HIPAA Compliance Cost for Telehealth and Digital Health in 2026
Telehealth budgets get built around the video licence, which is the one part of the problem that is nearly free. The cost sits in the layers around it: the devices your clinicians work from, the cloud your sessions run through, and a risk analysis whose scope is wider than any single-site practice ever has to think about.
Published rates below are read off each vendor's own pricing page and checked July 2026. Where nobody publishes, this page says so.
The video licence is the cheapest decision you will make
Both Doxy.me and VSee publish a $0 tier carrying a BAA, and VSee's paid tiers are $29 and $49 per month per provider on its own pricing page. So the BAA-eligible video layer can genuinely cost nothing, and it will never be the line that decides your budget. What costs is everything the video sits inside: device management across a distributed clinical fleet, cloud audit logging that scales with data rather than headcount, and an assessment that has to cover the platform, the apps, the portal, the infrastructure and every integration point. Budget the surroundings, not the licence.
Device management, as published
If clinicians reach ePHI from phones, tablets or laptops you do not physically control, device management stops being optional: it is how you enforce encryption, enable remote wipe, control which apps see PHI, and produce the audit trail. Every vendor here publishes a rate, and every one publishes it on a different meter. That is the part to get right before comparing anything, because per user and per device are not convertible without knowing your fleet.
| Product | Published rate | Vendor's own unit | Notes |
|---|---|---|---|
| Microsoft Intune Plan 1 | $8.00 | per user/month, standalone | Microsoft states it is included in Microsoft 365 E3, E5 and EMS E3/E5, so frequently a $0 line already |
| Microsoft Intune Plan 2 | $4.00 | user/month, paid yearly | An add-on requiring Plan 1 underneath it |
| Microsoft Intune Suite | $10.00 | per user/month | Priced in the pricing page FAQ prose rather than on a card |
| Jamf for Mac | $12.50 | per macOS device, per month, billed annually | 25-device minimum. Jamf Pro is a component of the bundle, not a separately priced SKU |
| Jamf for Mobile | $5.75 | per mobile device, per month, billed annually | Same terms as Jamf for Mac |
| Omnissa Mobile Essentials | $3.00 / $5.40 | per device / per user, monthly | 12 months prepaid with production-level support. The only vendor publishing both units side by side |
| Omnissa UEM Essentials | $5.25 / $9.45 | per device / per user, monthly | Same terms |
Microsoft documents a device-only Intune subscription for kiosk and shared devices but publishes no price for it. Jamf's AWS Marketplace listings all show an identical $50,000.00 per 12 months private-offer placeholder, which is not a per-device list price and is not quoted here. More units and bands on the tools comparison, and a field-fleet worked example on the home health page.
What the published rates work out to
Our arithmetic, not a vendor price
Our arithmetic, not a vendor price. Every input is a published figure from the table above. The multiplication is ours: no vendor publishes an annual total for a fleet of this shape, and the device-to-clinician ratio is an assumption stated on screen rather than a fact about your organisation.
A 40-clinician telehealth operation, two devices each
Assume 40 clinicians carrying a laptop and a phone each, so 40 users and 80 devices. On Omnissa UEM Essentials the published per-user rate of $9.45 gives 40 × $9.45 = $378 per month, while the published per-device rate of $5.25 gives 80 × $5.25 = $420 per month. Same vendor, same product, same organisation, and the per-user meter is cheaper here by $42 a month. Flip the assumption to one device per clinician and the per-device meter wins at $210 against $378. That is the entire lesson: the unit decides the bill, the device-to-user ratio decides the unit, and a comparison that normalises these into one number is describing something the vendors do not sell.
On Intune the same 40 users are 40 × $8.00 = $320 per month at the published Plan 1 standalone rate, but Microsoft states Plan 1 is included in Microsoft 365 E3 and E5, so an organisation already on those is looking at $0 rather than $320. Whether that applies to you is a fact about your existing licensing rather than about Intune, which is why this site does not put Intune in a comparison table with a single number.
Cloud: no HIPAA surcharge, from anyone
None of AWS, Microsoft or Google publishes a HIPAA surcharge on any service, and none charges a fee for its BAA. Google is the only one making an explicit pricing statement, saying it can offer HIPAA regulated customers the same products at the same pricing that is available to all customers. Microsoft makes an availability statement rather than a pricing one: the BAA is available through the Data Protection Addendum by default to all customers who are covered entities or business associates, with no fee attached and nothing to sign. AWS makes no statement about BAA cost at all; it is accepted self-service in AWS Artifact.
So the cost of HIPAA on a cloud is the security services you choose to run, at ordinary published rates, plus engineering time no vendor prices. For a telehealth platform the services that matter are audit logging, key management and threat detection, and they scale with data volume rather than with your headcount, which is why a telehealth cloud bill behaves nothing like a per-seat licence.
Per-service rates with worked examples: AWS, Azure and GCP. One thing worth flagging early for a small telehealth estate: Google's Security Command Center Premium is priced at 5 percent of projected annualized run rate with a $15,000 annual minimum, and that minimum dominates a small deployment regardless of how little you actually run.
The wider scope is the real telehealth difference
A single-site practice assesses a network, some workstations and an EHR. A telehealth operation's risk analysis has to reach every one of these, and each is somewhere PHI actually lives:
- The video platform and its BAA. Including what the vendor does and does not take responsibility for under it.
- Mobile and BYOD endpoints. Every device that can open a session, including the ones you do not own.
- Session recordings, if you make them. A recording is ePHI and inherits the whole Security Rule, plus the six-year documentation retention at 164.316(b)(2)(i). The cheapest recording policy is usually not to record.
- The patient portal and its authentication. Patient identity verification for a virtual visit is a control you own, not one the video vendor performs.
- Cloud infrastructure and its logging. Including whether anyone reads the logs, which is the obligation rather than capturing them.
- Every EHR integration point. Each interface is a PHI path and frequently a BAA.
- Multi-state operation. Licensure and data residency are not HIPAA questions, but they land in the same assessment and the same counsel bill.
This site publishes no figure for that assessment, because no firm performing risk analyses publishes a rate card. What is worth knowing is that scope, not headcount, is what an assessor prices against, and a telehealth operation of 40 people can carry a wider scope than a clinic of 200.
The enforcement discretion is over
The HHS OCR Notification of Enforcement Discretion for Telehealth, which from March 2020 declined to penalise covered entities using non-public-facing consumer tools for telehealth, was wound down effective 11 August 2023. Practices still running clinical video on platforms with no BAA are outside 45 CFR 164.312(e)(1) with no discretion to fall back on. The fix is cheap, because BAA-eligible platforms publish free tiers. See HIPAA video cost for which vendors publish a price and which publish nothing at all.
If you are a digital health startup
You are almost certainly a business associate rather than a covered entity, which changes which obligations apply to you at all, and you have been directly liable to OCR since HITECH rather than only to your customers under contract. The GRC platforms that serve this market publish real rates, but on axes that do not line up with each other, so comparing them requires reading the units rather than the numbers. Rather than restate it differently here, see the digital health startup page for the published platform rates, Aptible's actual pricing page, Okta's contract minimum and the lines that are quoted, and the business associate guide for what applies to you and what does not.