Free calculator · 2 minutes

What would a patient data breach cost your practice?

A hacked email account or a stolen laptop can expose thousands of patient records. Estimate the cost of letters, credit monitoring, investigators, attorneys, lost patients and fines, and see how much encryption saves. Nothing you type leaves your browser.

1 The breach

Patient records exposedDays your systems are down

The lost laptop, phone or data was encrypted

2 Telling patients

Letter, printing and postage, per patient$Call center to answer patient questions$Patients who sign up for credit monitoring%Credit monitoring, per patient who signs up$

3 Cleanup and help

Investigators to find out what happened$Breach attorney$Emergency IT work to clean up and restore$Revenue per day the practice is down$

4 Patients who leave, and fines

Affected patients who go elsewhere%What a patient brings in each year$

Federal HIPAA fines run from $145 to $73,011 per violation, up to $2,190,294 a year for each type. Many breaches end without a fine; settlements with small practices are often in the tens of thousands, and higher when basics like a risk analysis were missing.

No fine Small settlement Larger settlement

Fine or settlement to include$

Good to know

Questions people ask

What counts as a HIPAA breach?

Patient information seen, taken or lost by someone who shouldn't have it: a hacked email account, ransomware, a stolen laptop, a misdirected fax or email. It's presumed to be a breach unless a documented risk assessment shows a low chance the information was compromised.

Does encryption really make that much difference?

Yes. If a lost or stolen device was properly encrypted, the information is considered secured, and losing it usually isn't a breach you have to report. That's why encrypting every laptop and phone is one of the cheapest protections a practice can buy.

How big can HIPAA fines get?

As of 2026, federal penalties range from $145 to $73,011 per violation, up to $2,190,294 a year for each type of violation. Fines are highest when a practice ignored the basics, such as never doing a risk analysis.

Do Florida rules apply too?

Often, yes. Florida law can require notifying affected Floridians within 30 days and reporting to the Florida Attorney General when 500 or more Floridians are affected. Your attorney can tell you exactly which rules apply.

Is this legal advice?

No. It's an estimate to help you plan. If you think you've had a breach, call a breach attorney and your IT team right away.

Find your gaps before a breach does.

Our free Security Risk Check is a 20-minute call. We'll tell you plainly where patient data is exposed and what it would take to fix.

Get a free Security Risk Check

More free tools: see them all