September 21, 2026
There is no single cybersecurity budget that is appropriate for every healthcare practice. A 10-person primary care office and a 50-person multi-location specialty practice may need very different levels of protection.
Instead of starting with an arbitrary percentage of revenue or IT spending, healthcare practices should build their cybersecurity budget around six areas: risk assessment and planning, identity and access security, endpoint and network protection, email and cloud security, backup and recovery, and ongoing monitoring, training, and incident preparedness.
The goal is not to hit a particular spending percentage. It is to make sure the practice is adequately funding the safeguards needed to protect its systems, electronic protected health information (ePHI), and day-to-day operations.
Why Isn't There a Standard Cybersecurity Budget for Healthcare Practices?
Healthcare practices sometimes look for a simple benchmark such as "spend X% of revenue on cybersecurity" or "allocate X% of the IT budget to security."
Those numbers can provide context, but they can also create a false sense of precision.
A practice's actual cybersecurity needs depend on factors such as:
- Number of employees and locations
- Amount and type of sensitive information handled
- EHR and practice-management systems
- Microsoft 365 and other cloud applications
- Remote access
- Connected medical devices
- Existing technology and security controls
- Cyber insurance requirements
- Identified vulnerabilities
- Regulatory responsibilities
- Internal versus outsourced IT and security resources
HIPAA takes a similarly risk-based approach. The HIPAA Security Rule requires regulated organizations to assess risks to ePHI and implement reasonable and appropriate administrative, physical, and technical safeguards. The rule does not prescribe a specific cybersecurity budget.
That makes the practice's risk analysis an important starting point for budgeting. If you don't know where your risks and security gaps are, it is difficult to know whether you're spending too little, enough, or simply spending money on the wrong things.
For a deeper look at that process, see How Often Should Healthcare Practices Perform a HIPAA Security Risk Assessment? A 5-Step Review Framework.
What Should Be Included in a Healthcare Practice's Cybersecurity Budget?
For an independent healthcare practice, cybersecurity spending can be organized into six major categories.
This provides Practice Administrators with a more useful budgeting framework than starting with an arbitrary percentage.
1. Risk Assessment and Security Planning
Before deciding what security products to purchase, understand the environment you're trying to protect.
Your cybersecurity budget may need to account for:
- HIPAA Security Risk Assessments
- Vulnerability assessments
- Technology and asset inventories
- Security policies and procedures
- Remediation planning
- Periodic security reviews
- Vendor and third-party risk management
HHS describes risk analysis as foundational to identifying and implementing appropriate safeguards for ePHI.
The important distinction is that the assessment should lead to action.
For example, identifying outdated computers, weak authentication, an unsupported firewall, inadequate backups, or excessive user permissions creates potential remediation costs that need to become part of the practice's technology and cybersecurity budget.
2. Identity and Access Security
Every employee who accesses practice technology creates identities and permissions that need to be managed.
Budget considerations may include:
- Multifactor authentication
- Phishing-resistant authentication
- Individual user accounts
- Password and credential management
- Privileged account protection
- Employee onboarding and offboarding
- Periodic access reviews
- Remote-access controls
The costs aren't limited to software licenses. Someone also needs to manage these controls as employees join the practice, change responsibilities, or leave.
A documented process helps prevent old accounts and unnecessary permissions from remaining active. Our 7-step healthcare IT access management process explains how practices can structure employee access from onboarding through termination.
3. Endpoint, Network, and Device Security
Computers are only one part of a healthcare practice's technology environment.
Cybersecurity spending may need to protect:
- Desktop computers
- Laptops
- Servers
- Firewalls
- Wireless networks
- Tablets and mobile devices
- Remote devices
- Connected medical equipment
- Other network-connected technology
Depending on the environment, protections may include endpoint detection and response, patch management, vulnerability management, device encryption, secure network configurations, network monitoring, and segmentation.
Connected medical devices can create additional considerations because they may have different operating systems, vendor support requirements, and update procedures than standard business computers. Their role in patient care can also affect how and when they can be updated, replaced, or taken offline.
Practices using these devices can review our 6-step connected medical device security framework for additional guidance.
4. Email, Microsoft 365, and Cloud Security
Microsoft 365 and other cloud applications are sometimes treated as separate from cybersecurity spending.
They shouldn't be.
A compromised cloud account can potentially expose email, files, employee identities, sensitive business information, and other systems.
A healthcare practice's budget may therefore need to include:
- Email filtering and phishing protection
- Microsoft 365 security configuration
- Multifactor or phishing-resistant authentication
- Conditional Access
- Account monitoring
- Device management
- Data protection
- Cloud application security
- Microsoft 365 backup
- Appropriate Microsoft 365 licensing
Licensing deserves particular attention because the cheapest license may not include the security and device-management capabilities a practice needs.
For example, as of July 2026, the U.S. commercial list-price difference between Microsoft 365 Business Standard and Business Premium with Teams was $8 per user per month. For a 25-user practice, that is approximately $200 per month or $2,400 per year before taxes, reseller pricing, or other billing differences.
