HIPAA & HITRUST auditors
26 firms in our auditor directory list HIPAA or HITRUST in their cited service lists.
| Firm | Published frameworks | Platforms | Price |
|---|---|---|---|
| Johanson Group LLP | SOC 1/2/2+/3, ISO 27001/27017/27018/27701, HIPAA, GDPR, NIST CSFsource | Drata (Audit Alliance) | Not published |
| Insight Assurance | SOC 1/2/3, ISO 27001/27017/27018/27701/42001, PCI DSS (QSA), HITRUST, CMMC (C3PAO), FedRAMP (3PAO), CSA STAR, HIPAA, GDPR, NISTsource | Drata (Audit Alliance), Vanta | Not published |
| Sensiba LLP (with AssuranceLab) | SOC 1/2/3, HIPAA/HITRUST, ISO 27001/27017/27018/27701/42001, NIST CSF/800-171/CMMC/800-53, GDPR/CCPA, CSA STARsource | Drata (Elite Alliance member) | Not published (flat-fee model stated) |
| A-LIGN | SOC 2, ISO 27001, HITRUST, FedRAMP, PCI and moresource | Drata (Elite Alliance member); Vanta (as reported) | Not published; firm states fixed-fee pricing after scoping |
| Schellman | SOC 1/2/3, ISO 27001/27701/42001, FedRAMP, StateRAMP, CMMC, PCI DSS, HITRUST, HIPAA, TISAX, C5, IRAP, GDPR, CCPA (95+ frameworks)source | Drata (Audit Alliance); Vanta (as reported) | Not published |
| KirkpatrickPrice | SOC 1, SOC 2, HIPAA, HITRUST, ISO 27001, ISO 42001, NIST, PCI DSS, PCI-SSF, CMMC readiness, pen testingsource | Not verified | Not published |
| BARR Advisory | SOC 1/2/3, SOC for Cybersecurity, ISO 27001/27701/27017/27018/42001, HIPAA, HITRUST, FedRAMP, GovRAMP, CMMC, NIST 800-53, PCI DSS, CSA STAR, GDPRsource | Drata (Audit Alliance); Vanta (listed in Vanta partner directory, as reported) | Not published |
| Advantage Partners | SOC 2 Type 1 and 2, HIPAA, ISO 27001 audits (site also lists ISO 27701/42001, HITRUST, CMMC services)source | Vanta (as reported; team bios cite Vanta experience) | Not published |
| IS Partners, LLC | SOC 1, SOC 2, HITRUST, HIPAA, ISO 27001, ISO 42001, PCI DSS, CMMC, CSA STAR, NIST, DORA, GDPRsource | Drata (Advanced Alliance member) | Not published |
| Zero Day CPA | SOC 1, SOC 2, HIPAA, penetration testingsource | Drata (Audit Alliance) | From $5,000 (Type I); from $7,000 (Type II) |
| Dansa D'Arata Soucia (DDS) | SOC 1, SOC 2, ISO internal audit, GDPR, HIPAAsource | Drata (Audit Alliance) | Not published |
| 360 Advanced | SOC 1/2/2+/3, CSA STAR, ISO, HITRUST, PCI DSS, CMMC, FedRAMP, penetration testingsource | Drata (Audit Alliance) | Not published |
| MJD Advisors, LLC | SOC 1, SOC 2, SOC 2+, SOC 3, ISO Readiness, HIPAA Attestation, GDPR, HITRUST Readiness Assessmentsource | Drata (Audit Alliance), Vanta, Sprinto | Not published; preliminary quote via MJD's online quote form |
| Schneider Downs | SOC 1, SOC 2, SOC 2+, SOC 3; PCI, CMMC, NIST, HIPAA, HITRUST, ISO internal auditsource | Drata (Audit Alliance) | Not published |
| AARC-360 | SOC 1, SOC 2, SOC 3 and readiness; ISO 27001, ISO 27701, ISO 42001; FISMA, FedRAMP, GovRAMP; HIPAA, HITRUST; PCI DSS; GDPR; CMMC readiness; NIST 800-171, NIST CSF (per firm) | Apptega, Drata, Vanta, Hyperproof, Secureframe (methodology aligned, per firm) | Not published; all-inclusive price quoted after consultation |
