HIPAA Compliance for Real Estate Companies: What You Actually Need to Know
Most real estate companies are not directly covered by HIPAA, but those handling employee health benefits, occupational health records, or wellness programs may qualify as covered entities or business associates. If your firm touches protected health information (PHI) in any capacity, HIPAA obligations apply and violations carry fines up to $1.9 million per violation category annually.
HIPAA compliance is not a healthcare-only concern. Real estate companies with 20 or more employees frequently interact with protected health information through self-funded health plans, employee assistance programs, or third-party wellness vendors. If your firm sponsors a group health plan, administers COBRA notices, or works with occupational health providers, you may already be a HIPAA-covered entity or business associate without knowing it.
The consequences of non-compliance are concrete. The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has fined organizations across industries, including non-healthcare employers, for improper handling of PHI related to employee benefits. A fine does not require a data breach to occur - gaps in policies, missing business associate agreements (BAAs), or untrained staff are sufficient grounds for enforcement action.
This page is written for SMB owners, IT managers, and compliance officers at real estate companies with 20 to 500 employees. It explains when HIPAA applies to your firm, what controls you need to put in place, how much compliance typically costs, and how to find vetted cybersecurity and compliance vendors through the Value Aligners marketplace.
When Does HIPAA Apply to a Real Estate Company?
HIPAA applies to covered entities and their business associates. Covered entities are health plans, healthcare clearinghouses, and healthcare providers. Most real estate companies are none of these - but that does not mean HIPAA is irrelevant to your organization.
The most common trigger for HIPAA obligations in real estate is the employer-sponsored health plan. If your company self-funds its employee health benefits - meaning the company itself bears the financial risk for claims rather than fully insuring through a carrier - that health plan is a covered entity under HIPAA. Your company, as the plan sponsor, becomes responsible for the plan's HIPAA compliance. This includes implementing a privacy program, executing BAAs with any vendors that handle PHI on behalf of the plan, and training staff who have access to plan data.
A second trigger is the business associate relationship. If your real estate firm provides services to a covered entity and, in the course of those services, creates, receives, maintains, or transmits PHI, you are a business associate. This scenario is less common but not impossible. For example, a commercial real estate company that leases space to a healthcare provider and whose property management staff have incidental access to patient-facing areas or records systems could face scrutiny.
A third trigger involves employee health records more broadly. Under HIPAA's Privacy Rule, medical records held by an employer in the context of employment - such as ADA accommodation requests, workers' compensation files, or FMLA documentation - are generally not covered by HIPAA. However, if those records flow through your group health plan, they become PHI and are subject to HIPAA protections.
Practical steps to determine your obligations: - Identify whether your company self-funds any portion of its health benefits - Review contracts with HR platforms, employee wellness vendors, and benefits administrators to determine if BAAs are required - Consult a compliance attorney or use an assessment tool to map your PHI data flows - Document your determination in writing, even if the conclusion is that HIPAA does not fully apply
If you are uncertain, the safest approach is to conduct a formal risk assessment. The OCR expects covered entities to document this analysis regardless of what the outcome is.
What HIPAA Controls Does a Real Estate Company Need to Implement?
If your real estate company is subject to HIPAA - most likely as a plan sponsor of a self-funded health plan - you are required to implement administrative, physical, and technical safeguards under the HIPAA Security Rule, and privacy controls under the HIPAA Privacy Rule.
Administrative safeguards are the foundation. These include: - A written HIPAA Privacy Policy and Security Policy - Designation of a Privacy Officer and a Security Officer (these can be the same person in smaller organizations) - A workforce training program covering PHI handling, breach reporting, and acceptable use - A formal risk analysis and risk management process, reviewed at least annually or after any significant change - Business Associate Agreements executed with every vendor that handles PHI on your behalf - including payroll processors that touch health plan data, third-party administrators (TPAs), and employee assistance program (EAP) vendors
Physical safeguards apply to any location or device where PHI is stored or accessed. For a real estate firm, this often means: - Access controls on office areas where HR or benefits files are stored - Workstation use policies governing devices used to access health plan portals - Device disposal procedures for computers, phones, or external drives that may contain PHI
Technical safeguards govern electronic PHI (ePHI). Requirements include: - Unique user authentication for any system containing ePHI - Automatic logoff and session controls - Encryption of ePHI in transit and at rest - Audit logging to track who accessed what data and when
Breech notification is a separate but related obligation. Under the HIPAA Breach Notification Rule, your firm must notify affected individuals within 60 days of discovering a breach of unsecured PHI, notify HHS, and in cases involving 500 or more individuals in a single state, notify prominent media outlets.
For most real estate SMBs, the highest-risk gaps are missing BAAs with HR tech vendors, lack of a documented risk analysis, and untrained administrative staff who handle benefits enrollment. These are addressable with the right compliance partner and toolset.
How Much Does HIPAA Compliance Cost for a Real Estate Company?
The cost of HIPAA compliance for a real estate company depends on your current baseline, the complexity of your health plan, and whether you use outside vendors for HR and benefits administration. The following estimates reflect typical expenditures for SMBs with 20 to 500 employees.
Risk Assessment: A formal HIPAA risk analysis conducted by a third-party compliance firm typically costs between $2,500 and $8,000 for a company of this size. Automated risk assessment tools can reduce this to $500 to $2,000 annually if your environment is not complex.
Policy Development: If your company has no existing HIPAA policies, developing a compliant policy set - Privacy Policy, Security Policy, Incident Response Plan, BAA templates - generally costs $1,500 to $5,000 when using a compliance consultant. Template-based services or compliance platforms can reduce this to $300 to $1,500.
