Our methodology

Exactly how we choose firms, what we verify, how we label prices — and what we refuse to do.

Which firms get listed

A firm appears in our directory only if, as of our last check, it meets all three:

• It operates an active public website offering HIPAA assessment or compliance services — verified by a direct load check, not a database scrape.
• It is a real assessment or consulting practice with healthcare clients — not a software vendor rebranded as an assessor.
• Its HIPAA service is real and current — assessment service pages, not just a keyword on a services list.

What we verify — and what we don't claim

For each firm we record headquarters, firm type, and the frameworks its own public materials say it supports. Directory facts were last verified in September 2026; we aim to re-check quarterly.

How we label every price

Assessment fees are scoped per engagement, so almost no HIPAA firm publishes prices. Where we show a planning range, it always carries one of three labels:

None of these are quotes. Your fee depends on size, locations, ePHI complexity, and readiness. Treat every band as a planning figure and get scope and fee in writing.

Timelines

Where shown, the "fieldwork window" is the risk-analysis fieldwork phase — not the full program. Remediation, policies, and training (typically 1–4 months for first-timers) come after or alongside. Vendor marketing timelines don't count.

What we will never do

• No star ratings or review scores. We have not hired these firms' clients and won't compress fit into a number.
• No testimonials. Every quote-like line on this site would be fabricated — so there are none.
• No "HIPAA certified" badges. There is no official HIPAA certification; we won't sell, display, or imply otherwise.
• No pay-for-rank. Ever. Firms cannot pay to be listed, ranked higher, recommended, or have a profile softened. Some directories sell "featured" placement; we don't sell placement at all.
• No invented statistics. Every number on this site has a clickable source.

How we make money

When you request quotes, matched assessors may pay us a lead or referral fee. That payment cannot change which firms we list, what our guides say, or which firms we recommend — the firewall is absolute, and firms can't buy their way around it.

Corrections

Wrong price, stale fact, firm missing? Tell us. We check corrections against the firm's own public materials and note material fixes on the affected page with a date.

Verification log

Row-level log of the website verification behind this directory. Each firm's official website was loaded directly on 2026-09-24 with a browser user agent; every row below returned HTTP 200.