HIPAA Compliance Consultant: Scope, Cost and RFP Checklist

• Identify which framework is really driving the request
• What HIPAA actually requires, according to HHS
• What ISO/IEC 27001 actually requires, according to ISO
• What PCI DSS v4.0.1 actually requires, according to PCI SSC
• Consultant, auditor, QSA or fractional CISO: who does what
• A scope-and-cost model with explicit assumptions
• Questions that separate strong consultants from template sellers
• Copyable RFP and scoping checklist
• Sequence the first 90 days of a combined engagement
• When a consultant is not enough

A HIPAA compliance consultant helps a covered entity or business associate complete the Security Rule's required risk analysis, turn the findings into safeguards, policies and records, and keep that evidence current. There is no government-issued HIPAA certificate, so you should scope the engagement around the risk analysis, the resulting decisions and a documented evaluation, not around a badge. ISO 27001 and PCI DSS consultants do similar readiness work, but each framework ends at a different gate: an accredited certification body for ISO/IEC 27001, and the validation route your acquirer or payment brand accepts for PCI DSS.

This guide shows how to work out which framework is actually driving the request and what each one requires, according to the bodies that publish it. It also separates the consultant's job from the auditor's, the QSA's and a fractional CISO's. It ends with a scope-and-cost model built on stated assumptions and a copyable RFP checklist you can send to every shortlisted firm. Fractional CTO Experts is an executive network and matching platform. We do not certify organizations, perform audits or provide legal advice. Treat this guide as editorial research to check against the primary sources linked throughout.

Identify which framework is really driving the request

Most compliance projects start with a sentence from someone else. A hospital customer sends a business associate agreement, an enterprise buyer's security questionnaire asks for an ISO/IEC 27001 certificate, or an acquirer asks for an attestation of compliance. Before you contact a consultant, write down the exact request, who made it and what evidence would satisfy them. That sentence decides which framework matters, how deep the work goes and who will eventually judge it.

Trigger you received	Framework it points to	Who decides you are "done"	What the consultant should produce
A covered entity customer wants a business associate agreement	HIPAA Security Rule (and Privacy and Breach Notification Rules)	No certifying body; you remain responsible, and HHS can find violations later	Risk analysis, risk management plan, policies, evaluation record
An enterprise buyer asks for a certificate, not a questionnaire	ISO/IEC 27001:2022	An external certification body, ideally accredited	Defined ISMS scope, risk assessment and treatment, internal audit readiness
An acquirer or payment facilitator asks for PCI DSS validation	PCI DSS v4.0.1	The compliance-enforcing entity: acquirer, payment brand or facilitator	Cardholder data flow map, scope decision, SAQ or assessment support
A customer sends a long security questionnaire	Whatever controls the questionnaire references	The customer's reviewer, under your contract	Consistent answers backed by existing evidence
Several of the above at once	A combined program with shared controls	Each gate separately	A control map that avoids doing the same work three times

The last row is common for software companies that sell to health systems and take card payments. A good consultant builds one set of controls and evidence and maps it to each framework. They do not run three disconnected projects. Ask for that mapping explicitly in your RFP.

What HIPAA actually requires, according to HHS

The HHS summary of the HIPAA Security Rule says the rule applies to covered entities and to their business associates. Covered entities are health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with standard transactions. The HITECH Act made the Security Rule's safeguards apply directly to business associates, which is why a software vendor handling a hospital's data can be in scope. The Security Rule protects electronic protected health information (ePHI). HHS notes that, unlike the Privacy and Breach Notification Rules, it does not apply to PHI held on paper or communicated verbally.

HHS describes the rule as "flexible, scalable, and technology neutral." It does not dictate specific products. Instead, a regulated entity weighs its size and capabilities, its technical infrastructure, the cost of security measures and the probability and criticality of risks to ePHI. That flexibility is exactly why a consultant is useful. It is also why a consultant who arrives with a fixed checklist and no questions about your systems is a warning sign.

The core obligations HHS lists fall into three groups:

• Administrative safeguards: a security management process built on an accurate and thorough risk analysis, plus risk management. They also cover a designated security official, workforce security, information access management, security awareness and training, security incident procedures, a contingency plan, periodic evaluation and business associate agreements.
• Physical safeguards: facility access controls, workstation use and security, and device and media controls, including removing ePHI before media is reused.
• Technical safeguards: access control, audit controls, integrity controls, person or entity authentication and transmission security.