Staff Training: Annual HIPAA training for employees with access to PHI ranges from $15 to $50 per employee per year using online platforms. For a 100-person firm where 20 staff touch health plan data, this is a $300 to $1,000 annual line item.
Technology Controls: Encryption, multi-factor authentication, and audit logging tools for systems storing ePHI typically add $10 to $30 per user per month through cloud-based platforms. For a team of 20 relevant users, budget $2,400 to $7,200 annually.
Ongoing Compliance Management: Retaining a fractional compliance officer or using a managed compliance platform runs $500 to $3,000 per month depending on scope. Many SMBs start with a one-time program build followed by annual audits.
Total first-year cost for a mid-size real estate company building a HIPAA program from scratch: approximately $8,000 to $25,000. Ongoing annual costs drop to $3,000 to $10,000 once the program is established.
The cost of non-compliance is substantially higher. OCR civil monetary penalties for violations range from $127 to $63,973 per violation, with annual caps of $1.9 million per violation category (as adjusted by CMP inflation adjustments). State attorneys general may also bring separate enforcement actions.
Vendors on the Value Aligners marketplace have been vetted for SMB fit and transparent pricing. You can compare options at https://www.valuealigners.com/marketplace.
Top Vendors Compared
| Vendor | Specialty | SMB Fit | Pricing | Cert/Compliance Support |
|---|---|---|---|---|
| Compliancy Group | HIPAA compliance software and coaching for non-healthcare employers | Strong - built for companies with 10-500 employees | Starting ~$299/month | HIPAA Seal of Compliance, audit-ready documentation |
| Accountable HQ | Automated HIPAA policy and BAA management platform | Strong - self-service with guided workflows | Starting ~$199/month | Policy library, BAA tracking, risk assessment templates |
| SecurityMetrics | Risk analysis, penetration testing, and compliance audits | Moderate - better for firms needing technical assessments | Project-based, typically $3,000-$15,000 per engagement | Formal risk analysis reports, audit support |
| Clearwater | Enterprise-grade HIPAA risk management and advisory | Moderate - scalable but designed for larger organizations | Starting ~$500/month for SMB tier | OCR-quality risk analysis, legal and technical advisory |
| Value Aligners Marketplace | AI-matched cybersecurity and compliance vendors for SMBs | Built specifically for 20-500 employee companies | Free to assess; vendor pricing varies | Multiple vendor options including HIPAA, SOC 2, and risk management |
Key Statistics
- OCR received 46,338 HIPAA complaints in fiscal year 2023 and has collected over $135 million in settlements and civil monetary penalties since 2008.
- 58% of small and medium-sized businesses that experience a cyberattack involving health data go out of business within six months.
- The average cost of a healthcare data breach reached $10.93 million in 2023, the highest average of any industry sector tracked.
- Employers with self-funded health plans - including those in non-healthcare industries like real estate - are directly subject to HIPAA's Privacy and Security Rules as plan sponsors.
- There are approximately 106,548 real estate brokerage establishments in the United States as of 2023, the majority of which are small businesses that may be unaware of their HIPAA obligations as health plan sponsors.
Frequently Asked Questions
Is a real estate company automatically covered by HIPAA?
No. A real estate company is not automatically a covered entity. HIPAA applies only if your firm sponsors a self-funded employee health plan, acts as a business associate to a covered entity, or otherwise creates or receives protected health information (PHI) in a regulated context. Fully-insured health plans typically shift HIPAA obligations to the insurer, though the plan sponsor still has limited Privacy Rule responsibilities.
Does HIPAA apply to employee medical records at a real estate firm?
Generally, HIPAA does not cover medical records held by an employer in a pure employment context, such as disability leave documentation or workers' compensation files. However, if those records are connected to your group health plan, they become PHI and fall under HIPAA. The HIPAA Privacy Rule specifically requires that plan sponsors build a firewall between employment functions and health plan functions.
What is a Business Associate Agreement (BAA) and does a real estate company need one?
A BAA is a contract required by HIPAA between a covered entity or business associate and any vendor that handles PHI on its behalf. If your real estate firm sponsors a self-funded health plan, you need BAAs with your third-party administrator (TPA), any HR software that processes plan data, your employee assistance program provider, and potentially your payroll vendor if it touches health plan information.
What are the HIPAA fines a real estate company could face?
OCR can impose civil monetary penalties ranging from $127 to $63,973 per violation, depending on the level of culpability. Annual caps per violation category are $1.9 million (as adjusted under the Civil Monetary Penalties Law inflation adjustments). State attorneys general can impose additional fines of up to $25,000 per year per violation type. Criminal penalties for willful disclosure of PHI can reach $250,000 and 10 years imprisonment.
How long does it take to build a HIPAA compliance program for a real estate company?
For a real estate company with a straightforward self-funded health plan and 20 to 100 employees, building a baseline-compliant HIPAA program typically takes 4 to 12 weeks. This includes completing a risk analysis, drafting policies, executing BAAs with vendors, and training relevant staff. Using a compliance platform or managed service compresses this timeline compared to building from scratch internally.
Do real estate agents need HIPAA training?
Real estate agents themselves generally do not handle PHI and do not require HIPAA training. However, HR personnel, office managers, benefits administrators, and any staff who access the company's group health plan data should receive annual HIPAA training. The Privacy Rule requires covered entities to train all workforce members whose functions are affected by PHI handling.
Where can a real estate company find vetted HIPAA compliance vendors?
The Value Aligners marketplace lists pre-vetted cybersecurity and compliance vendors filtered by company size, industry, and compliance framework. You can compare vendors by specialty, pricing model, and SMB fit at https://www.valuealigners.com/marketplace. The platform uses an AI-powered matching process to surface vendors appropriate for your company's specific risk profile and budget.