How to Choose a HIPAA Compliance Consultant

Imagine a consultant delivers a polished HIPAA binder and a signed letter. Then a breach brings OCR to your door. In 2026, one finding kept repeating across OCR settlements: a missing or inadequate risk analysis.

HHS neither recommends consultants nor vouches for anyone as HIPAA compliant. Buyers of HIPAA compliance services must therefore judge the work itself.

This guide is for CTOs, CISOs, and compliance leads hiring HIPAA compliance consulting for cloud-based products. It covers what OCR enforcement demands and what a consultant can deliver. It ends with tests to run before you sign.

What OCR Enforcement Shows About HIPAA Compliance Services

OCR's Risk Analysis Initiative is the clearest guide to regulator expectations.

A Pattern That Keeps Repeating

HHS called the March 2026 MMG Fusion settlement its 12th action under the initiative. By April, OCR counted 13 completed risk analysis investigations and 19 completed ransomware investigations.

Enforcement also arrives late. OSF discovered its ransomware in April 2021, and Ambry found its phishing incident in January 2020. Both settled in 2026, and both now run two-year corrective action plans under OCR monitoring.

Three Resolutions at a Glance

Resolution	Announced	Amount	What OCR alleged
MMG Fusion	Mar 5, 2026	$10,000	Risk analysis missing or inadequate; about 15 million individuals affected
OSF Healthcare	Jul 29, 2026	$552,250	Risk analysis missing or inadequate; late breach notices; 53,907 patients affected
Ambry Genetics	Sep 17, 2026	$700,000	No risk analysis; no offboarding process for ePHI access; about 225,000 affected

OCR set that figure with MMG's ability to pay in mind.

What a HIPAA Compliance Consultant Can and Cannot Deliver

Those cases raise a buyer's question: what can a consultant promise?

Does HHS Certify HIPAA Compliance Consultants?

No. HHS has said it neither recommends specific consultants nor vouches for anyone as HIPAA compliant. The Security Rule also never asks an organization to obtain a certification. If you hire an outside firm to certify you anyway, regulators can still find violations afterward.

Where a Consultant's Responsibility Ends

A consultant can	A consultant cannot
Assess, test, and document your environment	Assume your accountability under the rule
Perform the periodic evaluation the rule requires	Issue an HHS determination
Write findings, remediation plans, and evidence packages	Grant an official HIPAA compliant status
Help you frame vendor assurance requests	Replace your own risk management decisions

OCR's FAQ allows the required evaluation to be done in-house or by an outside firm. That is why deliverables need careful reading. An attestation letter shows that someone performed work. It is not an HHS determination, so its credibility depends on the assessment behind it.

The Regulatory Baseline a Consultant Must Work From

Whatever a consultant promises, the work must match the rule that OCR enforces.

The Current Security Rule Is the Enforceable Standard

OCR enforces the current rule, and HHS states that it remains in effect during rulemaking. Under 45 CFR 164.308(a)(1)(ii), risk analysis and risk management are both required implementation specifications. So are the sanction policy and regular review of audit logs and access reports. A separate standard, 164.308(a)(8), requires periodic technical and nontechnical evaluation.

Is the Proposed Security Rule Update in Effect?

No. HHS published the proposal at 90 FR 898 on January 6, 2025, and comments closed March 7, 2025. The latest Unified Agenda moved it to the long-term actions list. Law firm analyses cite a July 2027 target for final action. The prior agenda listed May 2026, so the date has already slipped once. Treat the proposal as a planning input, and be cautious with any firm that presents it as current law.

What Would Change, and What Already Applies

Topic	Current rule	2025 proposal (not final)
Technology asset inventory and network map	Not named in the rule text	Written asset inventory and ePHI flow map, refreshed at least yearly
Vulnerability scanning	No fixed cadence	At least every six months
Penetration testing	No explicit requirement	At least every 12 months
Multi-factor authentication	No explicit requirement	Mandatory, with narrow exceptions
Encryption of ePHI	Addressable specification	Mandatory for stored and transmitted ePHI, with narrow exceptions

The first row deserves attention. HHS's preamble already treats asset discovery and ePHI flow mapping as parts of a sound risk analysis. A consultant who skips those steps is not behind a future rule. They are under-delivering against today's rule.

What a Defensible Risk Analysis Engagement Looks Like

OCR sets the benchmark through guidance and corrective action plans. It does not mandate one methodology, but it does define elements that any method must cover.

Scope and Inventory

Scope means every system and medium that touches ePHI, whether the organization generates, stores, or moves it. OSF's plan went further and demanded a full inventory of hardware, data systems, offsite storage, and applications. That included web properties.

