What a third-party HIPAA assessment proves, and what it does not
A customer, contract or board asks you to prove HIPAA Security Rule compliance. The honest answer starts with this: there is no HIPAA certification. HHS states that no Security Rule standard requires an entity to certify compliance and that it does not endorse or recognize private certifications. An outside assessment can support the evaluation that 45 CFR 164.308(a)(8) requires you to perform, but it cannot make your organization compliant, and it cannot bind the HHS Office for Civil Rights (OCR), which may still find a violation after a clean report. Any vendor or consultant who sells a HIPAA certificate is selling something HHS does not recognize.
The value of an outside evaluation depends on four things you decide before the work starts: the scope (which systems, facilities, workforce and business associates are in it), the evaluator's independence (an outside firm that did not design the controls it is judging), the quality of the evidence (current risk analysis, dated policies, access reviews, audit log samples and remediation records), and how you act on the findings. Ask for the scope and the evaluator's independence in writing. Ask whether the report names the standards and implementation specifications it tested and which ones it did not.
Roles need to stay clear. Your organization owns its safeguards and remains accountable for them. An implementation partner such as DeployOpen can prepare self-hosted systems, document controls and assemble evidence for the evaluation. Only an independent auditor or assessor issues a report, and that report describes what was tested at a point in time, not a guarantee of future compliance. Confirm with your evaluator exactly what the deliverable will say, and confirm with counsel how you will describe it to customers so the wording does not imply a certification.
Which external evaluators can help, and what each can show
An independent technical assessor tests whether the safeguards you have actually work. Typical work includes a penetration test of exposed systems, a configuration review of servers and cloud accounts, a check of access controls and logging, and a sample-based review of how a control operates in practice. The output is a findings report with severity ratings, evidence of what was tested and how, and a remediation list. This is useful input to the evaluation standard in 45 CFR 164.308(a)(8), which requires a periodic technical and nontechnical evaluation.
- What it produces: test results, evidence of scope and method, and prioritized findings for your risk management plan.
- What it cannot establish: that every standard and implementation specification is met, since a technical test covers only the systems and controls in scope.
- What it cannot establish about policy: whether written policies, workforce training or business associate agreements are adequate.
- Independence: high, as long as the assessor did not build, configure or operate the systems under test. A firm that remediates its own findings is reviewing its own work.
- Recurring effort: retests after changes to systems, and re-review after environmental or operational changes.
Before engaging one, confirm in writing the systems in scope, the testing rules of engagement, who owns the findings, and whether the report is delivered to you alone.
A consultant helps build the documentation and analysis that the Security Rule requires you to own. This usually covers mapping where electronic protected health information (ePHI) lives, performing the risk analysis, drafting written policies and procedures, documenting how each addressable specification was assessed, and preparing evidence for the evaluation. The organization still makes the decisions and signs off on the results, because the obligations under 45 CFR 164.316 and the risk analysis standard sit with the covered entity or business associate.
- What it produces: a risk analysis, a risk management plan, policy drafts, and a gap assessment against the standards.
- What it cannot establish: that the controls described in the documents are running, or that the analysis is complete if the inventory of systems was incomplete.
- Independence: low for the work it creates. A consultant who wrote the policies and performed the analysis is reviewing its own output if it also performs the evaluation.
- Access to PHI: if the consultant reviews systems containing ePHI, it may need a business associate agreement with you.
- Recurring effort: updates when systems, vendors or risks change.
Ask for a named deliverable list, the methodology used for the risk analysis, and whether an independent party will evaluate the result.
Some firms offer a private HIPAA certificate or seal. Treat any such offer with caution. HHS states that no Security Rule standard requires an entity to certify compliance, and that HHS does not endorse or otherwise recognize private organizations' certifications. HHS also states that a third-party certification does not stop HHS from later finding a violation. A certificate can show that a firm reviewed some evidence on a given date. It does not establish legal compliance, and it does not protect you from an OCR investigation.
- What it produces: a document or seal issued by the firm, based on the scope and evidence it reviewed.
- What it cannot establish: HIPAA compliance, or any finding that binds HHS or OCR.
- Independence: variable. Check whether the firm also sells remediation, consulting or tools to the same client, since that creates a conflict.
- Marketing risk: using a certificate to imply government endorsement can mislead customers and regulators.