Two details change how you should scope a HIPAA engagement. First, HHS explains that "addressable" implementation specifications are not optional. You must implement them where reasonable and appropriate. Otherwise you must document why not and adopt an equivalent alternative where reasonable. A consultant should produce that reasoning in writing. Second, HHS says documentation must be kept for six years from the date it was created or last in effect, whichever is later. The engagement should leave you with a document system that someone will maintain, not a folder that ages.

The HHS guidance on risk analysis calls the risk analysis "foundational." It states that the rule does not prescribe a specific methodology. The guidance draws on NIST material and lists questions such as where your ePHI is created, received, maintained or transmitted. Ask every consultant to show you, with client details removed, what their finished risk analysis looks like. If the sample could describe any company, it will not help you make decisions.

On certification, HHS is direct. Its FAQ on certifying Security Rule compliance says no standard requires a covered entity to certify compliance. The required evaluation can be done internally or by an external organization. HHS also says it "does not endorse or otherwise recognize private organizations' 'certifications'" and that such a certification does not stop HHS from later finding a violation. An external evaluation can still be valuable evidence for customers. Just do not buy it as legal protection.

Incident handling belongs in scope too. The HHS Breach Notification Rule page says individual notice must be given without unreasonable delay and no later than 60 days after a breach of unsecured PHI is discovered. Media notice is also required when a breach affects more than 500 residents of a state or jurisdiction. A consultant can help you rehearse that path. Whether a specific incident is a reportable breach is a question for counsel.

Finally, ask how the consultant handles regulatory change. HHS issued a proposed rule to update the Security Rule on December 27, 2024. HHS's summary page, last reviewed in August 2026, still describes the rule "currently in effect" and links separately to the proposal. A credible consultant will tell you which of their recommendations are current obligations, which reflect the proposal and which are simply good practice. They will not present a proposal as if it were final.

What ISO/IEC 27001 actually requires, according to ISO

ISO describes ISO/IEC 27001 as the standard that "defines requirements an ISMS must meet," where the ISMS is an information security management system. It applies to organizations of any size and sector. The current edition is ISO/IEC 27001:2022, edition 3, published in October 2022. ISO lists one amendment, Amendment 1:2024 on climate action changes, and shows the 2013 edition as withdrawn. The requirements document itself is short; ISO lists it at 19 pages. Most of the effort goes into applying it to your organization, not into reading it.

The important word is "management system." ISO/IEC 27001 does not certify that a product is secure. It asks you to define the scope of your ISMS and assess and treat information security risks. You then operate chosen controls, measure them, audit them internally and have management review the results. A consultant's value is in setting a sensible scope and producing a risk assessment your team can defend. The internal audit and management review should run without them. Watch for a scope drawn so narrowly that the certificate will not answer your customer's question. Watch equally for one drawn so broadly that the project stalls.

Certification is optional, and ISO does not perform it. ISO's certification page says: "ISO does not perform certification or issue certificates." Certification is done by external certification bodies. Accreditation is formal recognition that a certification body operates according to international standards. ISO notes that accreditation is not compulsory, but its standard page adds that a certificate from an accredited body "may bring an additional layer of confidence." ISO also points buyers to the International Accreditation Forum's CertSearch database for verifying accredited certificates. It asks organizations to use the full reference, for example "certified to ISO/IEC 27001:2022."

Three scoping questions follow from this:

1. Which certification body will you use, and is it accredited for this scheme? Your customer may have a view. Ask them before you choose.
2. Is the consultant independent of the certification body? The party that designed your ISMS should not also be the party that audits it. Ask both to disclose any commercial relationship.
3. What will the certificate scope statement say? Draft it early and show it to the customer who asked for the certificate. It is the sentence they will actually read.

What PCI DSS v4.0.1 actually requires, according to PCI SSC

The PCI Security Standards Council's overview says PCI DSS applies to entities that store, process or transmit cardholder data or sensitive authentication data. It also applies to entities that could affect the security of the cardholder data environment. That includes merchants, processors, acquirers, issuers and service providers.

The current version is PCI DSS v4.0.1. The PCI SSC announcement says it was published on June 11, 2024 as a limited revision with "no additional or deleted requirements." PCI DSS v4.0 was retired on December 31, 2024. The requirements v4.0 marked as future-dated took effect on March 31, 2025, and v4.0.1 did not change that date. If a proposal in 2026 still talks about "preparing for 4.0," ask when the firm last updated its methodology.