That additional cost should be evaluated against the security and management capabilities included with the license and what the practice would otherwise need to purchase separately.
Our Microsoft 365 healthcare security framework and Microsoft 365 healthcare licensing comparison explore those decisions in more detail.
5. Backup, Recovery, and Incident Preparedness
Cybersecurity budgeting should account for what happens when prevention fails.
That includes preparing for situations such as:
- Ransomware
- Account compromise
- Hardware failure
- Accidental deletion
- Cloud application problems
- Severe weather
- Other technology disruptions
Your budget may therefore need to include:
- Data backups
- Microsoft 365 or cloud backups
- Backup monitoring
- Secure backup storage
- Recovery testing
- Incident-response planning
- Business continuity planning
- Recovery procedures
A successful backup job is not the same thing as knowing the practice can recover.
The practice should understand which systems are protected, how frequently information is backed up, how backups are secured, who is responsible for recovery, and whether restoration has actually been tested.
Our 6-part healthcare backup strategy provides a framework for evaluating those questions.
6. Ongoing Monitoring, Management, and Employee Training
Cybersecurity is not a collection of products that can be purchased once and forgotten.
Someone needs to:
- Review security alerts
- Monitor systems and accounts
- Investigate suspicious activity
- Maintain security tools
- Apply updates
- Review vulnerabilities
- Manage security configurations
- Train employees
- Conduct security awareness activities
- Update security plans as risks change
- Coordinate responses when an incident occurs
HHS's voluntary healthcare-specific Cybersecurity Performance Goals identify high-impact practices including email security, multifactor authentication, cybersecurity training, vulnerability management, incident planning, and vendor security.
For a small independent practice, the budgeting question becomes:
Who is responsible for doing this work?
Larger healthcare organizations may employ dedicated cybersecurity personnel. A 10- to 25-employee independent practice is more likely to combine technology management and cybersecurity through an outside IT provider or other specialized vendors.
That makes it important to understand exactly which security responsibilities are included in each agreement.
How Can a 10 to 25 Employee Healthcare Practice Build a Cybersecurity Budget?
Instead of beginning with a percentage, start with the six categories above and document what the practice already has.
A simple review can look like this:
| Cybersecurity Category | What Do We Have Today? | What Is Missing or Needs Improvement? |
| Risk assessment and planning | Existing assessments, policies, reviews | Identified gaps or overdue work |
| Identity and access | MFA, account management, access controls | Missing or weak controls |
| Endpoint and network security | Endpoint protection, firewall, monitoring | Unsupported or inadequate protection |
| Email and cloud security | Microsoft 365, filtering, authentication | Licensing or configuration gaps |
| Backup and recovery | Existing backups and recovery procedures | Systems not protected or recovery not tested |
| Monitoring and training | Monitoring, awareness training, incident response | Missing management or preparedness |
Once the gaps are identified, divide the financial requirements into three types of spending.
Recurring Cybersecurity Costs
These are predictable monthly or annual costs.
Examples may include:
- Security software
- Endpoint protection
- Email security
- Microsoft 365 security licensing
- Backup services
- Security monitoring
- Security awareness training
- Managed IT or cybersecurity services
Periodic Cybersecurity Costs
Not every security activity generates a monthly bill.
Periodic costs may include:
- Comprehensive risk assessments
- Vulnerability assessments
- Penetration testing when appropriate
- Policy reviews
- Incident-response exercises
- Security reviews
- Specialized consulting
These expenses should still be anticipated in the annual budget even when they only occur once or twice during the year.
Remediation and Capital Costs
A security review may identify larger investments that aren't part of normal monthly operations.
Examples include:
- Replacing unsupported computers
- Replacing an outdated firewall
- Upgrading network equipment
- Improving wireless infrastructure
- Segmenting networks
- Completing a major security project
- Replacing unsupported technology
Separating these expenses prevents a common budgeting mistake: assuming the practice's monthly security bill represents its entire cybersecurity investment.
Is Cybersecurity Already Included in Your Managed IT Costs?
Possibly.
This is one reason healthcare practices should inventory existing services before adding new cybersecurity spending.
A managed IT agreement may already include services such as:
- Endpoint protection
- Patch management
- Microsoft 365 management
- Backup monitoring
- Network monitoring
- Security monitoring
- User account management
- Employee onboarding and offboarding
ResTech's 2026 Houston healthcare managed IT pricing guide estimates comprehensive managed IT services at approximately $200 to $475 per user per month, depending on the technology environment, cybersecurity requirements, and included services.
For a 10- to 25-employee practice, that translates to a broad range of approximately $2,000 to $11,875 per month for comprehensive managed IT.
That is not a cybersecurity-only budget.
Cybersecurity may represent a significant portion of the services and technology included in the agreement, but the same monthly fee may also cover help desk support, device management, Microsoft 365 administration, technology planning, vendor coordination, and other IT responsibilities.
