HIPAA compliance consulting is the work of helping a covered entity or a business associate meet the HIPAA Privacy, Security, and Breach Notification Rules and prove it with documented evidence. The word “prove” matters, because HIPAA has no certificate to buy and no seal that settles the question. Compliance is shown through a risk analysis that is current, policies that match practice, signed agreements with vendors, trained staff, and a breach process that has been tested. A consultant’s value is in producing and maintaining that evidence, and the quality of the work is easy to judge once you know what it should contain.
This guide explains what HIPAA compliance consulting covers, who needs it, why the risk analysis sits at the center, how an engagement runs, what a consultant can and cannot claim, and how to compare providers. It closes with the status of the proposed Security Rule update, because many buyers ask whether to wait for it.
What HIPAA Compliance Consulting Covers
The three HIPAA rules each create different work. The Privacy Rule governs how protected health information can be used and disclosed, the Security Rule requires safeguards for electronic protected health information, and the Breach Notification Rule sets what must happen when that information is exposed. A consulting engagement turns those rules into a set of deliverables.
| Workstream | What it produces | Rule it serves |
|---|---|---|
| Risk analysis | A documented assessment of the risks to electronic protected health information across systems, people, and vendors | Security Rule |
| Risk management plan | A prioritized treatment plan with owners and dates | Security Rule |
| Policies and procedures | Written policies for administrative, physical, and technical safeguards, and for privacy practices | Privacy and Security Rules |
| Business associate management | An inventory of vendors with access to protected health information and signed business associate agreements | Privacy and Security Rules |
| Workforce training | Training content, completion records, and a sanction policy | Privacy and Security Rules |
| Incident response and breach assessment | A tested response procedure and a method for deciding whether an incident is a reportable breach | Breach Notification Rule |
| Audit and investigation readiness | Evidence staged so the organization can answer a regulator’s request | All three |
The table shows why a proposal that lists only “policies” or only “an assessment” is incomplete. The workstreams depend on each other: the risk analysis decides which safeguards matter most, the plan assigns the work, and the policies, agreements, training, and incident process are how the plan becomes operational. Elevate’s HIPAA services cover the gap analysis against all three rules and the required risk analysis.
Who Needs HIPAA Compliance Consulting
HIPAA applies to two groups. Covered entities are health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions. Business associates are the vendors and partners that create, receive, maintain, or transmit protected health information on a covered entity’s behalf. Since the 2013 Omnibus Rule, business associates are directly liable for compliance with the Security Rule and parts of the Privacy and Breach Notification Rules, and their subcontractors are covered as well. That second group is where most of the new demand comes from.
| Organization | Role | What usually starts the search |
|---|---|---|
| Clinic, practice, or hospital | Covered entity | An OCR inquiry, a breach, or a risk analysis that has not been updated in years |
| Health plan or insurer | Covered entity | A regulator or program audit, or a vendor program that needs oversight |
| Software vendor that handles patient data | Business associate | A first healthcare customer asks for a signed agreement and a security review |
| Billing, claims, or revenue cycle company | Business associate | A contract renewal or customer due diligence |
| Cloud, hosting, or IT provider with access to patient data | Business associate or subcontractor | A downstream agreement that flows HIPAA duties to them |
| Digital health startup | Often both roles | Fundraising diligence, or a pilot with a health system |
The table shows two patterns. Covered entities usually come to consulting after an event, such as an inquiry or an incident. Business associates usually come before one, because a customer’s security questionnaire turns HIPAA from a legal duty into a sales requirement. For that second group, ISO 27001, HITRUST and SOC 2: What Are the Differences? helps place HIPAA beside the other assurance reports buyers ask for, and the guide to answering security questionnaires covers the sales side. Organizations in the CMS Enhanced Direct Enrollment program follow program-specific requirements in addition to HIPAA, which Elevate covers in its CMS EDE service.
