HIPAA compliance consultant cost and what they do

What a HIPAA compliance consultant costs and why the answer depends on your scope

A HIPAA compliance consultant prepares the risk analysis, policies, safeguards and evidence that your organization needs to show Security Rule compliance, and fees follow from a written scope that sets out which systems, sites, workforce and deliverables are included. No HIPAA certification exists, so no consultant can certify you. When a customer, contract or OCR inquiry asks for proof, start by listing what you already have: an existing risk analysis, written policies under 45 CFR 164.316, access records, backup tests and business associate agreements. A consultant's work is usually priced against the gap between that inventory and what the Security Rule requires. Ask each bidder to name the systems in scope, the evidence they will produce, who on your side must supply interviews and access, and whether the price covers drafting, implementation support or both. The HHS Security Risk Assessment Tool is free and aimed at small and medium-sized practices and business associates, so an organization with a simple environment can start there before paying anyone to do the analysis.

Your organization owns its controls. The consultant can design, configure and document them, and the HIPAA security official and leadership remain accountable for whether they work. Only an independent evaluator can report on them, and HHS does not recognize private certifications. That split should shape the contract: the consultant's deliverables are preparation materials and evidence, not an attestation. Ask whether the work includes a named accountable owner on your side, a written handover of every policy and procedure, and a list of open items with owners and dates after the engagement ends. Fixed-scope agreements make these deliverables easier to compare across bids, and a quote should state what is one-time, such as the initial analysis and policy set, and what recurs, such as annual risk analysis updates and workforce training refreshes.

The cost of getting it wrong is the reason many organizations buy help. For penalties assessed on or after January 28, 2026, the inflation-adjusted HIPAA civil money penalty ranges from $145 per violation (no knowledge) to $2,190,294 per violation (uncorrected willful neglect), with a calendar-year cap of $2,190,294 under 45 CFR 102.3. Those figures are a penalty ceiling set by regulation, not a consulting price, and OCR's settlements vary widely with the facts, such as the $10,000 MMG Fusion agreement in March 2026, which considered the company's financial condition. Recent settlements such as the $700,000 Ambry Genetics agreement in September 2026 also carry multi-year corrective action plans, which can require ongoing reporting and cost more than the initial engagement. Compare any consultant's fee with the internal staff time, tooling and corrective actions a finding would demand.

Who gets paid for what in a HIPAA engagement

This table compares each cost component of a HIPAA Security Rule engagement by who is paid, whether the cost is one-time or recurring, and what moves it up or down. Use it to structure requests for line-item quotes, since no supplied figures set prices. The main takeaway is that the largest recurring costs usually sit with your own staff and tooling, not with the consultant.

Cost component	Who is paid	One-time or recurring	What drives it up or down
Implementation partner or consultant	The firm that prepares policies, risk analysis support, safeguards and evidence	Mostly one-time, scoped to written deliverables	Number of systems and ePHI locations in scope, existing documentation quality, and how much work your team does first
Internal staff time	Your own employees, such as the security official, IT, compliance and clinical leads	One-time for setup, recurring for reviews, training and access changes	Headcount available, how many systems handle ePHI, and how often workforce or vendors change
Security tooling and hosting	Software vendors, cloud providers or your data center team	Recurring, usually billed on a subscription or infrastructure basis	Choice of open-source versus licensed tools, log retention needs, and the number of users and endpoints
Outside evaluator (if chosen)	An external organization that provides evaluation services	Periodic, tied to the evaluation cycle you select	Scope of systems reviewed and whether findings require retesting. HHS does not recognize private certifications, so confirm what the report will and will not show
Legal review of business associate agreements	Your counsel or outside health law firm	One-time per agreement, plus updates when vendors or terms change	Number of business associates, whether you use standard templates, and how many terms you negotiate
Penetration testing or technical assessment	A testing firm or your own qualified staff	Periodic, often repeated after major system changes	Number of applications and networks in scope, and whether testing includes cloud configuration review
Training and awareness materials	Training vendors, your learning team or the consultant	Recurring, since workforce training must be repeated and updated	Workforce size, turnover rate, and whether you build content in-house or buy it
Documentation upkeep	Your compliance or security staff, sometimes supported by a retainer	Recurring, since policies, risk analysis and records must be kept current	Frequency of system changes, the six-year retention period for documentation, and how much is automated

What makes a HIPAA engagement cost more or less

Under 45 CFR 164.306(b)(2), an entity weighs its size, complexity, technical infrastructure and the cost of security measures against the probability and criticality of risks to ePHI. The six drivers below follow that reasoning, and each one moves the scope of a consultant's work up or down.

