What Colington Consulting does

Colington Consulting is a Burke, Virginia-based HIPAA compliance consulting firm founded in 2013 by Jay Hodes, a former HIPAA Compliance Officer for Fairfax County and former Assistant Inspector General for Investigations at HHS-OIG. The firm delivers human-led, consultative compliance services to healthcare Covered Entities, Business Associates, and HIPAA Hybrid Entities, including HIPAA Security Risk Assessments, Risk Management Plans (policies and procedures), workforce Security Awareness and Privacy Training, HIPAA Privacy Assessments, Facility Security Plans, Third-Party and AI Tool Governance, OCR Investigation Support, and Audit Readiness services. Its core technology stack is senior regulatory expertise and proprietary documentation frameworks rather than software products; the firm explicitly does not sell software subscriptions, generic templates, or one-time certification badges, and instead issues Letters of Attestation upon completion of full Security Rule conformance.

The business model is professional services with customized, engagement-based pricing rather than uniform SKUs. The firm has introduced a Virtual HIPAA Compliance Officer (vHCO) fractional retainer for small-to-midsize organizations, billed as a flat monthly subscription or hourly support. Initial engagement is driven by a complimentary 30-minute HIPAA Risk Review that funnels prospects directly to Jay Hodes via Microsoft Outlook booking, emphasizing consultative, high-touch selling over automated marketing or sales development motions. Marketing is anchored on thought leadership: a HIPAA blog with over 80 articles authored by Hodes, conference speaking engagements with healthcare compliance associations, and earned media in healthcare trade publications.

The client base spans large healthcare systems (multi-state skilled nursing, rehabilitation, and hospice), specialty practices (pathology, oncology, ophthalmology, radiology), dental and behavioral health groups, municipal public health and school systems requiring FERPA/HIPAA integration, and HealthTech vendors handling PHI. Service delivery is virtual nationwide and worldwide, with on-site risk reviews throughout Virginia and the greater Washington D.C. area. The firm operates without external funding or institutional investors and reports cumulative scale of hundreds of served organizations and more than 1,000 completed risk assessments.

Name

Colington Consulting

Legal name

Colington Consulting

Website

https://cchipaa.com

Company type

Private

Founded year

2013

Operating status

Operating

Headcount range

1–10 employees

Short description

Colington Consulting is a HIPAA compliance consultancy delivering human-led risk assessments, risk management plans, workforce training, OCR investigation support, and AI compliance services to healthcare Covered Entities and Business Associates nationwide.

Ownership category

akta.pro rank

Product category

HIPAA Compliance Consulting

NAICS

Management Consulting Services (54161)

SIC

Services-Management Consulting Services (8742)

akta.pro primary industry

Risk, Compliance & Internal Controls Consulting (BPAHACAJ)

Keywords

• HIPAA compliance consulting
• Security risk assessments
• Compliance training services
• Risk management plans
• Virtual compliance officer

Headquarters

HQ city

Burke

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Marketing or Sales, Technology or R&D

Revenue model

1. HIPAA Compliance Consulting Services: Professional consulting services including HIPAA Security Risk Assessments, HIPAA Risk Management Plans (Policies and Procedures), HIPAA Security Awareness & Privacy Training, OCR Investigation Support, HIPAA Privacy Assessments, HIPAA Policy Reviews, Facility Security Plans & Surveys, Third-Party HIPAA Governance, Virtual HIPAA Compliance Officer (vHCO) program, and Hourly HIPAA Consulting. Services are customized per organization with engagements reflecting ongoing risk oversight rather than transactional deliverables.

Pricing tiers

Go-to-market motion1 record

Distribution channels3 records

Marketing channels4 records

Core offering

Colington Consulting provides human-led, consultative HIPAA compliance services to healthcare providers (Covered Entities) and their vendors (Business Associates). Its core offerings include HIPAA Security Risk Assessments, customized HIPAA Risk Management Plans (policies and procedures), and HIPAA Security Awareness & Privacy Training, supplemented by Privacy Assessments, Policy Reviews, Facility Security Surveys, Third-Party and AI Governance, a fractional Virtual HIPAA Compliance Officer (vHCO) program, OCR Investigation Support, and HIPAA Audit Readiness.

Product overview

Colington Consulting is a HIPAA compliance consulting services firm offering a portfolio of interconnected advisory services for Covered Entities (healthcare providers and plans), Business Associates, and HIPAA Hybrid Entities. The core service framework consists of three foundational programs: HIPAA Security Risk Assessments (mandatory regulatory gap analysis), HIPAA Risk Management Plans (policies and procedures documentation), and HIPAA Security Awareness & Privacy Training (workforce education). These foundational services are complemented by targeted add-on modules including HIPAA Privacy Assessments, HIPAA Policy Reviews, Facility Security Plans & Surveys, Third-Party HIPAA Governance (including AI vendor compliance), Virtual HIPAA Compliance Officer (vHCO) fractional services, Hourly HIPAA Consulting, OCR Investigation Support, and Audit Readiness services. The firm does not sell software subscriptions, generic templates, or one-time certification badges—instead providing hands-on, human-led consulting with over 100 years of combined experience.

