AI Vendor Breach Exposure Calculator
Every AI tool that touches protected health information is a door someone else is guarding on your behalf. This model puts a number on what happens if one of them leaves it open: the financial exposure from a breach at your single highest-access vendor, priced from IBM's published healthcare breach data, next to the civil penalty band HHS actually applies. Every figure is named, dated and editable.
Updated August 10, 2026Free, no signupRuns in your browser
Your AI vendor footprint
Any tool that stores, transmits or processes identifiable patient data, not only clinical ones.
The vendor with the broadest reach, not your total patient population. A breach starts at one vendor at a time.
A business associate agreement is required wherever a vendor creates, receives, maintains or transmits PHI on your behalf.
Cost basis
Defaults to IBM's 2025 average cost per record of compromised customer PII, the closest published figure. Not healthcare-specific; edit if you have a better one.
Your model
Modelled financial exposure
$9,645,449
60,000 records at $160 each, plus a $45,449 vendor risk uplift from the 20% of your vendors without a signed BAA.
Your exposure against the published healthcare average
The healthcare average covers breaches from every cause, not only vendor incidents. It is a sanity check, not a target.
HHS civil penalty band (does not scale with the inputs above)
HHS sets this band by the culpability tier found in a specific breach under 45 CFR 160.404, not by vendor or record counts. Which tier applies is HHS’s determination, not this tool’s.
Modeling estimate, not a quote or a guarantee. Assumptions are editable and every figure above is derived from the values you entered. The penalty band above is fixed by rule and does not move with your inputs; only the financial exposure figures do.
How this is calculated
base exposure = records your highest-access vendor can reach x cost per record
vendor risk uplift = share of vendors without a signed BAA x $227,244(IBM’s published supply chain breach cost factor)
modelled financial exposure = base exposure + vendor risk uplift
vendors without a signed BAA = vendor count x share without a signed BAA, rounded
HHS civil penalty band = $145 to $2,190,294 per violation, fixed by culpability tier under 45 CFR 160.404, independent of every input above
Methodology and assumptions
What the model does, and what it refuses to guess
Two figures, calculated separately and never added together, because they measure different things.
Financial exposure
Base exposure is the records your highest-access vendor can reach multiplied by a cost per record. That default, USD 160, is IBM's 2025 study average for customer personal identifiable information, the category patient records fall under. It is economy-wide, not healthcare-specific: IBM does not publish a per-record figure broken out by industry, only a total average cost per breach by industry, which is why the healthcare figure below is shown as a total rather than a rate. The field is editable if you have a better number.
On top of that, a vendor risk uplift adds IBM's published supply chain breach cost factor, USD 227,244, scaled by the share of your vendors without a signed business associate agreement (BAA). IBM reports that figure as the difference a supply chain breach makes to the study's average cost, not as a per-vendor or per-record add-on. Scaling it by your BAA gap is a modelling choice this tool is making, not a formula IBM publishes: a missing BAA is the closest measurable proxy available for the vendor-trust failure the factor describes. A reader who disagrees with that substitution should read the base exposure figure alone.
The healthcare average shown for comparison, USD 7.42 million, is IBM's 2025 average total cost of a healthcare data breach, the highest of any industry in the study for the 14th consecutive year. It covers breaches from every cause, not only vendor incidents, so treat it as a sanity check on scale rather than a target.
Where the HIPAA civil penalty band comes from
HHS enforces HIPAA through four culpability tiers set out at 45 CFR 160.404: no knowledge, reasonable cause, willful neglect corrected within 30 days, and willful neglect not corrected. Each tier carries its own per-violation minimum and its own calendar-year cap on penalties for multiple violations of an identical requirement, and HHS adjusts every dollar figure annually for inflation. As of the adjustment effective January 28, 2026, the lowest tier's per-violation floor is USD 145 and the highest tier's calendar-year cap is USD 2,190,294. Those are the two figures this tool shows.
Since April 2019, HHS has applied a tiered reading of the annual caps rather than the single USD 1.5 million ceiling it used before: lower-culpability tiers carry proportionally lower annual caps, and only the top tier, willful neglect not corrected, can reach the full USD 2,190,294 figure. HHS has described that reading as enforcement discretion rather than a change to the regulation text, which means it could change again.
This band is deliberately not multiplied by anything above it. HHS assigns a tier based on the culpability found in a specific breach, not on how many vendors or records were involved, and there is no published rule mapping a BAA gap onto a specific tier. Presenting a scaled penalty figure would be inventing a precision the enforcement record does not support.