- Alternative evidence: a documented evaluation, recognized security practices in place for the prior 12 months, and records of risk management.
Ask the firm for its scope statement, its methodology, its conflict disclosures, and written confirmation that the document is not an HHS endorsement.
Why HHS does not recognize HIPAA certifications
HHS has said plainly that no Security Rule standard requires a covered entity or business associate to certify its compliance, and that HHS does not endorse or recognize certifications issued by private organizations. In its HHS FAQ from 2003, the agency adds two points that matter for procurement: a private certification does not relieve an entity of its legal obligations, and it does not stop HHS from later finding a Security Rule violation. A badge or letter from an outside firm is therefore evidence of an assessment that took place, not a legal safe harbor. The obligation to evaluate and document compliance stays with the entity itself.
Marketing often blurs this line. Vendors and consultants may describe a product, service or even an organization as "HIPAA certified" or "HIPAA compliant certified," and buyers may read that as an official status. Before accepting any such claim, ask for three things in writing: the exact scope of the assessment (which systems, facilities, locations and PHI flows were included and which were excluded), the methodology or evaluation standard used, and the name, firm and relevant credentials of the people who performed the evaluation. Confirm whether the issuer is independent of the firm that sold the remediation work. If the answer is vague, treat the document as marketing material.
Use the outside assessment for what it can show: an independent view of specific controls, tested at a specific point in time, against a stated method. It cannot show that the whole organization is compliant today, and it cannot replace the periodic evaluation the entity must perform after environmental or operational changes. Plan for that gap by keeping your own dated risk analysis, evaluation records and remediation tracking, so that when OCR asks what you did, you can show your work rather than pointing to a certificate.
How OCR's own audit program differs from a private assessment
OCR, the HHS office that enforces the Security Rule, uses its own tools to check compliance, and none of them are run by private certifiers. Each mechanism below tests something different, and a third-party assessment cannot stand in for any of them.
Complaint investigations
OCR opens an investigation when someone files a complaint about a possible HIPAA violation, including a breach or a missed safeguard. Investigators ask for the risk analysis, the written policies, and proof that the safeguards described in them were actually running at the time of the incident. A private assessment dated before the complaint shows what the entity believed about its controls, not what was in place when the event happened. Check that your evidence covers the period in question, not only the most recent review.
Compliance reviews
OCR opens a compliance review after a reported breach or a complaint, and reviews the entity's compliance with the specific provisions involved. The reviewer asks for documentation tied to those provisions, such as access logs, business associate agreements and evidence of training. An outside report can organize that material, but OCR will read the underlying records itself. Confirm that your assessor's workpapers identify the systems and dates they sampled.
HIPAA audit program reviews
OCR's audit program is run by HHS. The 2024 to 2025 round reviews 50 covered entities and business associates on the Security Rule provisions most relevant to hacking and ransomware. Auditors examine the risk analysis, risk management, access controls, audit controls and contingency planning, and they request evidence for each. No private certifier selects the audited entities or sets the findings. Ask your assessor which of these provisions their work covers and where it stops.
Technical safeguard evidence
Auditors test technical safeguards by asking for configurations and logs, not summaries. Expect requests for access control lists, audit log samples, encryption settings for data at rest and in transit, and authentication settings. A third-party assessor may confirm these settings at one point in time, but OCR can ask for proof that they were maintained across the review period. Keep exported configurations and change records so the evidence stays current.
Enforcement after a clean report
HHS states that a third-party certification does not stop it from later finding a Security Rule violation. OCR can open a complaint investigation or compliance review after an assessor has signed off, and penalties are set by the facts found at that time. For penalties assessed on or after January 28, 2026, the inflation-adjusted maximum is $2,190,294 per violation, with the same amount as the calendar-year cap for uncorrected willful neglect. Treat any private report as one input to your own risk management, not as a shield against that exposure.
What the proposed annual compliance audit would change
The January 6, 2025 proposed revision to the Security Rule, published at 90 FR 898 under RIN 0945-AA22, would add an annual compliance audit as a new standard, proposed as 45 CFR 164.308(a)(14). The proposal does not say whether the covered entity or business associate would perform that audit itself or whether an outside party would have to perform it. That gap matters for anyone weighing an external assessment, because the answer determines who is accountable for the result and what evidence an auditor would need to see. The proposal is not law. As of October 2026, no final rule had been published, and the latest Unified Agenda entry lists it under Long-Term Actions with final action projected for July 2027. Those dates come from the agenda and can move, so confirm the rule's status on the Federal Register and reginfo.gov before you commit budget to an audit cycle tied to it.