For a cloud-native team, the equivalent includes accounts, regions, data stores, queues, logs, backups, and SaaS tools. Ask how the consultant will discover assets. Interviews alone can miss resources that engineers created outside documented processes. Discovery through your own cloud APIs reduces that risk.

Methodology and Evidence

OCR does not prescribe a single risk analysis model. Its guidance cites NIST SP 800-30 for example steps. NIST SP 800-66 Rev. 2 maps Security Rule standards to NIST controls. The guidance lists elements any method must cover, including scope, data collection, current measures, likelihood, and impact. It also expects the analysis to be documented, though no format is prescribed.

One element separates strong work from weak work. OCR's guidance wants to know whether existing safeguards are set up correctly and used as intended. Interviews cannot answer that question. A consultant has to pull IAM policies, encryption settings, and logging configuration directly from your accounts.

Worked Example: Validating Access to Patient Uploads

Consider a hypothetical SaaS team that stores patient uploads in one AWS S3 bucket. Its written policy says access follows least privilege. This is an illustration, not a client case. A consultant tests the policy claim in four steps.

1Discover. Attach the read-only SecurityAudit policy to an assumable role in each account, then list buckets, roles, and policies.
2Trace. Combine identity policies, the bucket policy, and role trust relationships to see who can read the bucket.
3Compare. Run the IAM policy simulator on key roles and compare results with the written policy and data flows.
4Check logging. Read the trail's event selectors to confirm object-level data events are on. CloudTrail does not log them by default.

SecurityAudit cannot read object contents, but it can list object key names, so treat every export as sensitive.

From Finding to Closed Evidence

Suppose the export shows a developer role with s3:* on that bucket and no object-level logging. The consultant records both gaps against the rule sections they touch, such as 164.312(a)(1) and 164.312(b). Each record carries a risk rating and a remediation owner. The consultant can also draft a least-privilege policy for the team to review and deploy.

After the fix, the consultant re-exports the configuration and compares it with the first export. That dated before-and-after pair becomes the closure evidence. If the export still disagrees with the written policy, the finding stays open.

From Analysis to Risk Management

A risk analysis alone does not satisfy the rule. Risk management is a separate required specification. It means acting on the analysis until remaining risk reaches what the rule calls "reasonable and appropriate". OSF's corrective action plan shows OCR's sequence:

1Within 60 days, OSF submits the scope and methodology of its proposed analysis.
2Once OCR accepts the approach, OSF has 90 days to deliver the analysis.
3OCR comments, OSF revises, and the loop repeats until OCR signs off.
4Within 90 days of that approval, OSF submits a risk management plan with a remediation timeline.
5OSF repeats the analysis annually, for two analyses during the plan.

Judge any consultant by what happens after the report. Ask who owns remediation and how closure is evidenced.

Cloud and Vendor Questions to Ask Before You Sign

Cloud environments add a second set of questions, because your risk now includes vendors.

Does a BAA With My Cloud Provider Make Me HIPAA Compliant?

No. OCR's cloud guidance leaves little room for doubt. A vendor that stores your ePHI is a business associate, even when it cannot read the data. That triggers a business associate agreement (BAA). OCR's guidance cites its 2016 Oregon Health & Science University settlement, which involved cloud storage without a BAA.

A BAA does not configure your environment. You remain responsible for risk analysis and for the services you configure. Ask the consultant to map which services in each account touch ePHI. Then confirm that your provider's agreement covers those services.

Subcontractors and Vendor Inventory

Business associates must obtain satisfactory assurances from their own subcontractors under 45 CFR 164.308(b)(2). A consultant who reviews only customer-facing agreements misses part of that chain. Ask whether the engagement inventories every vendor that touches ePHI, including analytics, support, and logging tools.

OCR's guidance adds a negotiating point. HIPAA does not force a cloud vendor to open its security records to customers. Any such access has to be negotiated into the contract. A capable consultant can help you frame the ask.

How to Evaluate HIPAA Compliance Consulting Proposals

With those baselines set, proposals become easier to compare.

What Should a HIPAA Compliance Consultant Deliver?

At minimum, expect a documented risk analysis and a risk management plan. Evidence should come from your systems, not only from interviews. Every finding should carry three things:

A citation to the relevant Security Rule section
A risk rating based on likelihood and impact
A named remediation owner

Ask for Evidence Samples, Not Policy Binders

Request a redacted sample of a prior risk analysis and its evidence package. Expect system-level evidence: configuration exports, IAM policy reviews, log settings, and likelihood and impact ratings per threat.