The standard is organized into 12 principal requirements. The headings below appear in the PCI SSC's Self-Assessment Questionnaire D for merchants. Because v4.0.1 added and deleted no requirements, they remain the requirement titles:

1. Install and maintain network security controls.
2. Apply secure configurations to all system components.
3. Protect stored account data.
4. Protect cardholder data with strong cryptography during transmission over open, public networks.
5. Protect all systems and networks from malicious software.
6. Develop and maintain secure systems and software.
7. Restrict access to system components and cardholder data by business need to know.
8. Identify users and authenticate access to system components.
9. Restrict physical access to cardholder data.
10. Log and monitor all access to system components and cardholder data.
11. Test security of systems and networks regularly.
12. Support information security with organizational policies and programs.

The largest cost lever in PCI DSS is scope, not control implementation. If a payment provider's hosted page or redirect handles card entry, far fewer of your systems may be in scope than if your own servers see card numbers. Scope rules still change, though. In January 2025 the PCI SSC announced changes for merchants validating with SAQ A. Requirements 6.4.3, 11.6.1 and 12.3.1 were removed from that questionnaire. A new eligibility criterion requires merchants to confirm their site is not susceptible to attacks from scripts that could affect their e-commerce systems. A consultant's first PCI deliverable should be a cardholder data flow diagram and a written scope decision that reflects rules like these.

Who decides how you validate? Not the Council. The same PCI SSC post states that "compliance validation requirements are set by brands, acquirers, payment facilitators, etc." In August 2026 the Council revised FAQ 1331 to clarify that merchants "should always consult with their Compliance Accepting Entities" to confirm validation and reporting requirements. Put that conversation with your acquirer on the project plan before you commit to a validation route.

If your acquirer requires an assessment by a Qualified Security Assessor, the PCI SSC's QSA page defines QSA companies as "independent security organizations" qualified by the Council to validate adherence to PCI DSS. It advises checking the current listing each time you engage one, because the list changes. Qualification is not an endorsement of a firm's business practices. A consultant who helps you prepare is a different role from the QSA who assesses you.

Consultant, auditor, QSA or fractional CISO: who does what

These roles overlap in marketing copy but not in accountability. The simplest test is to ask who builds the program, who independently assesses it and who owns it after the engagement ends. Buying one when you need another is the most common scoping mistake.

Role	What they are accountable for	What they should not do	Hire when
Compliance consultant	Designing controls, running or facilitating risk analysis, drafting policies, preparing evidence for a named framework	Independently assess the program they built; give legal opinions; own your program indefinitely	You have a defined framework goal and an internal owner who can keep it running
ISO certification body auditor	Auditing your ISMS against ISO/IEC 27001 and issuing or declining a certificate	Design your ISMS for you	You have operated the ISMS long enough to produce audit evidence
PCI QSA	Validating adherence to PCI DSS where your compliance-enforcing entity requires it	Act as your builder and your independent assessor at once	Your acquirer or payment brand requires an assessment, or you want independent validation
External HIPAA evaluator	Performing the periodic technical and non-technical evaluation HHS requires	Offer a "certification" that HHS will recognize (none exists)	You want an independent evaluation for your records or customers
Fractional CISO	Owning security risk decisions, the roadmap, incident leadership and executive reporting across frameworks	Replace hands-on implementation capacity	Compliance keeps exposing unowned security decisions, not just missing documents
Legal counsel	Business associate status, contract terms, regulatory response, breach notification decisions	Build your technical controls	Any question about what the law or a contract obligates you to do
Compliance automation software	Collecting evidence, tracking tasks, mapping controls across frameworks	Decide your risk treatment or own the program	You already know what to do and need to keep evidence current at lower effort

The fractional CISO row deserves attention. If every compliance request turns into a debate about who can accept a risk, approve an exception or lead an incident, you have a leadership gap, not a documentation gap. A consultant will produce the documents and leave. Our fractional CISO guide explains how to scope an executive who owns those decisions across frameworks, with a named internal team doing the ongoing work. Many companies use both: a fractional CISO sets priorities and accepts risk, and a consultant delivers a bounded readiness project inside that plan.

A scope-and-cost model with explicit assumptions

We do not publish market rates for compliance consultants. Rates vary with firm type, seniority, geography and whether the work is fixed-fee or time-based, and we have no verified benchmark to offer. What you can control is the effort estimate. If you build it yourself, you can compare proposals on hours and deliverables rather than on headline price. Then multiply by each firm's own quoted rate.

The model below is an illustrative worked example for an invented company. The hours are assumptions chosen to show the arithmetic. They are not benchmarks and not a quote.

Invented company. A 60-person business-to-business software company sells a scheduling product to hospital groups, which makes it a business associate. Two enterprise prospects have asked for an ISO/IEC 27001 certificate. Customers pay by card through a provider's hosted payment page, so the company's own systems do not receive card numbers. It has an engineering lead who will own security internally, a handful of informal policies and no prior risk analysis.