Plan around the requirement that applies today. The current rule does not require a certification or an annual audit by any named party. It requires a periodic technical and nontechnical evaluation, which can be performed internally or by an external organization. If the revision is finalized as proposed, you would need an annual audit cycle, a documented method for it, and clear ownership of findings. Practical preparation includes keeping current risk analysis and evaluation records, tracking remediation of open findings, and maintaining evidence that can be reproduced for a later review. Ask any outside assessor whether their scope and deliverables could support an annual cycle if the rule changes, and whether re-scoping would be billed separately. Those terms belong in the written scope before work starts, not after a final rule appears.
Treat the proposal as a reason to ask questions now, not as a reason to pre-buy a product. Confirm three things before committing budget: whether the final rule has been published, whether the audit provision survived comment review in unchanged form, and whether the final text names the performer. Budget items that depend on those answers, such as multi-year assessor contracts or an annual audit line, should carry a condition that they are reviewed when the rule's status changes. Organizations that already run documented evaluations and track findings to closure will need the smallest adjustment if the audit requirement is finalized.
How an outside HIPAA assessment runs from scoping to report
An outside HIPAA assessment moves from a written scope to evidence, evaluation, findings and an evaluator's report, and each step produces a record the entity can check. The sequence shows what the evaluator tested and where the entity's own responsibility continues.
Agree scope and ePHI systems in writing
The entity and the evaluator agree in writing which systems, facilities, vendors and workflows hold or transmit electronic protected health information, and which Security Rule standards the assessment covers. The entity owns the scope decision, since an assessment cannot test what was left out. Ask the evaluator to state the timeline, the named individuals, the sampling approach and what is excluded. The step is complete when both parties sign a scope document that lists each in-scope system and the evaluation criteria.
Sign the business associate terms before access
If the evaluator will view ePHI, screenshots, logs or configurations containing ePHI, the engagement needs a business associate agreement or equivalent terms before any data moves. The entity should confirm what the evaluator may access, where evidence is stored and how it is destroyed afterward. The output is a signed agreement and a short access plan that names the accounts and environments the evaluator will use.
Collect and prepare evidence
The entity's own staff, and any implementation partner it has retained, gather the records that show how safeguards operate: the current risk analysis, written policies and procedures, access reviews, training records, audit log samples, backup test results, incident logs and vendor agreements. Evidence should be dated, complete for the scoped period and free of ePHI where possible. The step ends with an index that maps each Security Rule requirement in scope to the document or system export that supports it.
Perform the technical and nontechnical evaluation
The evaluator reviews the evidence, interviews staff, observes controls and tests a sample of configurations and transactions against the scoped standards. This follows the evaluation standard in 45 CFR 164.308(a)(8), which asks for a periodic technical and nontechnical review of how well policies and procedures meet the rule. The output is working papers that show each test, the sample, the result and any exception. Ask for the test procedures in writing before fieldwork begins.
Document findings and agree remediation
The evaluator records each gap, weakness or unsupported claim against the specific Security Rule provision, and rates its effect on ePHI. The entity reviews the findings for factual accuracy, then decides on remediation, documents why it accepts any residual risk and sets owners and completion dates. Where a requirement is addressable, the entity records its reasoning and any equivalent alternative measure. The output is a findings register with a remediation plan the entity signs off.
Receive the evaluator's report and limits
The evaluator issues a written report describing the scope, method, evidence reviewed, findings and the period covered. A competent report states what it does not cover and does not claim that the entity is HIPAA compliant or certified. The entity should confirm that the report is its own record for the risk analysis and evaluation file, and it should not present it to customers as a certificate. The step closes when the report is delivered and retained under the entity's documentation policy.
What must be in place before an outside evaluation
An outside evaluator tests what you already have, so the gaps usually show up in the documents and records before anyone looks at a system. The six items below are the ones an evaluator will ask for first, and you can check each one yourself before the engagement starts.
