IEC 62304 compliance cost vs HIPAA in 2026, line by line
TL;DR
IEC 62304 compliance cost in 2026 is not a percentage you add on top of a HIPAA quote. HIPAA and ISO 27001 add line items to a normal build, while FDA rules and the voluntary IEC 62304 and IEC 82304-1 standards change the lifecycle every line passes through. Price both the same way and two quotes stop being comparable.
- HIPAA work prices as controls plus evidence. Acquaint Softtech publishes $29,000 to $87,000 of HIPAA overhead built in from day one, $67,000 to $199,000 retrofitted.
- Device work prices as artifacts per feature. The FDA's Enhanced documentation level adds a software design specification and all unit and integration test protocols and reports.
- Regulated device programs often run waterfall, agile, waterfall.
- From October 1, 2026 a 510(k) costs $28,653 in user fees.
- Around 25% of the healthcare requests on our file named a compliance framework among their requirements. Most named it as a bare label.
Why a HIPAA label is not an estimate
"It has to be HIPAA compliant" is the compliance sentence we see most often in a healthcare brief, and the least priceable one. It names a law. It does not say which data the product touches, which roles see it, or what evidence somebody will ask for next year. Price that sentence and you are pricing a guess.
There is no certificate to buy either. HHS does not endorse or otherwise recognize private organizations' certifications regarding the Security Rule. What exists is a set of obligations, and each one becomes engineering work.
Device regulation gets misread the other way round. The names are familiar, and it is tempting to budget them as one extra phase before launch. In fact the rules decide how each feature is specified and tested from the first sprint, which is why two quotes for the same screens can sit months apart.
What moved on each side of the boundary in 2026
The device side moved three times this year.
- February 2, 2026. The FDA's Quality Management System Regulation took effect and incorporated ISO 13485:2016 by reference.
- February 3, 2026. The FDA reissued its cybersecurity premarket guidance to match. For a cyber device, an SBOM is required.
- October 1, 2026. Fiscal 2027 user fees took effect: $28,653 for a 510(k), or $7,163 for a qualified small business.
The HIPAA side did not move. The proposed Security Rule overhaul of January 6, 2025 is still a proposal, and the regulatory agenda points final action to July 2027. Price today's rule as the baseline and the proposed controls as named options. When the final rule lands, a line changes instead of the whole quote.
How we built this comparison
- Regulatory facts come from the regulator or the standards body wherever the text is public.
- IEC 62304, IEC 82304-1 and ISO/IEC 27001 sit behind paywalls, so we pair the publisher's page with a named secondary source.
- Vendor prices stay attributed to the vendor that published them.
- Our own figures come from healthcare requirement records, counted by hand. Any group with fewer than three data points is not published.
One disclosure. Mercury Development builds healthcare and device connected software and has done so since 1999. We build to HIPAA and GDPR requirements, so some examples are our own work.
The two compliance stacks at a glance
The two columns mix different kinds of obligation. FDA-recognized standards are voluntary unless incorporated by reference into a regulation: ISO 13485 now is, through the QMSR, while IEC 62304 is not.
| Question | HIPAA plus ISO/IEC 27001 | FDA plus IEC 62304 and IEC 82304-1 |
|---|---|---|
| Legal status | HIPAA is federal regulation; ISO/IEC 27001 is an optional certification | FDA rules are statute and regulation; IEC 62304 and IEC 82304-1 are voluntary standards, and the FDA recognizes IEC 62304 |
| What is regulated | Handling of protected health information; security management | Software with a device function and how its life cycle is recorded |
| What switches it on | PHI handled by or for a covered entity; a certified scope that includes the product | A device software function in your intended use; for IEC 82304-1, any standalone health software product |
| Certificate | None for HIPAA; ISO 27001 runs three years with annual surveillance | Clearance or approval of the device, never of the vendor |
| Unit of evidence | Risk analysis, policies, logs, agreements, test reports | Requirements, risk file, design, test protocols, traceability |
| Effect on the lifecycle | Adds controls to any lifecycle | QMSR design controls; IEC 62304 adds a chosen lifecycle model mapped to its processes |
| Shape in the estimate | Extra line items | Extra artifacts per feature, plus gated phases |
| Fixed fees, fiscal 2027 | None from HHS | $28,653 per 510(k), $191,020 per De Novo, $636,732 per PMA |
Where your compliance boundary actually sits
Four separate questions decide where your product lands.
- Do you handle PHI for a covered entity? HHS's health app scenarios treat a developer who creates, receives, maintains or transmits PHI on behalf of a covered entity as a business associate. A consumer downloading an app on her own does not. Outside HIPAA, the FTC's Health Breach Notification Rule, amended effective July 29, 2024, reaches many health apps.