Organization size and complexity

A single clinic with one practice management system and a handful of staff needs a much smaller risk analysis than a health system with many facilities, affiliated physician groups and shared services. Complexity counts as much as headcount: more workflows that create, receive, maintain or transmit ePHI means more systems to inventory and more policies to write. Ask a consultant to state which entities, sites and workflows the quote covers, and whether affiliates are included.

Number and location of ePHI systems

Every system that stores, processes or transmits ePHI expands the risk analysis, the access reviews and the audit log review. Count applications, databases, endpoints, mobile devices, backups and interfaces before asking for a price, because a vague inventory is the most common reason a quote changes after kickoff. Confirm whether the consultant will build the inventory from your records or expect you to deliver it.

Cloud and third-party hosting

Hosting ePHI in a cloud environment or with a managed provider splits responsibility between you and the provider, and each split needs to be documented. Business associate agreements, provider attestations and shared responsibility matrices all add review work. Ask whether the consultant will map each safeguard to your side or the provider's side, and which provider documents you already hold.

Business associates in scope

Each vendor that creates, receives, maintains or transmits ePHI for you needs a written agreement with Security Rule terms under 45 CFR 164.314, and your assessment has to cover how that vendor protects the data. A long vendor list multiplies contract review and due diligence questionnaires. Build a list of every vendor touching ePHI, flag the ones that only host encrypted data, and agree on which vendors the consultant will assess and which you will assess yourself.

Evidence maturity

An organization with current policies, dated risk analysis records, training logs and access review tickets needs less reconstruction than one that has never written them down. Under 45 CFR 164.316, documentation must be retained for six years and kept current, so older gaps in records often cost more to rebuild than current gaps cost to fix. Ask the consultant to list which artifacts it will reuse and which it will create from scratch.

Remediation backlog

A risk analysis that finds many high-risk items creates a risk management plan with a long list of fixes, and each fix needs an owner, a decision on whether the measure is reasonable and appropriate, and evidence that it works. Open items from an earlier assessment or an OCR inquiry add scope. Separate the cost of the assessment from the cost of remediation in any quote, and ask which fixes are your team's work and which the partner will carry out.

How a HIPAA consultant engagement moves from scoping to evidence

The sequence turns a written scope into a documented Security Rule program in which the covered entity or business associate owns every decision, every control and every piece of evidence it will show an assessor or OCR.

Agree scope and a written statement of work
The consultant and the organization define which entities, facilities, systems and business associates fall inside the engagement, who owns each deliverable, and what the organization must provide. The security official, a named internal sponsor, and any PHI access the consultant needs are settled here. Ask for a quote built from this written scope, with each phase listed separately so you can see what is one-time work and what recurs. The step is done when both parties have signed a statement of work that names the outputs of every later phase.
Map assets and where ePHI lives
Your team and the consultant inventory systems, applications, endpoints, removable media, backups, cloud accounts and vendors that create, receive, maintain or transmit electronic protected health information. The work turns on interviews, system owners and data flow diagrams, and it should cover business associates and subcontractors as well as internal systems. Confirm the consultant's access to PHI is limited to what this mapping requires and is covered by a business associate agreement where the law applies. The output is a current asset and data flow inventory that the risk analysis can reference.
Complete the risk analysis
The organization performs its accurate and thorough assessment of risks and vulnerabilities to ePHI, using the free HHS Security Risk Assessment Tool or an equivalent method that the entity can explain and repeat. The consultant facilitates the work, but the organization decides likelihood, impact and the risk ratings it accepts. Each finding is tied to a specific asset and standard. The step is complete when the analysis is signed, dated and approved by the security official, and the organization can show how it arrived at each rating.
Build the risk management plan and gap remediation
The organization selects security measures that reduce identified risks to a reasonable and appropriate level, taking into account its size, complexity, infrastructure and costs. Each required implementation specification is implemented, and each addressable one is assessed, implemented, or documented with the reason it is not reasonable and appropriate along with any equivalent alternative measure. Technical work, such as configuration, access reviews or encryption, is performed by the team or a delivery partner under the agreed scope. The output is a risk management plan with owners, status and evidence for each remediated item.
Draft policies, procedures and documentation
The consultant drafts written policies and procedures for each Security Rule requirement under 45 CFR 164.316, using the organization's actual systems and roles rather than generic templates. The organization reviews, edits and approves each document, sets review dates, and records who approved it. Documentation must be retained for six years, be available to the people who need it, and be updated as operations change. The step is complete when every policy maps to a standard or specification and carries an approval record.
Collect and organize evidence
The organization gathers records that show each safeguard operates in practice, such as access review logs, training completion records, audit log samples, backup restore tests, incident tickets and business associate agreements. The consultant helps define what evidence each control should produce and how it is stored and dated. Evidence is only useful if the organization can produce it on request, so the test is whether a staff member can retrieve it without reconstruction. The output is an evidence index linking each safeguard to its artifacts and their owners.
Hand over the program and assign ongoing ownership
The consultant walks the security official and control owners through the documents, the evidence index and the open items, and confirms who will run each recurring activity, such as risk analysis updates, training and periodic evaluation. Any ongoing support, testing or upgrade work is agreed separately as a retainer or new scope. The handover is complete when the organization can run the program without the consultant and has a list of open issues with owners. Remember that no consultant can issue a certification, and any outside evaluation is a separate engagement with an independent evaluator.