Then test traceability. Can you follow one finding from rule citation to owner to closure evidence? In our view, findings without citations are hard to defend in an OCR inquiry.

Confirm Who Does the Technical Work

A proposal can describe senior engineers while delivering interview notes. Ask who will access your cloud accounts, through which roles, and with what logging. Prefer read-only roles with short-lived credentials, and ask how access is revoked at the end.

If the work involves ePHI access, the consulting firm may itself be a business associate. That is our informed analysis, not legal advice. Have counsel settle the question and any BAA terms before testing begins.

Evidence Retention and Recognized Security Practices

Good evidence has a long shelf life.

How Long Should I Keep HIPAA Assessment Records?

The Security Rule sets a six-year retention period for required documentation. The clock starts at the later of two dates: creation, or the last day the record governed practice. That is 45 CFR 164.316(b)(2)(i). Written records of required assessments and actions fall under that rule. Keep your risk analysis and remediation records for the full period. Keeping consultant deliverables for the same period is a sound practice.

Enforcement can arrive late. OSF's incident occurred in April 2021, and its settlement followed in July 2026. OSF's agreement also notes that civil money penalties face a six-year limit, which parties can pause by agreement.

Recognized Security Practices

A 2021 HITECH amendment gives you a second reason to keep evidence. Under Public Law 116-321, HHS must weigh recognized security practices you maintained for at least 12 months. Qualifying frameworks include NIST's work and the 405(d) program under the Cybersecurity Act of 2015. You pick which to adopt.

The amendment rewards documented good practice, but it is not a safe harbor. HHS keeps full authority to enforce the Security Rule.

A Buyer's Playbook: Before, During, and After the Engagement

Put together, these points become a simple routine.

Before You Sign

Write the deliverables into the statement of work.
Require a documented methodology, a discovery-based asset inventory, and system-level evidence.
Require a rule citation and a named owner for every finding.
Ask for named engineers and their access model.
Settle BAA terms if ePHI access is possible.
Agree how closure of each finding will be evidenced.

During the Engagement

Grant read-only access through short-lived roles, and log every session. Compare the consultant's discovered assets against your own inventory, and treat each difference as a finding. Track every remediation item to a named owner and a date. Keep exports and configuration snapshots in a store you control.

After Delivery

Schedule the next analysis. OSF's plan requires an annual cycle. OCR's guidance ties updates to triggers such as incidents, ownership changes, leadership turnover, and new technology. Re-run the analysis after events such as a new cloud region or a new vendor with ePHI access.

Plan for the Proposed Rule Without Overbuilding

Map your findings to the proposal's items, including MFA, encryption, vulnerability scanning, and penetration testing. Prioritize them using your own risk analysis. HHS said most existing obligations would not change substantially. Fixed testing cadences would be new specifics. Do not describe proposed items to customers as current legal requirements.

Key Takeaways

HHS certifies neither consultants nor "HIPAA compliant" status, so judge the work product.
OCR's 2026 settlements keep citing missing risk analysis, so make it the center of any engagement.
The current Security Rule is enforceable. The 2025 proposal is not final, and its timing is uncertain.
Require discovery-based inventories, system-level evidence, and a rule citation for every finding.
A BAA is necessary but not sufficient. Your configuration remains your responsibility.
Keep risk analysis records for six years, and repeat the analysis as your environment changes.

Before you sign, ask one question: can this consultant show evidence from a cloud environment like yours? A binder cannot answer it. A configuration export can.

How SiegePal Helps

How the Engagement Maps to These Tests

SiegePal's HIPAA compliance services follow the structure described above. HIPAA assessments run 10 to 14 weeks, depending on environment size and complexity. They move from discovery and scoping through a risk assessment across administrative, physical, and technical safeguards. A gap analysis with a prioritized roadmap and remediation support follow.

Deliverables include a BAA review, a vendor risk assessment framework, and an evidence package with the attestation letter. SiegePal verifies controls against live cloud configuration rather than policy text. That maps to the two tests above: discovery-based inventory and system-level evidence. SiegePal is not a certification body, and no attestation replaces an HHS determination.

Where to Start

Teams wanting a first read can use the HIPAA risk score tool. Teams needing only the analysis can review SiegePal's cyber risk assessment services. Teams that need help implementing fixes can look at cloud security engineering. To scope an engagement against the tests in this guide, book a free consultation.

This analysis reflects public information as of October 14, 2026. It is not legal advice.

Sources Used

Sources are ordered by category. No cloud-provider documentation or vendor threat research was used, because the topic is regulatory and enforcement-driven.