Compliance Services
HIPAA Compliance That Protects Patients — and Your Organization
Identify gaps in the HIPAA requirements that apply to your organization. Auditsuisse assessments document the agreed scope, findings, and remediation priorities to support your ongoing compliance work.
What Is HIPAA Compliance?
HIPAA regulates health plans, health care clearinghouses, and health care providers that conduct covered electronic transactions. Business associates have applicable obligations when they perform covered functions or services involving protected health information on behalf of a covered entity or another business associate. A technology company is not subject to HIPAA merely because it handles some form of health data.
HHS's Office for Civil Rights enforces the HIPAA Privacy, Security, and Breach Notification Rules. Civil monetary penalty amounts and enforcement policies can change. Any penalty assessment depends on the applicable rules and the facts of the case.
Auditsuisse combines US healthcare regulatory expertise with Swiss-standard precision to deliver HIPAA assessments that go beyond checkbox compliance. As a US-licensed CPA firm, we understand the intersection of HIPAA with SOC 2, HITRUST, and state privacy laws. Standard assessments start at $2,000, priced by company headcount — see the full HIPAA pricing schedule.
What's Included
End-to-End HIPAA Assessment
Security Risk Assessment
Comprehensive SRA aligned with NIST SP 800-66 and OCR guidance, covering all ePHI systems, threats, and vulnerabilities.
Privacy Rule Review
Assessment of your policies around patient rights, minimum necessary use, authorizations, and Notice of Privacy Practices.
Gap Analysis & Remediation
Detailed findings report with prioritized remediation roadmap, risk ratings, and practical implementation guidance.
Policy & Procedure Review
Evaluation of your HIPAA policies, procedures, and documentation against current regulatory requirements and best practices.
Workforce Training Assessment
Review of your security awareness training program and recommendations for HIPAA-specific workforce education.
Incident Response Planning
Evaluation of your breach notification procedures and incident response readiness against HIPAA Breach Notification Rule requirements.
Our Process
Structured Approach to HIPAA Compliance
Intake
Understand your organization type, ePHI flows, and existing compliance posture to tailor the assessment scope.
Assessment
Conduct security risk assessment, privacy reviews, and technical testing across all in-scope systems.
Remediation
Deliver prioritized findings and work alongside your team to address gaps and strengthen controls.
Assessment Findings
Document the agreed findings and any remediation review completed within the engagement scope. Any assessment letter and follow-up work must describe their scope, limitations, and review date.
Frequently Asked Questions
What is HIPAA?
HIPAA regulates health plans, health care clearinghouses, and health care providers that conduct covered electronic transactions. Business associates have applicable obligations when they perform covered functions or services involving protected health information on behalf of a covered entity or another business associate. A technology company is not subject to HIPAA merely because it handles some form of health data.
Who needs to be HIPAA compliant?
HIPAA regulates health plans, health care clearinghouses, and health care providers that conduct covered electronic transactions. Business associates have applicable obligations when they perform covered functions or services involving protected health information on behalf of a covered entity or another business associate. A technology company is not subject to HIPAA merely because it handles some form of health data.
What is a HIPAA Security Risk Assessment?
A HIPAA Security Risk Assessment (SRA) is a comprehensive evaluation of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). Required under the HIPAA Security Rule, it involves identifying ePHI assets, evaluating threats and vulnerabilities, assessing current security measures, and determining the likelihood and impact of potential breaches.
How much does a HIPAA assessment cost?
Auditsuisse publishes standard starting fees: $2,000 for organizations with 1–20 employees, $3,000 for 21–35, $4,000 for 36–50, $5,000 for 51–100, and $10,000 for 101–250 employees, with custom quotes above 250. The final fee depends on MSP involvement, GRC platform status, and observation-period length. See the full HIPAA pricing schedule.
Does a HIPAA assessment provide government certification?
No. HHS does not recognize private Security Rule certifications as proof of compliance. An external assessment documents work performed within its stated scope; it does not remove the organization's legal duties or prevent HHS from finding a violation.
Get Started
Protect Patient Data with Confidence
Discuss your organization, ePHI environment, and assessment needs with our team to define an appropriate scope and deliverable.