Who owns controls, who prepares evidence, and who reports

The covered entity or business associate remains legally responsible for Security Rule compliance, whatever help it hires. The organization must designate a security official, make the risk decisions that determine which safeguards are reasonable and appropriate, direct the workforce that operates those safeguards, and sign off on the policies, risk management plan and evidence that the organization relies on. An addressable specification that is not implemented still needs a documented decision made by the organization. Outside help can inform these decisions but cannot take them over.

Security official role: Name an individual in writing and define the duties, reporting line and time commitment. A consultant may support this role but the designation stays with the organization.
Risk decisions: Accept, reduce, transfer or avoid each identified risk, and document the reasoning for addressable specifications.
Workforce and access: Assign owners for user access, training, sanctions and termination steps, and confirm they happen.
Sign-off: Approve written policies, procedures and the risk management plan before they are relied on.
Ongoing operation: Review logs, incidents and changes after any consultant has left.

Before hiring help, confirm which of these duties your own staff will hold and who signs each document.

Why no consultant can certify your HIPAA compliance

No consultant can certify your HIPAA Security Rule compliance, and HHS says so directly: no Security Rule standard requires an entity to certify compliance, and HHS does not endorse or otherwise recognize private organizations' certifications. HHS also states that such certifications do not prevent it from later finding a violation. A consultant's badge, seal or report therefore does not shield your organization from enforcement. Before you buy any engagement described as a "HIPAA certification," ask the provider which Security Rule standards it tests, against which evidence, and in whose name the conclusion is issued. Those answers tell you what you are actually purchasing.

HHS does allow the required evaluation to be performed internally or by an external organization that offers evaluation or certification services. That is the role a consultant plays: the findings feed your evaluation under 45 CFR 164.308(a)(8), and the covered entity or business associate remains the party that decides whether its safeguards are reasonable and appropriate. Treat the deliverable as evaluation input. Your team should own the conclusions, sign off on accepted risks and document why each addressable specification was handled as it was. Confirm in the statement of work that the consultant's report is a working document for your evaluation, not a statement of legal compliance.

The practical test is what happens when OCR asks questions. Recent resolution agreements show that enforcement looks at the specifics: the risk analysis, the risk management plan, the policies and the records that show they were followed. The Ambry Genetics settlement, announced in September 2026, carried a $700,000 payment and a multi-year corrective action plan, and the MMG Fusion settlement from March 2026 carried a $10,000 payment and a similar plan. A consultant who delivers polished documents without traceable evidence leaves you exposed. Ask for a list of the artifacts that will exist on day one and who will maintain them after the engagement ends.

What to have in place before a consultant starts

A consultant can scope and price HIPAA Security Rule work only when the entity can show who is accountable, where ePHI lives, what exists already and who touches it. Checking these six items internally before requesting quotes shortens scoping and makes fixed-scope proposals more accurate.