Differentiator

Problem solved

Functional benefit

Products and services

• HIPAA Security Risk Assessments Mandatory regulatory assessment under the HIPAA Security Rule that evaluates, identifies, and documents potential vulnerabilities to electronic Protected Health Information (ePHI) across administrative, physical, and technical safeguards. Conducted in-house by Colington consultants (human-led) to produce defensible documentation.
• HIPAA Risk Management Plans (Policies and Procedures) Customized documentation of the security management process outlining administrative, physical, and technical safeguards to protect ePHI, including a breach notification compliance framework. Tailored to each organization rather than template-based.
• HIPAA Security Awareness & Privacy Training CFR-mapped workforce training covering PHI protection, security awareness, and privacy protocols. Available via annual subscriptions, live instructor-led sessions (Microsoft Teams or onsite), or customized organization-specific courses.
• HIPAA Privacy Assessments Standalone assessment that determines whether daily operations meet HIPAA Privacy Rule standards, available in dedicated Covered Entity and Business Associate versions.
• HIPAA Policy Reviews Cost-effective evaluation of an organization's existing HIPAA documentation to ensure every OCR standard is legally defensible and thoroughly addressed.
• Facility Security Plans & Surveys On-site or remote physical security evaluations assessing physical access controls, visitor logs, validation procedures, and workstation placement under 45 CFR §164.310(a)(1).
• Business Associate, AI, & Third-Party HIPAA Governance Third-party vendor compliance monitoring including pre-service vendor risk assessments, AI tool compliance reviews, and Business Associate Agreement management for healthcare vendors and business associates.
• Virtual HIPAA Compliance Officer (vHCO) Fractional compliance leadership providing Privacy and Security Officer functions for small-to-midsize organizations lacking internal workforce, offered as a flat monthly subscription or hourly support.
• Hourly HIPAA Consulting & Developer Support Flexible, project-based access to HIPAA consultants for immediate physical, technical, or administrative safeguard compliance hurdles, including support for developer and engineering teams building health-related products.
• OCR Investigation Support Structured response support during HHS Office for Civil Rights investigations, including documentation preparation, policy alignment, gap identification, and regulatory submission structuring.
• HIPAA Audit Readiness Compliance evaluation and preparation services to ensure healthcare organizations are prepared for HIPAA audits, OCR investigations, and cyber insurance reviews.
• AI and HIPAA Compliance Services Advisory service helping healthcare organizations understand AI-related HIPAA risk, governance, and compliance exposure arising from AI tools and AI vendors they adopt.

Quantifiable outcome

• Most organizations achieve full compliance within 30-60 days
• +1 more outcomes

Named customers9 records

Segments6 records

Ideal customer profiles5 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Partnerships

One partnership is on record.

• MyData-TRUSTminorStrategic or Co-development PartnerGDPR Services partner offering consulting services and solutions including trainings, risk assessments, legal support, externalized DPO and DPR, personal data protection governance strategies and tools. Belgium-based company with offices in US, France, UK and Romania. Recognized among top 10 data protection solution providers globally with multidisciplinary team of data protection officers, lawyers, and cybersecurity experts specialized in healthcare sector.

Scale indicators4 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• HIPAA One: HIPAA One provides HIPAA compliance software and services, including security risk assessments, policies, and training. It competes directly with Colington's core services while leaning more heavily on a SaaS-enabled delivery model.
• The HIPAA Company: The HIPAA Company is a boutique consultancy offering HIPAA risk assessments, policy development, and training to healthcare providers and business associates. It is comparable to Colington in scope, scale, and target customer profile.
• Meditology Services: Meditology is a healthcare cybersecurity and HIPAA compliance consulting firm serving providers, payers, and HealthTech vendors. It directly competes with Colington on HIPAA risk assessments, security program development, and third-party risk oversight.
• CynergisTek: CynergisTek is a healthcare cybersecurity and HIPAA risk management consulting firm offering assessments, managed services, and advisory to providers and business associates. It overlaps directly with Colington's core risk assessment and compliance advisory offerings at a significantly larger footprint.
• Clearwater: Clearwater (formerly Clearwater Compliance) is a leading healthcare-focused cybersecurity and HIPAA compliance consulting firm. It directly competes with Colington on HIPAA risk assessments, risk management program development, and managed compliance services for providers and business associates, but operates at materially greater scale.
• Compliancy Group: Compliancy Group sells HIPAA compliance software and a guided compliance program aimed at small and mid-sized healthcare providers. It directly overlaps with Colington's risk assessment, training, and policy work for the SMB healthcare segment.

Broad incumbents

• Coalfire: Coalfire is a major cybersecurity advisory and assessment firm with a dedicated HIPAA and healthcare practice. It serves many of the same Covered Entity and Business Associate segments as Colington but operates across a much broader compliance and cyber portfolio.
• Schellman: Schellman is a top-tier cybersecurity and compliance attestation firm with HIPAA and HITRUST practices. It serves healthcare clients seeking HIPAA-aligned assessments alongside broader certifications such as SOC 2 and ISO 27001, putting it in adjacent competition with Colington at the high end of the market.
• A-LIGN: A-LIGN is a large cybersecurity and compliance audit firm delivering HIPAA, HITRUST, SOC, and ISO assessments. Its HIPAA practice overlaps with Colington's risk assessment and compliance advisory services, but as part of a multi-framework audit portfolio.

Emerging players

• Sprinto: Sprinto is a compliance automation platform that has publicly recognized Colington as a top compliance partner. Sprinto represents the emerging software-enabled alternative to boutique HIPAA consultancies, automating parts of the risk assessment and policy workflow that Colington performs manually.

Market position

Strengths5 records

Weaknesses4 records

Competitive moat4 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/ColingtonInfo

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Colington Consulting