A current risk analysis
The risk analysis is the starting point for the evaluation standard in 45 CFR 164.308(a)(8), which asks how far your policies and procedures meet the Security Rule. Check that the analysis covers every system that creates, receives, maintains or transmits ePHI, that it records likelihoods and impacts, and that it was updated after your last major change. An evaluator can confirm the analysis exists, but cannot confirm it is accurate for your environment. A dated analysis that predates recent system changes is a common finding.
Documented ePHI asset inventory
An inventory lists every application, database, endpoint, backup, cloud tenant and vendor connection that holds ePHI, along with its owner and data flows. Before the evaluator arrives, reconcile the inventory against your cloud accounts, directory, network diagrams and procurement records. An outside evaluator can sample items from the inventory, but cannot find systems you left off it. Shadow exports and spreadsheets copied from old projects are the usual gaps.
Written policies under 164.316
Section 164.316 requires written policies and procedures for each Security Rule requirement, and documentation that is kept current. Check that each policy names an owner, states the date it was approved and last reviewed, and matches what staff actually do. Evaluators read policies against practice, so a policy describing a control your team does not run will be recorded as a gap. Confirm that the documentation retention period you apply meets the six-year requirement in the rule.
Named security official
The Security Rule requires you to designate one individual as responsible for the security policies and procedures. Confirm that the designation is in writing, that the person has the authority and time to act, and that they can explain the risk analysis and current remediation plan without notes. An outside evaluator will interview this person, and a vague answer about ownership is difficult to resolve during fieldwork. If the role is fractional or outsourced, the written designation still has to name who holds the responsibility.
Business associate agreements on file
Each business associate that creates, receives, maintains or transmits ePHI for you needs a written agreement containing the Security Rule terms in 164.314. Build a register that lists every vendor, the services provided, whether PHI is involved, the agreement date and the review date. Evaluators commonly sample vendor files to test whether your third-party oversight works. Missing or expired agreements cannot be fixed by the evaluator's report, so resolve them first.
Record of prior evaluations
The evaluation standard expects periodic evaluations, both after the initial rule-based review and after environmental or operational changes. Keep a log that records the date, scope, evaluator (internal or external), findings, corrective actions and closure evidence for each past review. An outside evaluator will ask how earlier findings were handled, and a log showing open items with no closure dates signals weak oversight. Remember that the log documents your own evaluation program. It does not show that any certification was issued.
What an outside HIPAA assessment costs and who gets paid
This table separates the payees in an outside HIPAA assessment, from the independent evaluator to the implementation partner and internal staff, and marks which costs are one-time and which recur. Use it to structure requests for itemized quotes, since no researched fee figures apply and each quote should follow from written scope.
| Cost component | Who is paid, and for what | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Independent evaluator or auditor | The external organization that performs the evaluation or assessment and issues its own findings or report. It does not certify HIPAA compliance, since HHS does not recognize HIPAA certifications. | Usually recurring if repeated on the evaluation cycle; the first engagement carries more discovery work | Number of ePHI systems in scope, number of locations, number of third parties, and whether the evaluator tests technical controls or only documents |
| Implementation partner | The firm that prepares systems, policies, safeguard configurations and evidence before the evaluator arrives. It does not issue reports or attestations. | Mostly one-time for remediation and evidence build; smaller recurring support for maintenance | Gap between current controls and the Security Rule, age and complexity of the environment, and how much work the organization hands over |
| Internal staff time | Your own security official, IT, clinical and business owners who supply information, approve decisions and own each control. Staff time is an internal cost rather than an invoice. | Recurring, because the evaluation standard repeats after environmental or operational changes | Team size, documentation quality, how many business owners must sign off, and how current the risk analysis already is |
| Tooling and licenses | Vendors or open-source projects that support logging, access review, vulnerability scanning and backups. Open-source tools may carry no license fee but still need hosting and operator time. | Mix of one-time setup and recurring subscriptions or hosting | Choice between commercial and self-hosted tools, log retention needs, and the number of endpoints and systems monitored |
| Penetration or technical testing | A separate tester, if the outside assessment includes it. This is distinct from the evaluation the Security Rule requires and does not replace it. | Recurring, typically tied to environment changes or a chosen testing schedule | Attack surface, number of applications and APIs, and whether testing is scoped to ePHI systems only |
| Business associate and contract review | Counsel or the assessor reviews business associate agreements and subcontractor terms that affect what an outside party may access or prove. | One-time per contract, with updates when vendors or contracts change | Number of business associates, subcontractor depth, and whether a vendor's assurance reports cover the ePHI services used |
| Re-evaluation after change | Repeat work when systems, locations, vendors or operations change enough to require a new evaluation under the rule. | Recurring and event-driven | Frequency of major changes such as cloud migrations, mergers or new clinical systems |
Mistakes that make an outside assessment worth less
An outside assessment only carries weight when its scope, evaluator, evidence and purpose match what the Security Rule asks for. The mistakes below share one root cause: treating an external review as a document to hold rather than an evaluation to act on.