- Does your intended use include a device software function? Then the FDA's premarket software guidance sets the documentation level by risk: Enhanced where a failure could present a hazardous situation with a probable risk of death or serious injury, Basic otherwise.
- Is the product inside a certified ISMS? ISO/IEC 27001 certifies an organization's information security management system, not a product. If your certificate covers the product, your vendor's work falls under Annex A control 8.30: the organization should direct, monitor and review outsourced system development.
- Is it standalone software for phones, PCs or the cloud? IEC 82304-1:2016 covers health software products that run on general computing platforms without dedicated hardware.
Draw the boundary around functions. A monitoring app can carry its device function in the alerting logic and nothing regulated in onboarding. Keep that logic behind a narrow interface and the heaviest evidence lands on the least code, a design decision that belongs in discovery.
What each framework asks for, side by side, is in our comparison of healthcare compliance standards.
What HIPAA and ISO 27001 add, line by line
The Security Rule says what to protect and leaves the method to you. The risk analysis is mandatory, and HHS's risk analysis guidance confirms the rule prescribes no specific methodology. What you document, you keep: 45 CFR 164.316 requires 6 years of retention.
Acquaint Softtech prices what it bundles as HIPAA work:
- encryption at rest and in transit
- role-based access control
- audit logging
- HIPAA-eligible cloud configuration
- business associate agreements with PHI vendors
- a third-party penetration test
- a pre-launch compliance audit
The total runs $29,000 to $87,000 built in and $67,000 to $199,000 retrofitted, with risk analysis and training in a separate $10,000 to $40,000 a year. Look at what multiplies. Encryption goes from $3,000-$8,000 to $15,000-$40,000 and access control from $5,000-$12,000 to $20,000-$60,000, because both live in the data model, while the penetration test costs the same either way. The HIPAA decision to make before the estimate is a schema decision.
Read that list as practice, not as the rule. Under today's Security Rule, encryption is an addressable implementation specification: you implement it where your risk analysis finds it reasonable and appropriate, or document why not and use an equivalent measure. The rule asks for periodic technical evaluation but does not name a penetration test. The January 2025 proposal would require both, encryption with limited exceptions and penetration testing at least once every 12 months, so they belong in the estimate as named lines either way.
ISO/IEC 27001:2022 comes in by another door. Annex A holds 93 controls in four themes, and a certificate is valid for three years subject to annual surveillance audits. Requiring a certified vendor is a selection filter: ask whether the certificate's scope covers the team writing your code. If your own certificate covers the product, you need vendor evidence for the development controls, from secure development life cycle to security testing. That evidence pack is a line. Price it once and reuse it at every surveillance audit.
The build steps behind these lines are laid out in our guide to HIPAA compliant app development.
What FDA, IEC 62304 and IEC 82304 add, line by line
HIPAA adds rows to an estimate. Device regulation adds columns: every feature carries a requirement, a risk entry, a design record and test evidence that point at each other. Three dials set how wide the columns get. The first comes from FDA guidance; the other two come from voluntary standards, although the FDA accepts a declaration of conformity to IEC 62304 in place of part of the lifecycle documentation.
- FDA documentation level. Basic already asks for a requirements specification, an architecture diagram, a risk management file, a summary of testing at unit, integration and system level, and a system level test protocol and report. Enhanced adds a software design specification and all unit and integration test protocols and reports. Testing changes meaning here: a HIPAA test proves a control works, while a device test proves a requirement is met, with a protocol and a report for each.
- IEC 62304 safety class. IEC 62304 sorts software into classes A, B and C by the harm a failure could cause. Class B means documenting the requirements and the architecture, plus unit testing. Class C applies the full standard, detailed design included. The class comes from the standard's own test, not the FDA's, and the FDA guidance itself notes known differences between the two categorizations, so answer them separately.
- IEC 82304-1, for standalone products. It adds product requirements, validation, instructions for use, a technical description and post-market duties, and for the software life cycle itself points back to IEC 62304.
Then the cybersecurity file. Under section 524B, a cyber device includes software, can connect to the internet and could be vulnerable to cybersecurity threats. The February 2026 guidance expects a threat model, a cybersecurity risk assessment, an SBOM, security architecture views and cybersecurity testing with penetration testing. On a HIPAA project the penetration test is a line. Here it is one of five.
Then the fixed costs: $191,020 for a De Novo, $636,732 for a PMA, $13,785 a year for establishment registration. The MDUFA commitment is a decision on 95% of 510(k) submissions within 90 FDA Days. None of this is exotic engineering. It is the same build with every decision written down when it is made, and the writing is what you pay for.
The risk and security work behind the cyber device file is broken down in our guide to ISO 14971 for software.
Why regulated programs run waterfall, agile, waterfall
The standard does not force the shape. IEC 62304 does not prescribe a specific life cycle model, and in May 2025 the FDA recognized AAMI TIR45:2023, the agile guidance for medical device software, as a complete standard. Programs end up hybrid anyway.