What it refuses to do
It does not estimate how likely a breach at any given vendor is. No publisher tracks an incidence rate for AI vendors specifically, and multiplying an invented probability into a dollar figure would make the output look more precise than it is, not less. It also does not guess which HIPAA tier your organization would fall into, and it does not treat a missing BAA as proof of willful neglect: that determination is HHS's, made case by case, and several resolution agreements on record involve entities that did have a BAA in place.
What it leaves out
Litigation costs beyond what IBM's four-category cost model already includes, state attorney general actions, and state breach notification requirements that sit alongside HIPAA and vary by state are all real and none of them are modelled here. A vendor's own contractual liability cap, if one exists, also is not reflected: read the agreement, since it frequently sits well below the exposure figure above. For the regulatory posture behind all of this, see the HIPAA AI compliance page; for the questions worth asking before a vendor gets access at all, see what to ask AI vendors about HIPAA.
Sources
The named reports and rules this calculator’s figures are drawn from. Where a figure moves, this calculator moves with it.
- OtherCost of a Data Breach Report 2025: healthcare average breach cost, cost per record and the supply chain breach cost factor, IBM (opens in a new tab)
- HHSAnnual Civil Monetary Penalties Inflation Adjustment, HHS, effective January 28, 2026 (45 CFR 160.404) (opens in a new tab)
- HHSNotification of Enforcement Discretion Regarding HIPAA Civil Money Penalties, HHS (April 2019) (opens in a new tab)
- HHSBusiness Associates and the business associate agreement requirement, HHS Office for Civil Rights (opens in a new tab)
- HHSHIPAA Breach Reporting Portal, HHS Office for Civil Rights (opens in a new tab)
Questions we get asked
Why does the calculator only use my highest-access vendor, not all of them?
Because a breach happens at one vendor at a time. Adding every vendor's accessible records together would model a simultaneous, organization-wide compromise, which is a different and far rarer event than a single vendor incident. The vendor count you enter is used to size the BAA-gap count in the results, not to multiply the dollar total.
Where does the USD 160 per record figure come from?
IBM's Cost of a Data Breach Report 2025, which found an average cost of USD 160 per record for compromised customer personal identifiable information, the category patient records sit under in that study. It is an economy-wide figure, not a healthcare-specific one: IBM does not publish a per-record rate broken out by industry, only a total average cost per breach by industry. Replace it if you have a better source.
What is the vendor risk uplift, and why is it tied to BAA coverage?
It is IBM's published supply chain breach cost factor, USD 227,244, scaled by the share of your vendors without a signed business associate agreement. IBM measures that figure as the difference a supply chain breach makes to the average cost of a breach in its study, not as a per-vendor add-on. Applying it here scaled by your BAA gap is this tool's modelling choice, made explicit rather than left hidden in the formula, because a missing BAA is the closest measurable proxy available for the vendor-trust failure IBM's factor describes.
Does having a signed BAA with every vendor mean we would avoid a civil penalty?
No. A BAA is a contractual and administrative safeguard HHS expects to see, and its absence is a real and commonly cited finding in enforcement actions, but several published resolution agreements involve covered entities that did have a BAA in place and were penalized anyway for how the relationship was managed. This tool does not claim a BAA gap determines your penalty tier, because HHS has not published a rule that does either.
Why is the HHS penalty band shown as a fixed range instead of scaling with my inputs?
Because HHS assigns one of four culpability tiers based on what actually happened in a specific breach, not on vendor or record counts, and no published formula converts either into a penalty amount. Scaling the band by your inputs would manufacture a precision the enforcement framework does not offer. The band shown, USD 145 to USD 2,190,294, is the current floor and ceiling across all four tiers under 45 CFR 160.404.
Why does the model not include state breach notification fines or litigation costs?
Because neither is a single, citable national figure. State breach notification laws vary by state, and litigation outcomes vary by case, jurisdiction and counsel. IBM's cost-per-record figure already folds in notification, detection and post-breach response costs from its study sample, but state penalties and lawsuit settlements sit outside that figure and outside HIPAA entirely, so adding a guessed number for either would misrepresent what this tool can actually verify.
Is this calculator specific to AI vendors, or does it apply to any business associate?
The maths applies to any vendor with PHI access. It is framed around AI vendors because that population is growing fastest and is the one least likely to have a mature BAA and security review process behind it, per the questions this site publishes for evaluating one before signing. The HHS penalty structure and IBM's cost figures do not distinguish AI vendors from any other business associate.
Find out what an agent could safely do today
The readiness assessment scores your data, systems, staffing and governance against what agents actually require, and tells you which use cases are reachable this year.
Book an evaluation call at any point. No obligation.