Switching HIPAA assessors

When to change assessment firms, when not to, and how to do it without breaking your compliance program.

Good reasons to switch

• Scheduling: your current firm can't commit a fieldwork window before your deadline.
• Scope mismatch: you've outgrown a boutique, or a large firm is overkill for your footprint.
• Team churn: the assessors you vetted aren't the assessors showing up.
• Fee disputes: change orders that weren't in the engagement letter.

Bad reasons to switch

• Shopping for softer findings. Switching firms to find a lenient assessor is visible and corrosive — OCR doesn't grade on a curve.
• Mid-assessment. Switching during active fieldwork wastes the evidence packaging you've done.

How to switch cleanly

1. Time it between assessment cycles — ideally right after a completed risk analysis, with the next one months out.
2. Keep your risk analysis and evidence package — they're yours, and a good package transfers.
3. Brief the new firm on prior findings and open remediation — hiding history backfires.
4. Get the new engagement letter's scope, fee, and schedule in writing before terminating the old one.