- The front is waterfall. Intended use, product requirements, risk plan, safety class and architecture must hold still, because the class decides what a story's definition of done contains.
- The middle is agile. Sprints build and verify features, and a story is done when its requirement, risk control and test point at each other.
- The back is waterfall again. Verification and validation run against a frozen version, and so does the submission, because a reviewer reads a version, not a backlog.
In the estimate that gives three blocks. The front prices as a fixed phase, the middle as capacity per sprint, the back as fixed again. The back is the first block to compare when two quotes sit months apart.
Do not wait for a simpler standard. The second edition of IEC 62304 widens its scope to health software, and Christian Johner expects it to slip past the IEC's October 2028 forecast.
Vendors that run this lifecycle are compared in our ranking of medical device software development companies.
The compliance boundary checklist
Every yes is a line your estimate should show by name. If a quote shows fewer compliance lines than your count, ask which line absorbed the rest.
| # | Question | If yes, the estimate needs | Driver |
|---|---|---|---|
| 1 | Do you handle PHI for a covered entity? | Risk analysis, policies, business associate agreements | HIPAA |
| 2 | Will more than one role see patient data? | Role-based access control | HIPAA |
| 3 | Must you prove who opened which record? | Audit logging and log review | HIPAA |
| 4 | Will PHI sit on devices or third-party services? | Encryption, HIPAA-eligible hosting | HIPAA, addressable |
| 5 | Does anyone demand a penetration test before go-live? | Third-party test plus a fix sprint | Contract or policy |
| 6 | Will your ISO 27001 scope include this product? | Secure development evidence pack | ISO/IEC 27001 |
| 7 | Does your intended use include a device function? | Regulatory strategy, documentation level | FDA |
| 8 | Before any risk controls, could a software failure present a probable risk of death or serious injury? | Enhanced documentation | FDA |
| 9 | Does your IEC 62304 safety classification put any software in Class C? | Detailed design for every unit, Class C verification | IEC 62304 |
| 10 | Can the device software reach the internet? | Threat model, SBOM, security testing | FDA section 524B |
| 11 | Is it standalone software on a general platform? | Validation, instructions for use | IEC 82304-1 |
| 12 | Will you file a 510(k), De Novo or PMA? | User fee, submission, review responses | FDA |
| 13 | Will you update it after clearance? | Maintenance, revalidation, release notes | IEC 62304, IEC 82304-1 |
Rows 1 to 6 add lines to a normal lifecycle. Any yes in rows 7 to 13 changes the lifecycle itself, and the estimate should show three phase blocks. Rows 8 and 9 widen every feature, so settle them first, and settle them apart: the answers often coincide, but they come from different tests.
What our healthcare request file shows
We counted by hand across our healthcare and telehealth requirement records, from remote monitoring to behavioral health.
- Around 25% named at least one compliance framework or regulator among their requirements.
- Of those, around 60% named it as a bare label, usually "HIPAA compliant", with no data classes, roles or evidence attached.
- Requests naming FDA or IEC device standards had fewer than three data points, so they get no share here.
A remote monitoring request listed HIPAA, CCPA, a cybersecurity assessment and ISO 27001 in one sentence. We could not estimate the compliance effort with confidence until those four were broken into requirements, and we now treat that as a recurring pre-sales risk in regulated work.
A device program named FDA, IEC 62304 and IEC 82304 together and asked for a waterfall, agile, waterfall model from the start. Our schedule came in far longer than competing bids, and timeline, not technical fit, became the objection. The lesson is the thesis of this article: a regulated schedule has to be shown phase by phase and line by line, or it reads as padding.
Price the boundary before you price the build
Our position, plainly. A compliance percentage is the wrong unit. Nobody can tell you which work it pays for, and the control it forgot comes back as a change request. We price the boundary first: a short discovery phase produces a list like the checklist above, with a regime and an owner on each line, and the build estimate carries those lines by name.
Both stacks can meet in one product. We built MatchedFlicker, which the case page describes as a 510(k) FDA-cleared application, first for Windows desktop, then moved it to a multi-user web application with HIPAA-compliant online access in 3 months. A medical billing workflow we have extended since 2006, now in its fourth major release, is documented as 100% HIPAA compliant. Our QA practice of 100+ engineers works inside your process with your tools, so test records land in your system.
One honest limit. A boundary list does not make an estimate correct. It makes it checkable, which is a smaller promise and a more useful one.
Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The requirement and estimate records behind this article's own figures sit in the operations he oversees.
Send us your compliance list and we will turn it into estimate lines
Send the compliance sentence from your brief, your intended use statement if you have one, and the roles that will see patient data. We will come back with the boundary drawn, each regime turned into named lines, and the phase blocks a regulated schedule needs.