Before buying another security product, determine whether you're already paying for the capability somewhere else.
The opposite is also important.
Don't assume a service is included simply because your practice has an IT provider. Ask specifically what security products, monitoring, management, assessments, training, and response capabilities are actually part of the agreement.
When Should a Healthcare Practice Increase Its Cybersecurity Budget?
Cybersecurity spending should change when the practice's risk or technology environment changes.
Budgeting should be reconsidered when the practice:
- Adds employees
- Opens another location
- Changes EHR systems
- Moves important systems to the cloud
- Adds connected medical devices
- Expands remote access
- Adopts new AI tools
- Experiences a cybersecurity incident
- Identifies significant gaps during a risk assessment
- Receives new cyber insurance requirements
- Adds vendors that handle sensitive information
- Continues operating technology that is approaching or has reached end of support
HHS requires regulated organizations to periodically evaluate their security measures and reevaluate risks to ePHI.
For a healthcare practice, that means the cybersecurity budget shouldn't simply roll forward unchanged every year.
A new location, EHR migration, acquisition, major software implementation, or change in how employees work can alter the practice's risk profile and create new security requirements.
How Do You Know Whether You're Spending Enough on Cybersecurity?
A bigger cybersecurity budget does not automatically mean better security.
A practice can spend significant money on overlapping products, poorly configured tools, services nobody monitors, or controls that don't address its most important risks.
Instead of asking only, "How much are we spending?", ask:
- What systems, devices, accounts, and information are we protecting?
- What are our most significant risks?
- What safeguards are already in place?
- What important gaps remain?
- Which gaps create the greatest operational, security, or compliance risk?
- Who is responsible for managing each control?
- How do we verify that those controls are actually working?
Those answers give Practice Administrators a much better basis for determining whether cybersecurity spending is adequate.
The objective is not the largest budget.
It is a budget that funds the right protections for the practice's actual risks.
Frequently Asked Questions
What Percentage of Its IT Budget Should a Healthcare Practice Spend on Cybersecurity?
There is no universal percentage that works for every healthcare practice. Organization size, existing technology, risk exposure, internal resources, compliance responsibilities, and the services already included in managed IT agreements can significantly change the amount required.
Use industry percentages as context rather than as the primary budgeting method. A risk assessment and review of existing security controls provide a stronger starting point.
Is Cybersecurity Part of the IT Budget or a Separate Budget?
Either approach can work if the practice can identify what it is spending and what protections those dollars provide.
For a small healthcare practice, cybersecurity may be embedded within managed IT, Microsoft 365 licensing, backup services, employee training, insurance requirements, and other technology expenses. Tracking those components separately can make it easier to identify gaps and duplicate spending.
Does Cyber Insurance Reduce How Much a Practice Needs to Spend on Cybersecurity?
No. Cyber insurance transfers some financial risk, but it does not replace cybersecurity controls.
Insurers may also require or ask about controls such as multifactor authentication, backups, endpoint protection, security training, and other safeguards during underwriting. The practice still needs appropriate protections regardless of whether insurance coverage is in place.
Should a Small Healthcare Practice Have the Same Cybersecurity Tools as a Hospital?
Not necessarily.
A small independent practice and a large hospital have very different technology environments, staffing, budgets, and risk profiles. The appropriate safeguards should reflect the practice's actual environment and risks.
However, being small does not eliminate the need for foundational controls such as secure authentication, endpoint protection, backups, access management, employee training, and incident preparedness.
How Often Should a Healthcare Practice Review Its Cybersecurity Budget?
At minimum, include cybersecurity in the practice's regular annual technology and budgeting process.
The budget should also be reconsidered whenever significant changes occur, such as opening a location, changing EHR systems, adopting new cloud or AI platforms, adding connected medical devices, experiencing an incident, or identifying new risks during a security assessment.
Final Thoughts
The better cybersecurity budgeting question isn't simply, "What percentage should we spend?"
It is, "Are we funding the protections our practice actually needs?"
Start with the practice's risks. Review the six major areas of cybersecurity spending. Determine which protections are already included in existing technology agreements, identify meaningful gaps, and separate recurring expenses from periodic assessments and larger remediation projects.
That gives Practice Administrators a cybersecurity budget tied to the practice's actual environment instead of an arbitrary industry percentage.
About ResTech Solutions
ResTech Solutions helps independent healthcare practices throughout the Houston area manage technology, cybersecurity, Microsoft 365, and long-term technology planning.
For more than a decade, we've worked with healthcare organizations and other regulated businesses to build secure, reliable technology environments. Our approach looks beyond individual security products to consider how users, devices, systems, vendors, policies, and security controls work together.
If you're unsure whether your current cybersecurity spending is covering the protections your practice actually needs, start by understanding what you already have, where the gaps are, and which risks deserve priority.
Book a 10-minute discovery call and we'll help you determine where your current cybersecurity approach may need a closer look.
