1st, You'll need to check with HIPAA to make sure you're doing it correctly.
http://www.cms.hhs.gov/HIPAAGenInfo/

Next, evaluate the cost of doing it inhouse (HW+SW+Time+Training+Maintenance and...