A named security official

Confirm that one workforce member holds the HIPAA security official role and that the responsibilities are written down. Under 45 CFR 164.308(a)(2), the entity must identify this person, so a consultant needs to know who approves scope, receives findings and signs off on risk decisions. If the role is held by an outside party, check whether that person has a documented mandate and access to the systems in scope. Ask the consultant to confirm that the entity keeps accountability for the role.

An inventory of ePHI locations

List every system that creates, receives, maintains or transmits electronic protected health information, including EHR platforms, billing tools, email, file shares, laptops, mobile devices, backups and cloud accounts. Note the owner and hosting location for each. A consultant prices the work by counting systems and data flows, so an incomplete inventory is the most common reason quotes change after kickoff. Mark any system whose ePHI status is unknown and treat it as in scope until it is ruled out.

An existing risk analysis

Gather the most recent risk analysis, its date, its method and the risk management plan that followed it. If none exists, say so, because a first analysis is scoped differently from an update. Check whether the document covers the systems in your inventory and whether its findings were tracked to closure. Consultants use this record to avoid repeating work and to see which risks were accepted, mitigated or left open, which affects both effort and the questions they ask.

A list of business associates and agreements

Prepare a list of every vendor, subcontractor and service provider that creates, receives, maintains or transmits ePHI for you, with the signed business associate agreement or equivalent contract for each. Check whether each agreement contains the terms required by 45 CFR 164.314 and whether any vendor has been missed. Consultants will review these contracts as part of the assessment, and gaps found late often expand scope and timelines.

Access and logging sources

Identify where user access, authentication and audit records come from: identity provider, directory service, EHR audit logs, firewall and VPN logs, endpoint management and cloud provider logs. Confirm how long each source retains records and who can read them. Consultants need this to test access control and audit controls and to judge whether logs could support an investigation. Missing or short-retained logs are a finding in themselves, so record the gaps before the engagement starts.

An executive sponsor with decision rights

Name an executive who can approve scope, release budget, accept residual risk and settle disputes between IT, clinical and operations teams. Without this person, fixed-scope work stalls when a finding needs a business decision. Confirm the sponsor's availability for kickoff and the review points agreed in the written scope. The sponsor also receives the remediation plan, which keeps the organization, not the consultant, responsible for the decisions the program records.

Which HHS resources are free before you pay anyone

A small practice with a handful of workstations and one electronic health record is the audience the HHS Security Risk Assessment Tool was built for. It is free, it walks you through the administrative, physical and technical safeguard questions, and it helps you record the answers in one place. It is a worksheet, not an assessment. Someone at the practice still has to answer each question honestly, decide how each risk is rated and write the risk management plan.

What it covers: A structured set of questions tied to the Security Rule safeguards, so you can see which areas you have not yet considered.
What it does not do: It does not scan your systems, test whether a control works or judge whether your answers are accurate.
Who must act: The practice owns the risk analysis and must document it, even if a consultant helped you complete the tool.
Where it helps most: Mapping where ePHI lives, including the EHR, billing software, email, mobile devices and backups.
Where it stops: Choosing and implementing fixes, such as encryption or multi-factor authentication, still requires your own team or a vendor.

Before paying anyone, check that your answers reflect how your practice actually works today, not how your policies say it should work.

What enforcement costs look like when controls fail

The most concrete cost of weak Security Rule controls is an enforcement action, and the figures OCR has recently settled for show how wide the range is. In September 2026, OCR settled its investigation of Ambry Genetics following a phishing attack for $700,000, with a multi-year corrective action plan. In March 2026, OCR settled its investigation of MMG Fusion for $10,000, and OCR considered the company's financial condition in setting that amount. The gap between the two shows that the outcome depends on the facts of each case, including what the organization had in place before the incident and how it responded. Neither settlement is a benchmark you can budget against, and the settlement amounts are not prices for any service. Read the HHS press release on the Ambry Genetics settlement for the specific failures OCR cited.

The financial exposure is a separate question from the settlement itself. Under 45 CFR 102.3, as adjusted for penalties assessed on or after January 28, 2026, the civil money penalty runs from $145 per violation where the entity did not know of the violation, up to $2,190,294 per violation for uncorrected willful neglect, with a calendar-year cap of $2,190,294 for identical violations. Because penalties are assessed per violation, the number of uncorrected gaps matters as much as their severity. Ask your leadership to confirm which of your current Security Rule gaps would be counted as separate violations, and whether any known gap is being left open for lack of budget, since that choice is what moves an entity toward the higher tiers.