| Sentry Assurance | SOC 1, SOC 2, HIPAA, ISO 27701, CCPA and other privacy assessmentssource | Not verified | Not published |
| Auditsuisse Assurance | SOC 1, SOC 2, ISAE 3402, HIPAA, GDPR, penetration testingsource | Platform-agnostic; Vanta, Drata, Secureframe, Sprinto named | From $3,000 (Type I), $5,000 (Type II), $7,000 (combined) for 1–50 employees; scales by headcount |
| Decrypt Compliance | SOC 1/2/3, ISO 27001, ISO 27701, ISO 42001, PCI DSS, HIPAA, HITRUST, GDPRsource | Not verified | Not published |
| Modern Assurance | SOC 1/2/3, ISO 27001, ISO 27701, ISO 42001, CMMC, HIPAA, GDPRsource | Not verified | Not published |
| Render Compliance | SOC 1, SOC 2, SOC 2+ (ISO 27001, HIPAA, PCI DSS, FedRAMP mapping), Microsoft SSPAsource | Drata, Vanta, TrustCloud, Yak (direct experience, per firm) | SOC 2 Type 2 from $16,000 (1–10 employees) to $34,000 (200–2,000) |
| Audit Peak | SOC 1/2/3, HIPAA, GDPR, GLBA, FISMA, NIST 800-53, AUPsource | Not verified | Not published |
| CertPro | SOC 2, ISO 27001, ISO 42001, HIPAA, CCPA, PIPEDA, ISO 27701/27018source | Not verified | Not published |
| Fine Assurance | SOC 1/2/2+/3, ISO 27001 and 42001 internal audit, HIPAA, GDPR, CCPA/CPRAsource | Not verified | Not published |
| Auditwerx | SOC 1/2/2+/3, SOC for Cybersecurity, ISAE 3402, CSAE 3416, PCI DSS (QSA), HIPAA, HITRUST, ISO 27001, CMMC (C3PAO)source | Works alongside compliance automation platforms (none named) | Not published |
| Throughline CPA | SOC 2, SOC 1, ISO 27001, ISO 42001, HIPAA, GDPR, Consumer Data Rightsource | Not verified | Not published |
| FinAudit CPA | SOC 1/2/3, ISO 27001/27701/42001 internal audit, HIPAA, PCI DSS, GDPR, CCPA/CPRA, CMMC readinesssource | Not verified | Not published; fixed fee quoted after scoping |
Based on each firm's cited listing. Confirm HIPAA or HITRUST scope with the firm before engaging.
Related: HIPAA hub · SOC 2 for healthtech · ISO 27001 certification bodies
Frequently asked questions
Who can perform a HIPAA assessment?
HIPAA has no accredited certifier, so buyers usually accept an independent assessment or a SOC 2 report with HIPAA mapped in. HITRUST is a separate certification and costs much more, per Cost of Compliance.
Which firms in your directory list HIPAA or HITRUST?
Johanson Group LLP, Insight Assurance, Sensiba LLP (with AssuranceLab), A-LIGN, Schellman, KirkpatrickPrice, BARR Advisory, Advantage Partners, IS Partners, LLC, Zero Day CPA, Dansa D'Arata Soucia (DDS), 360 Advanced, MJD Advisors, LLC, Schneider Downs, AARC-360, Sentry Assurance, Auditsuisse Assurance, Decrypt Compliance, Modern Assurance, Render Compliance, Audit Peak, CertPro, Fine Assurance, Auditwerx, Throughline CPA, FinAudit CPA. This is based on each firm's cited framework list.
Form not loading? Subscribe on beehiiv. Or browse past issues in the archive.
Last verified 2026-10-19.