These terms apply to auditors and audit firms who enroll in the HIPAA Auditors Auditor Network (“the network”), and to organizations that use the directory at hipaaauditors.com/auditors or ask us to introduce an auditor. The network is operated by HIPAA Auditors (“we”, “us”). By enrolling you agree to them. Our general Privacy Policy and Terms of Service also apply; where they differ on the network, these terms take precedence.
Who can list
- Individual auditors, assessors and consultants, and audit firms, who audit or assess organizations against HIPAA or any framework offered in the enrollment form.
- One profile per email address. Firms list under the firm’s name and name a primary contact.
- A person reviews every application. We may decline, suspend or remove a profile under these terms, and we tell you why.
Fees
- Founding members. If you enroll by 30 November 2026, before the directory launches in December 2026, your enrollment and listing are free until 31 May 2027. After that, the founding rate of USD 100 per year is locked for two years. Your Founding member badge stays on your profile.
- Everyone else. Listings start at USD 100 per year.
- No surprises. Nothing is charged automatically. We confirm your plan with you in writing before any invoice, and you can withdraw instead of paying.
- No commission. Listings are a flat fee. We don’t take a commission on introductions, and we don’t pay or accept referral fees, kickbacks or other incentives for routing work.
- Subcontracted work. When HIPAA Auditors engages you on its own client engagement, your rate, scope and confidentiality terms are agreed with you in writing before work starts.
What “Verified” means
- “Verified” means a person at HIPAA Auditors confirmed that credential with its issuer, through the issuer’s public register or verification service or directly with the issuing body, on the date shown. It says nothing else about your work.
- Credentials we have not checked yet are shown as pending verification. If you change a credential, it goes back to pending until we check it again.
- Credentials past their expiry date are shown as expired and stop counting as verified.
- We only show that a firm can formally issue a report or certificate (for example a SOC 2 report from a licensed CPA firm, or an ISO certificate from a certification body) once we have verified that authorization.
- BAA readiness, insurance and background-check consent are self-declared and labelled that way. We do not collect identity documents.
- A listing is not an endorsement or a guarantee. Organizations should still do their own due diligence before engaging anyone.
- There is no official HIPAA auditor certification, and HHS does not endorse private “HIPAA certifications”. Please don’t describe your listing as a certification or as approval by HIPAA Auditors or any regulator.
- Payment never buys a Verified badge, a higher place in our matching, or an endorsement. “Featured” profiles are chosen by our staff and labelled.
Code of conduct for listed auditors
When you enroll you agree to:
- Be accurate. Keep your profile, credentials and availability true and up to date, and only claim credentials and authorizations you hold.
- Disclose conflicts. Tell us and the client about any conflict of interest before accepting an engagement.
- Stay independent. Don’t audit systems, policies or controls you designed or implemented for the same client.
- No guarantees. Never promise a guaranteed pass, certification or “money back” outcome.
- No borrowed authority. Don’t use the logos or marks of regulators or scheme owners (for example HHS, AICPA, PCI SSC, HITRUST or the Cyber AB), or imply an authorization you don’t hold.
- Protect client information. Sign a business associate agreement and an NDA before accessing protected health information, use only the minimum necessary, and follow the client’s security requirements.
- Follow your professional standards and the laws that apply to your work — for example AICPA standards if you are a CPA.
- Respond or update. Reply to introductions promptly, or set your availability to “not taking engagements”.
How introductions work
- Organizations send requests to HIPAA Auditors, not directly to auditors. Your email address and phone number are never shown on the site.
- When a request matches your scope, we send you the details and ask you to confirm you have no conflict with that client, including prior readiness or implementation work.
- We share your contact details with the organization only after you agree to the introduction, and we tell the organization that we are sharing its request with the auditors we propose.
- When you engage directly with an organization, the engagement is between you and them. HIPAA Auditors is not a party to it and does not guarantee its outcome.
- HIPAA Auditors also offers its own audit services. We keep matching based on scope, verified credentials and availability, and we tell organizations when an option we propose is our own team.
Complaints and enforcement
- Anyone can raise a concern about a profile through our contact page or at info@hipaaauditors.com.
- We review every concern. Unless the matter is urgent, we tell the auditor and give them a chance to respond before acting.
- Possible outcomes: no action, a correction to the profile, a warning, removal of a Verified badge, suspension (the profile is hidden), or removal from the network.
- You can withdraw your profile at any time from your private profile link.
Privacy notice for auditors
What we collect: the details you enter in the enrollment form — name or firm name, contact person, email, phone, website, LinkedIn, location, experience, frameworks, services, industries, platforms, languages, availability, indicative rates, credentials (including certificate numbers and expiry dates), your commitments and your profile summary — plus the time, IP address and browser of each submission, to protect the form from abuse.
What is public: once approved, everything on your profile page except your email address, phone number, contact person and credential numbers, which only our staff see.
Why we use it: to review your application, check your credentials with their issuers, publish your profile, match you to requests and contact you about the network. We rely on your consent, which you can withdraw at any time, and on our legitimate interest in running a trustworthy directory.
Who we share it with: credential issuers, when we ask them to confirm a credential you listed; organizations, through your public profile and introductions you agree to. We do not sell your data.
HIPAA Auditors Academy certificates appear on your profile only if you opt in and have opened the private profile link we emailed you, which proves the address is yours.
How long we keep it: while your profile is listed, and for 12 months after you withdraw or an application is declined. After that it is deleted automatically. You can ask us to delete it sooner.
Your rights: you can see and correct your profile from your private link, withdraw it at any time, and ask for a copy of your data or its deletion by writing to privacy@hipaaauditors.com. Depending on where you live, laws such as the GDPR or India’s DPDP Act may give you further rights; our Privacy Policy explains them.
Changes to these terms
We will email listed auditors before any material change to these terms or to the fees. The version in force is always on this page.