A resolution agreement generally binds the entity to obligations and reports to HHS for three years, during which HHS monitors compliance. That monitoring period, and the corrective action plan that comes with it, is where most of the recurring cost lands: policy rewrites, retraining, independent reviews, risk analysis updates and documented evidence delivered on a schedule. An entity that could have funded that work before an incident pays for it again under obligation and on OCR's timetable. When you evaluate a consultant or implementation partner, treat the three-year obligation as the comparison point, and ask for the work to be scoped so that evidence exists before any regulator asks for it.

How to choose a HIPAA consultant and what to ask before signing

A consultant can prepare your Security Rule program, but it cannot certify it and it cannot take over your accountability. The cards below cover the checks that separate a useful engagement from a policy binder. Use them to write your scope, your contract and your shortlist questions.

Written scope and deliverables

Ask for a statement of work that lists each deliverable by name, such as a risk analysis report, a risk management plan, a policy set mapped to the standards in 45 CFR 164.308, 164.310, 164.312, 164.314 and 164.316, and a training record. Each deliverable should have an owner on both sides and a defined acceptance step. Scope that says only "HIPAA readiness" leaves the cost and the finish line undefined, so the quote cannot be compared with others.

Business associate agreement before PHI access

If the partner will see, store or transmit ePHI, including screenshots, logs or sample records taken during an assessment, it is a business associate and needs a business associate agreement before access starts. Confirm whether the agreement covers subcontractors and how incidents at the partner are reported to you. Ask for the signed agreement in the contract file, not a promise to sign later.

Evidence, not only policy templates

Templates describe what you intend to do. Ask the partner to show what evidence it will produce for each safeguard, such as access review records, audit log samples, backup restore tests and training completion reports. For example, a partner that delivers a policy for audit controls but no log retention configuration or review record has delivered a document, not a safeguard. Request a sample of the evidence package before you sign.

No certification claims

Get written confirmation that the partner will not describe its work as a HIPAA certification or seal. HHS states that no Security Rule standard requires certification and that it does not recognize private certifications. A partner that promises a certificate, or that suggests a certificate stops OCR from finding a violation, is describing a risk to your organization. Ask how it will word its final report so that it matches what was actually tested.

Named staff and their roles

Ask for the names and roles of the people who will do the work, and whether they are the people you meet during the sales process. Check which tasks are performed by security engineers, which by compliance analysts, and who signs off on the risk analysis. Ask how staff with PHI access are screened and trained, and how the partner replaces a named person if one leaves mid-engagement.

Handling the proposed rule changes

The proposed Security Rule revision published on January 6, 2025 is not final, so ask how the partner will track it and what it will change in your scope if it is finalized. A strong answer names the specific proposals it would watch, such as the proposed encryption and multi-factor authentication requirements, and states whether the fixed-price work includes a re-assessment. Get that treatment in writing, because the final action date is still open.

HIPAA consultant cost and effort questions buyers ask

How much does a HIPAA compliance consultant cost?

No fixed price exists because the fee follows from the written scope, not from a HIPAA package. The main cost components are the risk analysis, policy and procedure writing, technical safeguard work on your systems, staff training, and evidence collection. Each is priced separately or as one fixed-scope engagement. Costs recur when you need ongoing monitoring, periodic risk analysis updates, policy reviews, or retainer support. Costs rise with the number of systems that hold ePHI, the number of sites and business associates, the maturity of your existing controls, and how much hands-on configuration you want the partner to perform. Ask any provider for a line-item quote tied to deliverables, the owner of each deliverable, what is one-time versus recurring, and whether business associate terms apply to their own staff who access PHI.

Can we do HIPAA compliance ourselves with the free HHS tool?

Yes, many organizations do the core work internally, and the HHS Security Risk Assessment Tool is free and aimed at small and medium-sized practices and business associates. The Security Rule is technology neutral and scalable, so an entity may choose measures that fit its size, complexity, capabilities, infrastructure and risk. The tool helps structure the risk analysis, but it does not configure systems, write your policies for your environment, or produce evidence on its own. Internal teams should confirm they can cover the 18 standards and 36 implementation specifications, document why any addressable specification is not implemented, and keep documentation for six years. The question to answer honestly is whether your staff has the time, security knowledge and access to systems to do this work and keep it current.