The Risk Analysis Is the Center of the Work
The Security Rule requires every covered entity and business associate to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information, and to manage those risks with a documented process. Everything else in a HIPAA program depends on it. According to published analyses of OCR enforcement, the lack of a sufficient risk analysis is the deficiency cited most often in investigations, so a consultant that treats it as one deliverable among many is misreading where the exposure sits.
What a Defensible Risk Analysis Contains
A risk analysis that stands up to review has six parts. It starts with an inventory of where electronic protected health information lives, including systems, devices, backups, and the vendors that hold it. It identifies the threats and vulnerabilities for each location, records the controls already in place, and rates the likelihood and impact of each risk. It produces a ranked list of risks, and it is documented well enough that someone else can follow how each rating was reached. Finally, it is reviewed and updated when the environment changes, such as a new system, a new vendor, or an incident. The HIPAA compliance audit guide explains how the audit pairs with this analysis.
Where Risk Analyses Fail
Four failures recur. The scope covers the electronic health record and nothing else, which leaves email, cloud storage, mobile devices, and vendors outside the analysis. The document is a checklist of yes and no answers with no ratings or reasoning. It was done once and never updated. Or it exists but has no link to a treatment plan, so identified risks have no owner and no date. A consultant should be able to show how its analysis avoids each of these.
Recognized Security Practices
A 2021 amendment to the HITECH Act directs HHS to consider whether an organization has had recognized security practices in place for the previous twelve months when it determines penalties or audit outcomes. Frameworks such as the NIST Cybersecurity Framework can serve as recognized practices. The practical consequence is that a program built around a recognized framework and documented over time can reduce the severity of an outcome after an incident. A consultant can help select the practices and keep the evidence of them, and Elevate’s risk assessment service is where that work usually starts. Penetration testing is not a substitute for the risk analysis, though it can feed it, as explained in HIPAA Penetration Testing.
How a HIPAA Compliance Consulting Engagement Runs
A complete engagement follows a sequence. Knowing it helps a buyer judge whether a proposal covers the whole path or only the first half.
Step 1: Confirm Roles and Scope
The engagement starts by deciding whether the organization is a covered entity, a business associate, or both, and which systems, locations, and workflows touch protected health information. Many organizations discover that the scope is wider than they assumed, because data reaches email, shared drives, analytics tools, and vendors that nobody listed.
Step 2: Map Where Protected Health Information Lives and Moves
The consultant builds an inventory of systems and a data flow map that shows how information enters, moves, and leaves the organization. This is the foundation for the risk analysis, and it is also where business associate gaps show up, such as a vendor that holds patient data without a signed agreement.
Step 3: Run the Risk Analysis
Using the inventory, the consultant identifies threats and vulnerabilities, records the existing controls, and rates each risk. The output is a risk register in which every item has a rating and the reasoning behind it.
Step 4: Review Policies and Safeguards Against the Rules
The consultant compares existing policies, procedures, and technical controls with the Privacy, Security, and Breach Notification Rule requirements and lists the gaps. Documents that describe a practice the organization does not follow are a finding in their own right.
Step 5: Build the Plan and Support Remediation
Findings become a prioritized risk management plan with owners and dates. Providers differ most at this step. Some hand over the plan and leave, while others help write policies, execute business associate agreements, deliver workforce training, and set up the incident and breach process. The first costs less, and the second is what moves a first-time organization to completion.
Step 6: Assemble the Evidence and Set the Review Cycle
The engagement closes with an evidence package that a regulator or customer could request, and a calendar for reviewing the risk analysis, training, and vendor agreements. HIPAA compliance is a continuing obligation, so a plan for the next review is part of the deliverable.
