Enter Your Numbers
Each box starts with an example so you can see how it works. Replace the examples with your own numbers.
The number of patient records (ePHI) a single breach could reach.
Example: 10,000 records
Letters, call center, credit monitoring and other per-patient costs. Your best estimate or your insurer’s.
Example: $150
Forensics, outside IT help and breach coaching for one incident, whatever the record count.
Example: $100,000
Counsel, regulatory response and any settlement. Your counsel’s or insurer’s estimate.
Example: $200,000
Practices that lower your breach risk
Check the ones you have in place. This list does not change the dollar figures.
Your Estimated Breach Cost
For context, not included in the total: OCR can also set civil money penalties. The 2025 inflation-adjusted HHS/OCR schedule caps them at $2,190,294 per violation category per year, published in the Federal Register on January 28, 2026. Actual penalties are set by OCR case by case. Source.
How this is calculated
Every dollar figure comes from what you enter; the calculator adds no averages or estimates of its own. Notification and response is the number of records times your cost per record. The estimated cost of one breach adds that to your incident response cost and your legal and settlement cost. The examples in each box are there to show how the calculator works, not as typical costs. The practices checklist counts what you have in place and does not change the dollar figures. The federal penalty cap is shown for context only and is not added to the total.
Email me this summary
We will send your breach cost breakdown and practices checklist to your inbox, so you can share them with your team.