How to Choose a HIPAA Assessment Firm: 9 Questions to Ask

No government body accredits HIPAA assessors — so vetting is on you. The nine questions that separate real healthcare assessors from generalists.

Start with the uncomfortable truth

No government body accredits HIPAA assessors. Unlike HITRUST (authorized external assessors) or ISO 27001 (accredited certification bodies), anyone can hang out a shingle as a "HIPAA assessor." That makes your vetting the entire quality control. The questions below are how you do it.

The 9 questions

1. How much of your work is healthcare?
   A firm that does 10% healthcare will assess like a generalist. Ask for the percentage and for healthcare client references you can actually call.
2. Who is my actual assessment team?
   Partner bios in the pitch deck mean nothing if junior staff do the fieldwork. Ask for the lead assessor's name, healthcare background, and completed assessment count.
3. Can I see your risk-analysis report structure?
   A real assessor can show you (redacted) what the deliverable looks like: scope, threats, vulnerabilities, control evaluation, risk ratings, remediation plan. Vagueness here is disqualifying.
4. How do you address the nine OCR risk-analysis elements?
   OCR's guidance specifies what a compliant risk analysis contains. If the firm can't walk through its methodology against that guidance, keep looking.
5. Fixed fee or variable — and what breaks the fixed fee?
   Get scope boundaries in writing: locations, ePHI systems, workforce size. What triggers a change order mid-assessment?
6. What is your Privacy Rule depth, not just Security Rule?
   Many IT audit firms assess technical safeguards well and privacy poorly. If you need both rules covered, confirm it explicitly.
7. How do you handle remediation independence?
   If the firm also sells implementation help, ask how assessment independence is preserved — and get it in writing.
8. What is your scheduling lead time?
   Good healthcare assessors book up. Get a committed fieldwork window, not a vague quarter.
9. Can I talk to two reference clients my size?
   Not logos — conversations. Ask those references: did the fee hold, did the report survive customer scrutiny, and would they re-engage?

Red flags

• Sells "HIPAA certification." There is no such thing — see our explainer. A firm leading with a nonexistent credential misunderstands the basics.
• Won't name the assessment team. You're buying assessors, not a brand.
• Vague scope, lump-sum fee. "HIPAA assessment: $25k" with no locations, no ePHI inventory, no workforce count is a change order waiting to happen.
• Guaranteed outcomes. No ethical assessor pre-promises what the findings will say.

Specialist vs generalist

Healthcare-exclusive firms (Clearwater, Fortified Health Security, CynergisTek) live inside provider realities — clinical workflows, medical devices, payer contracting. Multi-framework practices (A-LIGN, Schellman, Coalfire) cover HIPAA alongside HITRUST and SOC 2. Match the firm to your need: pure HIPAA depth versus combined-framework efficiency. Browse verified assessor profiles or get matched.

Keep reading

Questions