If you sell to hospitals, health plans or healthtech companies, you've probably been asked to "prove you're HIPAA compliant." Then the confusion starts. Should you get a HIPAA audit? A HIPAA certification? An AT-C 315 report? In short: a HIPAA assessment finds your gaps, and an AT-C 315 HIPAA audit gives you an independent CPA opinion you can share. This guide explains the difference in plain language so you can choose the right option before you spend time and money.
First, a common myth: there is no official "HIPAA certification"
The U.S. Department of Health and Human Services (HHS) and its Office for Civil Rights (OCR) do not certify organizations as HIPAA compliant. Any "HIPAA certificate" from a private company is that company's own validation, not a government approval. What matters is whether you have a working, documented compliance program, and how you prove it to customers.
What is a HIPAA audit?
"HIPAA audit" is used in two different ways:
- OCR audit: HHS OCR can audit covered entities and business associates to check compliance with the HIPAA Privacy, Security and Breach Notification Rules. You don't choose this one; you get selected or investigated, often after a complaint or breach.
- Independent HIPAA assessment: a consulting firm reviews your organization against HIPAA requirements: risk analysis, policies, administrative, physical and technical safeguards, training, business associate agreements and breach procedures. You receive a findings report and a remediation plan.
An independent HIPAA assessment is excellent for finding gaps and getting ready. But it's usually an internal-facing document. It doesn't carry a formal independent opinion that your customers can rely on.
What is an AT-C 315 audit?
AT-C 315 (Compliance Attestation) is an attestation standard issued by the AICPA (American Institute of Certified Public Accountants) under SSAE 18. It allows a licensed CPA firm to examine whether an organization complies with specified laws or regulations, and HIPAA is one of the most common.
In an AT-C 315 HIPAA engagement:
- Management makes a written assertion that the organization complies with the selected HIPAA rules (Security Rule, Breach Notification Rule, and optionally the Privacy Rule).
- An independent CPA firm tests the controls and evidence.
- The CPA issues a formal opinion on that assertion.
The result is a report you can share with customers and prospects, similar in feel to a SOC 2 report but focused on HIPAA requirements.
AT-C 315 engagements can be:
- Type 1: compliance at a specific point in time
- Type 2: compliance over a period of time (for example, 6–12 months), which carries more weight with customers
HIPAA Audit vs AT-C 315: Side-by-Side
| Independent HIPAA Assessment | AT-C 315 HIPAA Attestation | |
|---|---|---|
| Performed by | Consulting / compliance firm | Licensed CPA firm |
| Governing standard | HIPAA rules (no audit standard) | AICPA SSAE 18, AT-C 315 |
| Output | Gap report & remediation plan | Formal CPA opinion report |
| Independent opinion | No | Yes |
| Shareable with customers | Usually not | Yes, designed for it |
| Best for | Readiness, finding gaps | Proving compliance to customers |
| Typical order | Done first | Done after you're ready |
Which one do you need?
Choose an independent HIPAA assessment if:
- You're starting your HIPAA program or haven't done a risk analysis
- You want to find and fix gaps before anyone else looks
- No customer has asked for a formal report yet
Choose an AT-C 315 HIPAA attestation if:
- Healthcare customers or enterprise buyers are asking for third-party proof
- Security questionnaires keep delaying your deals
- You want a credible, shareable report without the cost and scope of HITRUST
For most companies, the answer is both, in order: assess and remediate first, then get attested.
How AT-C 315 compares to SOC 2 and HITRUST
- SOC 2 reports on your controls against the AICPA Trust Services Criteria. It's widely recognized, but it isn't a HIPAA-specific opinion.
- AT-C 315 HIPAA gives a direct opinion on HIPAA compliance.
- HITRUST is a certifiable framework that maps to HIPAA and many other standards. It's the most rigorous of the three, and also the most effort.
Many organizations combine SOC 2 with HIPAA, testing once and reporting on both. If you're comparing SOC 2 providers, see our guide to the best SOC 2 consultants.
Important: independence matters
The CPA firm that issues your AT-C 315 opinion must be independent. That means the firm that helped build your controls can't also sign the opinion on them. Readiness and attestation should come from separate parties.
Why CyberWave GRC Is Among the Best HIPAA Consultants & Auditors
CyberWave GRC takes you from "where do we start?" to a report you can share:
- AT-C 315 HIPAA audits (Type 1 & Type 2) issued by our licensed AICPA CPA partner firm
- HIPAA gap assessment and security risk analysis
- HIPAA policies, procedures and BAA review
- Remediation support and workforce training
- Evidence preparation and audit readiness
- Combined SOC 2 + HIPAA and HITRUST pathways
Learn more about our HIPAA compliance consulting.