How long does HIPAA compliance work take, and what drives the timeline?

Duration depends on the scope and starting point, so ask for a timeline in the written scope rather than relying on a generic estimate. The main drivers are how many systems and locations hold ePHI, how complete your current inventory is, whether a risk analysis already exists, how many policies must be written or revised, how many technical changes are needed (such as encryption, access control or audit logging), and how quickly your staff can review and approve decisions. Business associate agreement negotiations and vendor responses often set the pace, as do training schedules and the availability of system owners for testing. Ask providers which dependencies they assume from your side and what happens to the schedule if those dependencies slip.

What does the work need from our staff?

Your staff keeps decision-making authority and supplies the facts that a consultant cannot know on their own. The Security Rule requires the entity to designate a security official, and that role's responsibilities must be documented. Typical needs include a named owner for each system, access to asset inventories, network and cloud configuration, identity and access records, backup and incident procedures, and time for interviews and sign-off. Engineers will usually be asked to test changes and confirm that logs and controls operate. Leadership must approve risk decisions, the risk management plan and any addressable specification that is not implemented. Ask the partner to list these inputs in the scope so that effort on both sides is visible before work starts.

Does hiring a consultant make us HIPAA compliant?

No. Compliance is an obligation that the covered entity or business associate meets and remains accountable for, and a consultant cannot take that legal responsibility away. A consultant can help identify gaps, prepare the risk analysis, draft policies, implement or configure safeguards, and assemble evidence. HHS does not certify organizations, and the Office for Civil Rights can still investigate and find a violation after any outside review. The entity must still make the decisions, operate the controls, train its workforce and respond to incidents. Use a consultant to shorten the work and improve its quality, and keep internal ownership of the outcomes.

Do we need a consultant if a customer asks for HIPAA certification?

You may not need a consultant for that reason alone, because there is no HIPAA certification that HHS recognizes. HHS states that no Security Rule standard requires an entity to certify compliance, and it does not endorse or recognize private organizations' certifications. A customer may still ask for a written attestation, a third-party assessment report, or evidence that maps to the Security Rule. Before you buy any outside work, ask the customer exactly what document they need, who must issue it, and whether they accept an internal assessment. If they require an independent report, an independent assessor or certification body must issue it, and a consultant can prepare the evidence but cannot issue the report.

What happens to our work if the proposed Security Rule changes are finalized?

The work you complete now still applies, because the proposed revision would strengthen existing expectations rather than replace the risk analysis and safeguard structure. HHS proposed the major revision on January 6, 2025 (90 FR 898), and as of October 2026 no final rule has been published. The effect on your effort will depend on which proposals are adopted and when, so ask any consultant how their deliverables would be updated and whether updates are included in the fixed scope or a retainer. Ask them to design risk analysis and evidence processes that can be reviewed annually, and to state which change in the final rule would trigger new work and who pays for it.

How DeployOpen scopes HIPAA Security Rule readiness work

DeployOpen is a Chainscore Labs company. We plan, implement, harden and document self-hosted open-source platforms inside the client's own infrastructure, whether that is the client's cloud accounts, data center or air-gapped network, and we prepare systems and evidence for compliance assessments. For HIPAA Security Rule work, that means the technical side of the program: configuring access control, audit logging, backup and recovery, and transmission security on the platforms that hold ePHI, and collecting the records that show those safeguards operate. Ownership of the program stays with the covered entity or business associate, including the security official role, the risk analysis and every decision about accepted risk.

Most engagements are fixed-scope. Before any work starts, we agree in writing which systems, environments, safeguards and deliverables are included, what the client must provide (for example, system inventories, existing policies and named owners for each platform), and what is out of scope. Pricing is not published as a list. A quote follows from that written scope, so the variables that move the number are visible to the client before signing: the number of systems, the depth of hardening, the volume of documentation and the amount of evidence collection. Ask any provider, including us, to show how each cost line maps to a scope item.

DeployOpen does not issue HIPAA audit reports, attestations or certifications, and no HIPAA certification exists to be issued. Independent assessors and OCR can examine what we prepared, and we do not guarantee any assessment result, enforcement outcome or regulatory position. Before you engage us or any other firm, confirm in writing what the firm will deliver, who will own each record after the engagement ends, and whether the firm will sign a business associate agreement if it will access ePHI during the work.

What a HIPAA compliance consultant does and what it costs