Buying a certificate instead of an evaluation
Some vendors sell a HIPAA certificate or seal. HHS does not endorse or recognize private Security Rule certifications, and a certificate does not relieve an entity of its legal obligations. The Security Rule asks for a periodic technical and nontechnical evaluation. Before signing, ask the provider to describe the evaluation method, the standards tested and the findings it expects to produce, and check that the deliverable is a findings report with remediation actions, not a badge.
Narrowing scope to exclude cloud and vendors
An assessment that covers the on-premises network but skips cloud workloads, SaaS platforms or business associate systems tests only part of the ePHI environment. Illustrative example: an assessor reviews the hospital data center but never examines the hosted billing platform where most patient records sit. Before engagement, map every system that creates, receives, maintains or transmits ePHI, and confirm in the written scope which business associates and subcontractors are covered.
Accepting evaluators with conflicts of interest
An evaluator who designed the controls being tested, or who also sells the remediation work, has a reason to pass findings it should flag. The Security Rule allows an external organization to perform the evaluation, but the value depends on independence and competence. Ask for written disclosure of prior work on the same environment, separate the team that builds controls from the team that tests them, and confirm the evaluator's qualifications for healthcare security.
Collecting evidence only for the review day
Controls that work only when the assessor is watching do not show ongoing compliance. Access reviews completed the week before fieldwork, or log reviews performed only on request, give a point-in-time snapshot. The evaluation standard expects re-evaluation after environmental or operational changes. Build evidence into routine operations, such as recurring access recertifications, log review records and change tickets, so the assessor sees how the controls run across the period, not just on one day.
Treating the report as a legal safe harbor
A clean third-party report does not prevent OCR from later investigating and finding a Security Rule violation. HHS has said certifications do not prevent a later violation finding. OCR's own audit program is run by HHS and examines compliance directly. Treat the report as one input to your risk analysis and remediation plan, and keep the underlying documentation, open findings and dated corrective actions available for regulator review.
Ignoring open findings after the report
An assessment creates value only when findings are tracked to closure. Reports that list gaps but have no owner, due date or verification step leave the same weaknesses in place. For addressable implementation specifications, the entity must document why a measure is not reasonable and appropriate and what equivalent alternative it uses. Assign each finding to a named owner, record the decision on addressable items, and retest closed findings before the next evaluation cycle.
Questions buyers ask before hiring an outside HIPAA assessor
Is there an official HIPAA certificate I can buy?
No. HHS states that no Security Rule standard requires an entity to certify compliance, and HHS does not endorse or recognize private organizations' certifications. Any document a vendor calls a HIPAA certificate is a private product, and it does not prevent HHS from later finding a violation. When a customer or contract asks for proof, ask for the evaluation report, its scope and the date it was performed, and what the evaluator reviewed. Those details show more than a logo or a badge does. The HHS FAQ from 2003 is the primary source on this point and is short enough to share with procurement teams.
Does an outside assessment satisfy 45 CFR 164.308(a)(8)?
It can, provided it performs the evaluation the standard describes. Section 164.308(a)(8) requires a periodic technical and nontechnical evaluation of how well security policies and procedures meet the Security Rule, and again after environmental or operational changes. HHS's FAQ says the evaluation can be done internally or by an external organization that provides evaluation services. The entity still owns the result. It must decide what the findings mean, fix gaps and keep records showing the evaluation happened. An outside report that only lists a score, without testing the policies, procedures and safeguards against the rule, will not meet the standard on its own.
How does a third-party assessment differ from an OCR audit?
An outside assessment is commissioned and paid for by the entity, and its purpose is internal evaluation and evidence. An OCR audit is run by HHS's Office for Civil Rights, not by private certifiers, and it carries enforcement consequences. The 2024 to 2025 audit round reviews 50 covered entities and business associates on Security Rule provisions most relevant to hacking and ransomware. Your assessor cannot tell OCR that you are compliant, and OCR is not bound by your assessor's conclusions. Treat the outside evaluation as preparation for an audit or complaint investigation, not as a substitute for either. Ask the assessor how its findings would look to an OCR reviewer.
