees. The percentage is not published.
NextGen Healthcare	No price. Its pricing URL redirects to a contact form.
Veradigm (formerly Allscripts)	No EHR price. It publishes a fee for its developer API programme, which is not the EHR, and a price under its Practice Fusion brand.
Elation Health	No price. Its pricing page asks you to describe your practice and await personalised pricing.
DrChrono (EverHealth)	No tier price. All tiers show Request A Quote. It does publish some add-on rates, such as extended lab integration at $30 per provider per month.
Greenway Health	No price. Its mandatory disclosure names an ongoing monthly licensing cost per provider as a category with no amount.

Two figures on this list get misread as prices and are not. Epic's API licence agreement contains a $7,000 amount that is a cap on total liability, not a fee. Veradigm's $49 per month is its Connect developer programme for integrators, not the EHR.

Who runs what, from government data

Vendor share in this market is usually cited to analyst subscriptions. It does not need to be. ONC publishes adoption figures derived from CMS programme reporting, free, and updated in 2026 for the 2024 reporting year.

Hospitals

Of 4,058 non-federal acute care hospitals in the Medicare Promoting Interoperability Program, 2024. Number reporting at least one certified product from:

Epic Systems Corporation	1,951
Oracle Health	999
MEDITECH	716
TruBridge	362
Altera Digital Health	263

ONC Health IT Quick Stat #29, updated April 2026.

Clinicians

Of 268,652 eligible clinicians in the CMS Quality Payment Program, 2024. Percent reporting at least one certified product from:

Epic Systems Corporation	62.80%
Oracle Health	10.50%
athenahealth	7.80%
NextGen	4.20%
eClinicalWorks	4.00%

ONC Health IT Quick Stat #30, updated July 2026.

Read this as adoption reporting, not market share. ONC's own note states that “the percentages for all table and chart values will not add to 100%, as hospitals may report certified technology from more than one developer,” and 53% of hospitals reported a product from one of the 83 other developers not listed. The metric counts organisations reporting at least one certified product from a developer, which is a different question from who holds the primary EHR contract. The hospital counts above are given against their denominator so you can see exactly what the ratio is measuring.

Sources: Hospital Certified Health IT Developers and Health Care Professional Certified Health IT Developers. ONC also publishes a hospital-to-product linkage dataset naming the certified product reported by each individual hospital, which is the free way to check what a specific facility runs.

The HIPAA work the EHR does not cover

This is the part that survives every vendor decision, and it is set by regulation rather than by your contract. Whichever EHR you buy, the vendor BAA covers the vendor's infrastructure and leaves the following with you:

Workstation security: your endpoints, laptops, tablets and shared devices used to reach the EHR.
Network safeguards: your local network, firewall, guest-WiFi separation and segmentation.
End-user MFA: the EHR typically offers the capability; enabling and enforcing it for every user is yours.
Identity governance: provisioning, deprovisioning at termination, and periodic access review under 45 CFR 164.308(a)(4).
Audit-log review: the EHR captures the log; you must review it under 45 CFR 164.308(a)(1)(ii)(D).
BAA execution with non-EHR vendors: every other vendor that handles PHI needs its own agreement.
Workforce training: yours under 45 CFR 164.308(a)(5).
Risk analysis: the formal Security Rule risk analysis under 45 CFR 164.308(a)(1)(ii)(A). This is the single most common failure in OCR's published enforcement record.
Policy and procedure development: Privacy Rule and Security Rule policies tailored to your organisation.
Breach response: you notify patients and HHS under 45 CFR 164.404; the EHR vendor notifies you under 164.410.

This is why a per-provider EHR subscription does not retire your HIPAA budget. The EHR is the platform; the HIPAA programme is the wrapper around it, and the wrapper is where OCR looks. See the physician group page for the customer-side line items priced from published platform rates, and the risk assessment page for the obligation no EHR discharges for you.

EHR HIPAA cost FAQ

Does the EHR price include HIPAA compliance?

Partially, and the split is the useful part. The EHR vendor's business associate agreement covers the vendor's own obligations: the application infrastructure security, database encryption, application audit logging, vendor-side breach notification to you, and vendor-side workforce safeguards. The covered entity still owns workstation security, network safeguards, mobile-device management, enabling and enforcing MFA for users, audit-log review, BAA execution with every non-EHR vendor that touches PHI, workforce training, the risk analysis, policy and procedure development, and breach notification to patients and HHS. This site does not put a percentage on that split, because the division is set by your BAA and your deployment model rather than by any published ratio.

