The honest answer is a range, and what you should watch is what the money buys. A security risk analysis is the most-cited gap in OCR enforcement, so the test of any assessment is simple: does it produce a documented analysis of where your PHI lives, the threats to it, and a prioritized remediation plan you actually execute?
What drives the price up or down: the number of locations and users, how many systems touch PHI (EMR, imaging, lab, billing, email, texting), whether the assessor only scans or also interviews and inspects, and whether remediation tracking is included or sold separately.
What to be skeptical of: a free "assessment" that is really a sales audit, a questionnaire you fill out yourself with no inspection behind it, and a glossy report with no asset inventory. OCR does not ask whether you bought a report; it asks for the analysis and what you did about it.
For current planning ranges in our market, use our Texas pricing guide; the figures there are planning ranges, not quotes, and an exact price takes a scoping conversation. In Galleon's managed relationships the recurring risk analysis is part of the regulatory compliance work rather than a one-off purchase, which is also how the documentation stays current between assessments.