Workstream	Illustrative consultant hours	Assumption behind the number
Discovery, system inventory and data flow mapping (ePHI and payment flows)	24	Two cloud environments, about 15 SaaS tools, one product
HIPAA risk analysis and risk management plan	40	No prior analysis; interviews with 6 system owners
Policy and procedure set, mapped to both HIPAA and ISO/IEC 27001	30	Drafting from the company's practices, not a generic pack
ISMS scope, risk treatment and statement of applicability	60	Scope limited to the product and the teams that support it
Internal audit preparation and a management review rehearsal	24	One internal audit cycle before the certification audit
PCI DSS scope confirmation and questionnaire support	12	Hosted payment page; acquirer confirms the validation route
Evidence coaching and remediation check-ins	128	8 hours a week for 16 weeks while the team implements
Total consultant effort	318

Estimated consultant fees are then 318 × R, where R is the blended hourly rate each firm quotes you. For a fixed-fee proposal, divide the fee by 318 to see the implied rate. Then ask the firm which of your assumptions it changed to reach its number. A proposal far below your estimate usually means a smaller scope, fewer interviews, template policies or no evidence coaching. Find out which before you compare prices.

Now add the costs that sit outside any consultant's proposal. Get quotes for each rather than guessing:

• The certification body's audit fees for ISO/IEC 27001, including the surveillance audits it schedules after certification.
• A QSA's fees, if your compliance-enforcing entity requires an assessment.
• Penetration testing or vulnerability scanning, where your chosen controls or your acquirer require it.
• Tools such as compliance automation, logging, endpoint management or identity services selected during risk treatment.
• Legal review of business associate agreements, customer contracts and incident procedures.
• Internal time, which is usually the largest hidden cost. In this example, assume the engineering lead spends a day a week on the program and six system owners each spend 10 hours on interviews and evidence. Write that estimate down and protect it on the roadmap.

The multipliers that move the hours most are predictable. Storing or processing card data on your own systems expands PCI DSS work sharply compared with a hosted page. An ISMS scope covering several products, offices or subsidiaries multiplies interviews and evidence. Having no existing inventory of systems and data flows makes discovery the critical path. Some companies ask for certification in a quarter while the team has no capacity to implement anything. That usually buys documentation without operating evidence, which a competent auditor will notice.

Questions that separate strong consultants from template sellers

Use the same questions with every firm and score the answers before discussing them as a group. You are looking for evidence that the consultant will make decisions specific to your systems. You also want to know they will leave your team able to keep the program running.

Question	Strong answer	Weak answer
Show us a redacted risk analysis you delivered.	Specific assets, threats, likelihood and impact reasoning, named owners and a treatment plan	A generic spreadsheet that would fit any company
How do you handle HIPAA addressable specifications?	Explains the implement, alternative or document-why reasoning HHS describes	"Addressable means optional"
What will you not do?	No legal opinions, no certification, no auditing their own work	"We handle everything"
Who will actually do the work?	Named people, their hours and their relevant framework experience	A partner in the pitch and unnamed staff afterwards
How do you map controls across frameworks?	One control set with a mapping to each framework and shared evidence	Separate projects and separate policy packs
What happens at handover?	An evidence calendar, owners for each recurring task and a rehearsal	A final report and a renewal proposal
How do you track regulatory change?	Distinguishes current rules from proposals, such as the HIPAA Security Rule proposal	Presents a proposal as settled law, or has not heard of it
Which certification bodies or QSAs do you work with?	Discloses relationships and supports your independent choice	Insists on a partner auditor without disclosure

Watch for red flags that should end a conversation. These include a promise of "HIPAA certification," a guarantee that you will pass an audit, or a fixed timeline set before discovery. A tool-only offer that cannot explain your own risk decisions is another. So is a firm that offers to be both your builder and your independent assessor. Also be wary of anyone who cannot say which version of PCI DSS is current. After June 2024 the answer should be v4.0.1, unless the Council has since published a newer version you can verify on its site.

Copyable RFP and scoping checklist

Send this to every shortlisted firm and ask them to answer in the same order. Delete the sections for frameworks that do not apply. Consistent answers make proposals comparable and expose the assumptions behind each price.