What does Epic, Oracle Health or MEDITECH cost?

None of the three publishes a price, on its own site or anywhere else public, and none is required to. This is worth stating plainly because it is the actual state of the market for the segment buyers most want priced. MEDITECH publishes a page titled Pricing Transparency that contains no amounts. Oracle Health's mandatory federal cost disclosure runs to dozens of pages and contains no dollar figures at all. Any per-bed, per-provider or all-in figure you see quoted for these three came from a paywalled analyst subscription or from someone's estimate, and this site prints neither.

Which EHR vendors do publish a price?

Three, all ambulatory and all aimed at small to mid-size practices. eClinicalWorks publishes $449 per provider per month for EHR Only and $599 per provider per month for EHR with Practice Management, plus RCM as a Service at 2.9% of practice collections, on its own pricing page, checked July 2026. AdvancedMD publishes $429 to $1,070 per provider per month for its medical package, $130 to $399 for mental health, $399 for physical medicine, and RCM at 4% to 8% of collections, on its own software pricing page. Practice Fusion publishes a floor: starting at $199 per month per provider with a required annual commitment. Everything else in the ambulatory market is quote-driven.

What does athenahealth cost?

athenahealth publishes the shape of its billing but not the rate. Its own SEC filings describe the model as billing clients monthly in arrears based either upon a percentage of collections posted to athenaNet, minimum fees, flat fees, or per-claim fees. That is a menu of four billing bases, not a single percentage-of-collections model, and athenahealth has never published the percentage in its public filings. Figures in the range of a few percent of collections circulate widely for athenahealth, but they are not published by athenahealth, so this site does not quote one.

Doesn't federal law require EHR vendors to disclose their costs?

It requires them to disclose the types of costs, not the amounts, and the distinction is the whole story. Under 45 CFR 170.523(k)(1)(iii), a certified health IT developer must give in plain language a detailed description of all known material information concerning additional types of costs or fees a user may be required to pay, whether fixed, recurring, transaction-based or otherwise. The operative word is types. The rule compels a taxonomy of charges and never an amount. You can see the result in the disclosures themselves: Oracle Health's runs to dozens of pages with no dollar figure, and Greenway's lists an ongoing monthly licensing cost per provider as a category with no number beside it. Federal law compels EHR cost disclosure and it produces no prices.

Which EHR vendors do hospitals and clinicians actually report using?

ONC publishes this from CMS programme data, and it is free. Among the 4,058 non-federal acute care hospitals participating in the Medicare Promoting Interoperability Program in 2024, 1,951 reported at least one certified product from Epic Systems Corporation, 999 from Oracle Health and 716 from MEDITECH. Among the 268,652 eligible clinicians in the CMS Quality Payment Program in 2024, ONC reports 62.80% for Epic, 10.50% for Oracle Health, 7.80% for athenahealth, 4.20% for NextGen and 4.00% for eClinicalWorks. Read these as adoption reporting rather than market share: ONC notes that the values will not add to 100% because an organisation may report certified technology from more than one developer.

Are there EHRs that handle more of the HIPAA work for you?

Deployment model matters more than vendor. A fully cloud-hosted EHR handles the infrastructure tier itself: physical security, database encryption, application audit logging and disaster recovery sit with the vendor under its BAA. A self-hosted or on-premise installation moves that work back to your IT department, along with the cost of doing it. Hosted variants of the enterprise EHRs sit in between, where the vendor runs the infrastructure but you retain more configuration responsibility. What no deployment model changes is the customer-side list: workstations, network, training, the risk analysis, your non-EHR BAA portfolio and breach notification to patients stay with you whoever hosts the database.

What about the EHR audit-log review burden?

Every major EHR captures detailed audit logs of user activity on patient records, and capturing them is not the obligation. Under 45 CFR 164.308(a)(1)(ii)(D) the covered entity must conduct information system activity review including audit logs, access reports and security incident tracking reports. The EHR produces the log; you must actually look at it. This is one of the most consistent findings in OCR's published resolution agreements, and it costs workforce time rather than licence fees. The 2026 Security Rule proposals would make the review cadence more explicit.

Related cost guides

Hospital HIPAA Cost

OCR's enforcement record at hospital scale

Physician Group HIPAA Cost

Published platform rates for an ambulatory group

Business Associate Guide

BAA execution and scope

AWS HIPAA Cost

Underlying infrastructure for hosted EHRs

Azure HIPAA Cost

Microsoft cloud infrastructure for hosted EHRs

2026 Security Rule Changes

MFA and audit-log cadence impact on EHRs