Seven criteria that actually matter
1. Does the engagement include a real risk analysis? Not a questionnaire. The Security Rule risk analysis is the document OCR asks for first and it is where the substance is. Ask to see a redacted example.
2. Does it include risk management, or stop at analysis? Identifying risks and never documenting their treatment is the second most-cited enforcement finding. Confirm remediation tracking is in scope.
3. Do they understand business associates? Much of this market is built for covered entities. If you are a software company, ask directly how many business associates they have worked with.
4. Is BAA review included? Both the ones your customers send you and the ones you owe subprocessors.
5. Do they publish or scope pricing? Very few in this market publish anything. A firm that will not put a range in writing has not scoped your project.
6. Do they claim to certify you? Nobody can. There is no HIPAA certification from HHS. A firm selling a "HIPAA certified" badge is selling their own attestation, which is fine only if they say so plainly.
7. What happens after? HIPAA is continuous. Annual risk analysis refresh, training, and BAA upkeep are ongoing obligations.
Notable firms in this market
An honest roundup. Different firms suit different situations and none of this is a ranking.
| Firm | Strength | Typical fit |
|---|---|---|
| Avantcert | Published price ranges, business associate focus, HIPAA alongside SOC 2 or HITRUST in one programme | SaaS and mid-market business associates |
| Clearwater | Deep healthcare risk management, large provider experience | Health systems and larger providers |
| LBMC | CPA firm integrating SOC reporting with HITRUST and HIPAA | Organizations wanting audit and advisory under one roof |
| HALOCK | Risk assessments referencing recognised methodologies | Security-led organizations |
| ComplyAssistant | Software plus advisory combination | Teams wanting ongoing tooling |
| Colington Consulting | Focused HIPAA advisory, smaller engagements | Small providers and practices |
Yes, we have listed ourselves first — it is our site. The rest of the table is accurate and the criteria above are the ones to judge us all against.
The certification trap
Worth its own section because this market is full of it.
There is no HIPAA certification. HHS does not certify anyone, there is no accreditation body, and no certificate confers compliance. What exists is an independent assessment against the HIPAA Rules plus your own documented evidence.
Vendors do sell "HIPAA certified" badges. That is their attestation, not a government recognition, and it can still be commercially useful — provided everyone involved understands what it is. A firm that blurs this is telling you something about how it will handle the rest of the engagement.
If a customer genuinely wants something verifiable, the answer is usually HITRUST, which is a real certification.
Questions to ask before signing
Who performs the work — the person in the meeting, or someone else? What is explicitly out of scope? Is the risk analysis refreshed annually or once? Who owns remediation, us or you? What does the evidence package look like at the end? What happens if OCR contacts us during the engagement? And can I have that scoped in writing?
A firm that answers all seven crisply has done this before.
FAQs
How do I choose a HIPAA compliance consultant?
Check that a genuine Security Rule risk analysis is included rather than a questionnaire, that risk management and remediation tracking are in scope, that they understand business associates if you are a software company, that BAA review is included, that they will scope pricing in writing, that they do not claim to certify you, and that ongoing obligations are addressed.
Is there such a thing as a certified HIPAA consultant?
Individuals hold credentials, but there is no HHS certification for HIPAA consultants and no accreditation body for the work. More useful signals are demonstrated experience with organizations like yours, a redacted example risk analysis, and willingness to scope the engagement in writing.
Can a consultant certify my company as HIPAA compliant?
No. HHS does not certify anyone and no certificate confers HIPAA compliance. Vendors selling a HIPAA certified badge are offering their own attestation, which can be commercially useful only if described accurately. If a customer wants something genuinely verifiable, HITRUST certification is the usual answer.
How much should HIPAA consulting cost?
Very few firms in this market publish figures, which makes budgeting hard. Avantcert publishes ranges by company size starting at $3,000 for a 5-50 employee organization. Any firm that will not put a scoped range in writing has not yet scoped your project.
What should be in a HIPAA consulting engagement?
PHI mapping and scoping, a documented Security Rule risk analysis, safeguard remediation across administrative, physical and technical categories, BAA review in both directions, breach notification procedures, workforce training delivered and evidenced, and an evidence package you can show a customer's security team.
Where to go next
See our HIPAA consulting services, start with a risk assessment, or read HIPAA vs HITRUST if a customer wants a certificate.