Can we run the Security Rule evaluation ourselves?
Yes. The rule allows the evaluation to be internal, and many organizations perform it with their own security and compliance staff. An internal evaluation is still subject to the same test: it must measure policies, procedures and safeguards against the Security Rule and be repeated after significant changes. The main questions are independence and skill. Staff who run the systems they are judging may miss gaps they helped create, and an internal team needs time, clear criteria and documented results. Many organizations split the work, with staff doing the evaluation and an outside party reviewing the method or testing technical controls. The free HHS risk analysis tool and NIST SP 800-66 Rev. 2 can help structure the internal work.
What does the evaluation need from our staff?
It needs people who know where electronic protected health information lives and how it moves, plus people who can explain how policies are applied day to day. Expect requests for current policies and procedures, asset and data-flow records, access lists, training records, incident and contingency plans, business associate agreements, and configuration evidence such as audit log settings and encryption status. Staff who own those areas must answer questions and provide screenshots, exports or logs. Ask the assessor for a written evidence request list before work starts, and agree on who in your organization is the single point of contact. Time spent by these staff is often the largest internal cost, so ask for it in the quote.
How do we check that an outside evaluator is independent?
Ask who the evaluator is, who pays them, and whether they design or sell the controls they are assessing. An evaluator who installs your safeguards, then grades them, has a conflict that a reader of the report should know about. Request a written statement of prior work for your organization in the last few years, and confirm that the firm does not take a fee tied to the findings. Check whether the people doing the work are bound by a business associate agreement if they will access PHI, since that status is separate from independence but just as important. Keep the scope of implementation work and the scope of evaluation in separate statements of work where you can.
How much does an outside HIPAA evaluation cost, and what drives it?
No supplied source gives a price or duration for an outside Security Rule evaluation, so treat any number you see with caution and ask for a written scope. The main cost drivers are the number of systems and locations holding ePHI, the number of business associates, the maturity of existing documentation, whether technical testing is included, and how many evaluation cycles you need in a year. Costs are one-time for the first full evaluation and recur for each periodic or change-driven evaluation. Ask each bidder to itemize the work, name the deliverables, state what the report will and will not claim, and say which parts you must supply. DeployOpen does not publish a price list. A quote follows from a written scope.
Does a recognized security practices review change the picture?
It can influence how HHS treats an entity, but it does not replace the evaluation. Public Law 116-321, enacted January 5, 2021, added section 13412 to the HITECH Act. It requires HHS to consider whether an entity adequately demonstrated recognized security practices were in place for at least the previous 12 months when it decides fines, audit length and scope, or remedies. An outside evaluation can help document that practices were in place, but the entity must show the practices were actually followed. Ask the evaluator which recognized practices, if any, it tested and how it kept evidence over time. You can read the statute in the GovInfo copy of Public Law 116-321.
How DeployOpen prepares your systems and evidence for an outside review
DeployOpen is an implementation partner, not an assessor. We plan, implement, harden, document and support self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and we prepare the systems, controls and evidence that an outside evaluator will look at. We do not issue audit reports, attestations or certifications. Only an independent auditor or assessor can do that, and hiring DeployOpen does not guarantee an outcome of any review. Nothing in our work should be presented to a customer, regulator or board as a HIPAA certificate.
Engagements start with a written scope that names the systems holding electronic protected health information, the Security Rule evaluation you want supported, the roles that own each control, and the deliverables. Typical preparation covers configuration baselines for access control, audit logging and transmission security, documented policies and procedures under 45 CFR 164.316, and an evidence register that maps each artifact to the standard it supports. Before any outside evaluator sees the environment, we can run an internal check of the evidence against the scope so gaps surface while you still have time to fix them.
Your organization keeps ownership of the decisions. Your security official, not DeployOpen, must accept residual risk, approve the evaluation scope and decide what to do with findings. Ask any implementation partner to confirm in writing which deliverables they produce, who signs each one, and what they will not do, including whether they will have access to PHI and whether a business associate agreement is needed. Ask the independent evaluator, separately, what their evaluation covers and how they will report it.
