Buying guide
The HIPAA RFP & quote comparison worksheet
What to put in your assessment brief, how to compare quotes apples-to-apples, and the engagement-letter red flags.
Your brief: the 10 lines that matter
- What you need: risk analysis, readiness/gap assessment, HITRUST, or full program
- Workforce size and number of ePHI users
- Locations with ePHI in scope (sites, cloud tenants)
- ePHI inventory status (or "undefined — help scoping")
- Current policies, training records, and last risk analysis date, if any
- Existing tooling (EHR, encryption, SIEM, GRC)
- Vendors with PHI access (BAA inventory status)
- Target assessment quarter
- Other frameworks in play (HITRUST, SOC 2)
- Budget band, if you have one
Quote comparison worksheet
| Line item | Firm A | Firm B | Firm C |
|---|---|---|---|
| Fixed fee & what's included | |||
| Per-location pricing | |||
| Assessment team (named lead?) | |||
| Committed fieldwork window | |||
| Remediation support pricing | |||
| Report structure (sample?) | |||
| Reference clients your size |
Engagement-letter red flags
- No named assessment team. "Our team" is not an answer.
- No committed schedule. "Q3-ish" from a firm with real demand behind it.
- Undefined change-order triggers. Get the scope boundaries that break the fixed fee.
- "HIPAA certification" language. There is no such thing — a firm promising it misunderstands the basics.
- Remediation bundled without independence language. Keep assessment and implementation properly separated.
Skip the RFP paperwork
Our 4-question brief captures all of the above — matched assessors reply with scoped quotes.
How it works: tell us once (4 questions, 2 min) → we match HIPAA assessors to your size, setting, and timeline → they send scoped quotes directly. Free, no obligation.