COMPLIANCE CONSULTING RFP — [Company name] — [Date]

1. WHY WE ARE DOING THIS
   - The exact request we received: [quote the customer, acquirer or contract clause]
   - Who asked, and what evidence would satisfy them: [name/role, artifact]
   - Deadline and what depends on it: [date, deal or renewal]

2. FRAMEWORKS IN SCOPE (delete what does not apply)
   - HIPAA Security Rule: we are a [covered entity / business associate / unsure: counsel to confirm]
   - ISO/IEC 27001:2022: proposed ISMS scope [products, locations, teams]
   - PCI DSS v4.0.1: how card data reaches us [hosted page / redirect / our servers]
     Validation route confirmed with acquirer: [yes/no; SAQ type or assessment]

3. ENVIRONMENT FACTS
   - Cloud environments and regions: [list]
   - Number of SaaS tools holding sensitive data: [count]
   - Where ePHI and/or cardholder data is created, stored, transmitted: [summary or diagram]
   - Existing policies, prior assessments, audit reports: [list and dates]
   - Headcount and teams with access to sensitive data: [numbers]

4. DELIVERABLES WE EXPECT (ask the firm to confirm, add or remove)
   - System and data flow inventory
   - HIPAA risk analysis and risk management plan
   - Written reasoning for each addressable specification
   - ISMS scope statement, risk assessment, risk treatment, statement of applicability
   - Policies mapped to each framework, drafted from our practices
   - PCI DSS scope decision and data flow diagram
   - Internal audit readiness and management review rehearsal
   - Evidence calendar with named internal owners
   - Handover session and final gap list

5. PLEASE ANSWER
   a. Named team members, their role, hours and framework experience
   b. Your estimate of consultant hours per deliverable, with assumptions
   c. Your estimate of OUR internal hours, by role
   d. Fee structure: fixed fee or rate, what triggers a change order
   e. What you will not do (legal advice, certification, independent assessment)
   f. Any relationship with certification bodies, QSAs or software vendors
   g. How you distinguish current rules from proposed rules
   h. A redacted sample risk analysis and statement of applicability
   i. How you hand over, and what we should be able to run without you
   j. Two references from clients with a similar framework and size

6. DECISION PROCESS
   - Questions due: [date]  Proposals due: [date]  Decision: [date]
   - Internal owner of this program after the engagement: [name, role]

Sequence the first 90 days of a combined engagement

A realistic plan front-loads the decisions that set scope, because every later estimate depends on them. The phases below describe an order of work, not a promised timeline. Your system count, existing evidence and internal capacity determine the actual pace.

Weeks 1 to 3: confirm obligations and scope. Counsel confirms whether you are a business associate and reviews the agreements you have signed. The acquirer confirms your PCI DSS validation route. The customer who asked for ISO/IEC 27001 sees a draft certificate scope statement. The consultant builds the system inventory and data flow diagrams. At the end, you should have a one-page scope decision for each framework that a non-specialist executive can read.

Weeks 3 to 8: analyze risk and decide treatment. The consultant runs the HIPAA risk analysis and the ISO/IEC 27001 risk assessment together, using one asset list and one risk method mapped to both. Your internal owner and the executive team decide which risks to treat, accept or transfer, and record who accepted each one. This is where a fractional CISO or other senior security owner earns their place. Risk acceptance is a management decision, not a consultant's.

Weeks 6 to 12: implement and start producing evidence. Engineering implements the chosen controls. The consultant drafts policies from your actual practices and sets up the evidence calendar: access reviews, backup restore tests, training records, vendor reviews and incident exercises. The goal by week 12 is not a perfect program. It is a working cadence with the first cycle of evidence already produced.

After week 12: prove it runs without the consultant. Run an internal audit or evaluation, hold a management review and rehearse an incident, including the breach notification decision path with counsel. Only then schedule the certification audit or the external assessment. If the team cannot run the evidence calendar without the consultant in the room, extend the handover rather than the audit.

When a consultant is not enough

A compliance consultant fits when the goal is bounded and someone inside the company will own the result. That is the same test our specialist consultants hub applies to AI, cloud and data consultants. If nobody can own the program, or the real problem is that security decisions have no executive owner, hire for that gap first.

Healthcare software companies often find the compliance question is tangled up with integration architecture, data ownership and product roadmap choices. The healthcare CTO services guide covers that broader technology leadership problem. Payment and financial services companies face a similar overlap between PCI DSS scope and system design; see the fintech CTO guide on controls and resilience. If you need an executive to own security risk across frameworks, request a shortlist of fractional security leaders with your completed RFP. Then assess each candidate's evidence yourself.

This guide summarizes public material from HHS, ISO and the PCI Security Standards Council as checked on its review date. It is not legal advice, and Fractional CTO Experts does not provide certification, audits or compliance attestations. The worked cost example uses an invented company and illustrative hours. Confirm your obligations with qualified counsel, your certification body and your acquirer or payment brand before committing to a plan.