What You Should Receive
A complete engagement should leave the organization with the following, and a proposal should name each item:
- A role and scope statement for covered entity and business associate duties
- A system inventory and data flow map
- A documented risk analysis with ratings and reasoning
- A risk management plan with owners and dates
- Updated policies and procedures, executed business associate agreements, and training records
- A breach assessment procedure and an incident response plan
- An evidence package and a review calendar
HIPAA Has No Certification: What a Consultant Can and Cannot Claim
The most common misunderstanding in this market is the idea that an organization can become “HIPAA certified.” There is no government-recognized HIPAA certification, and the Department of Health and Human Services does not endorse private certification programs. A consultant or software vendor that sells a “HIPAA certified” badge is selling its own opinion, which may be useful as a training record but does not protect the organization in an investigation. What exists are other assurance frameworks that cover much of the same ground and that buyers do ask for.
| What buyers call it | What it actually is | Who issues it |
|---|---|---|
| “HIPAA certified” | A marketing claim with no government recognition | No official issuer |
| HITRUST certification | A private framework that incorporates HIPAA requirements, with e1, i1, and r2 levels | HITRUST, after validation by an authorized external assessor |
| SOC 2 report | An examination of controls against the Trust Services Criteria, which can be scoped to include health data safeguards | A licensed CPA firm |
| ISO 27001 certificate | A certification of an information security management system | An accredited certification body |
The table matters for two reasons. First, none of these replaces the HIPAA risk analysis, because HIPAA requires one regardless of which report an organization holds. Second, the choice among them depends on what customers ask for, not on what HIPAA requires. A health system may ask a vendor for HITRUST, while a software buyer may accept a SOC 2. Elevate’s HITRUST service and the guide to what drives HITRUST certification cost cover that route.
The same line applies to the consultant. Elevate prepares organizations for assessments and does not issue certifications or determine legal compliance. A consultant can say that a program meets the requirements it has reviewed against, and it should say plainly that only a regulator decides whether an organization is compliant.
How to Choose a HIPAA Compliance Consultant
The HIPAA consulting market runs from firms that sell a template packet to firms that manage a program for years, and the names on their proposals look alike. The scorecard lists the questions that separate them.
| Question | Strong answer | Weak answer |
|---|---|---|
| Is the risk analysis a named deliverable? | Yes, with ratings, reasoning, and an update schedule | An “assessment” described as a checklist |
| Does it cover vendors and business associates? | Inventory of vendors with access to protected health information, and agreements reviewed | Internal systems only |
| Who does the work? | A named team with healthcare and security experience | The team is not named until after signing |
| Does the provider help remediate? | Hands-on support for policies, agreements, training, and the incident process, or a clear split of duties | A report and nothing after it |
| What does it claim? | Prepares you and says there is no HIPAA certification | Sells a “HIPAA certified” badge |
| Does it cover breach response? | A procedure and a test of it | A policy document only |
| How does it treat legal questions? | Flags them and says when to involve counsel | Gives legal conclusions |
| What happens after the first engagement? | An annual review cycle and support for changes | The engagement ends at delivery |
The weak answers share a pattern. They produce a document that looks complete and does not change how the organization operates. For a buyer who is also a business associate, the second test is whether the output will satisfy the customer who asked for it, which is why the evidence package matters as much as the risk analysis itself.
What Drives the Cost
Cost follows scope and not a fixed rate. The main drivers are the number of systems, locations, and vendors in scope, how mature the existing documentation is, whether the risk analysis includes technical testing, how much remediation the provider performs and how much the team performs, and whether the engagement is a single project or an annual program. A scoped proposal that lists deliverables is the reliable way to get a figure, and any quote offered before the provider has seen the environment should be treated with caution. For the broader question of choosing a partner across frameworks, see Cybersecurity Compliance Consulting: How to Choose the Right Firm.
What Is Changing: The Proposed Security Rule Update
Many buyers ask whether they should wait for the new rules. The status is clear. HHS announced a proposed update to the HIPAA Security Rule on December 27, 2024, and published it in the Federal Register on January 6, 2025. The comment period closed on March 7, 2025. As of October 2026 no final rule has been published, the regulatory agenda now lists final action for July 2027, and that date is not binding. The current Security Rule remains in force and OCR continues to enforce it.
The proposal would be the first major overhaul of the rule in more than a decade. According to HHS’s summary and published analyses, it would remove the distinction between required and addressable safeguards, require measures such as multi-factor authentication and encryption, and add a written asset inventory and network map, regular vulnerability scanning, annual penetration testing, and a restoration time objective. It is disputed, and whether it is finalized as proposed, narrowed, delayed, or withdrawn is not known.
The practical advice does not depend on the outcome. The risk analysis, the vendor agreements, the training, and the breach process are required today, and many of the proposed measures describe what reasonable security looks like in any case. A consultant should build the program to the current rule, track the proposal, and say plainly which items are proposed and which are required. Elevate follows related developments in its coverage of the Health Care Cybersecurity and Resiliency Act.
Conclusion
HIPAA compliance consulting is worth buying when it produces evidence that holds up: a risk analysis with ratings and reasoning, a plan with owners, agreements with every vendor that touches patient data, trained staff, and a breach process that has been tested. It is not worth buying as a badge, because no badge exists. The questions that separate good providers from weak ones are about deliverables, vendor coverage, hands-on remediation, and honesty about what a consultant can claim.
The proposed Security Rule update does not change the order of work. Build to the current rule, track the proposal, and treat the review cycle as part of the program. Elevate prepares healthcare organizations and their business associates for audits and regulatory review and does not issue certifications. To see where your program stands, book a readiness call with an Elevate advisor.
Key Takeaways
HIPAA compliance consulting is the work of building and maintaining the evidence that a covered entity or business associate meets the Privacy, Security, and Breach Notification Rules.
- The risk analysis is the center. It is a Security Rule requirement, a common enforcement finding, and the document every other workstream depends on.
- There is no HIPAA certification. Treat any “HIPAA certified” claim as marketing, and use HITRUST, SOC 2, or ISO 27001 only when a customer asks for them.
- Business associates are directly liable. Software, billing, and IT vendors that handle patient data need the same program, usually after a customer’s security review forces the question.
- Compare proposals on deliverables. A named risk analysis, vendor coverage, hands-on remediation, breach response, and an annual review cycle separate complete engagements from template packets.
- The Security Rule update is proposed, not final. The current rule is in force, and a consultant should build to it while tracking the proposal.
- Legal questions belong with counsel. A consultant prepares the evidence and flags legal issues, and a regulator decides whether an organization is compliant.
Frequently Asked Questions
What does HIPAA compliance consulting include?
HIPAA compliance consulting includes a risk analysis, a risk management plan, updated policies and procedures, an inventory of vendors with business associate agreements, workforce training, an incident and breach assessment process, and evidence staged for an audit or investigation. The work is organized around the HIPAA Privacy, Security, and Breach Notification Rules. A complete engagement also sets a review cycle so the program stays current after the first delivery.
Is there a HIPAA certification?
No. There is no government-recognized HIPAA certification, and the Department of Health and Human Services does not endorse private certification programs. Providers that sell a “HIPAA certified” badge are selling their own assessment, which does not protect an organization in an investigation. Frameworks such as HITRUST, SOC 2, and ISO 27001 cover related ground and are requested by some customers, but none replaces the HIPAA risk analysis.
Do business associates need HIPAA compliance consulting?
Business associates are directly liable for compliance with the Security Rule and parts of the Privacy and Breach Notification Rules, so they need the same program as a covered entity for the data they handle. Software, billing, and IT vendors usually start after a customer asks for a signed agreement and a security review. A consultant helps them build the risk analysis and evidence that the review will request, and an Elevate advisor can scope that work.
How often should a HIPAA risk analysis be updated?
The Security Rule requires the risk analysis to be a continuing process that is reviewed and updated as the environment changes, and it does not set a fixed interval. Many organizations review it at least once a year and again after any significant change, such as a new system, a new vendor, or a security incident. The proposed Security Rule update would make an annual review explicit, but it is not final.
Should we wait for the new HIPAA Security Rule before hiring a consultant?
No. The proposed update is not final, the regulatory agenda lists final action for July 2027, and the current rule remains in force and enforced. The risk analysis, agreements, training, and breach process are required today. A consultant can build the program to the current rule and align it with the proposal, which many security leaders already treat as a statement of reasonable practice.