We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Meditology Services, LLC review

Advisory firm

A US consultancy working only in healthcare privacy, security and AI governance, and an authorised HITRUST assessor.

Relevant if you are a US health organisation needing a HITRUST assessment or HIPAA compliance help

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Meditology Services scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 5/5
What it publishes about fees 2/5
Knowledge of your sector 5/5
Independence from what it sells 2/5
Who carries the risk if the advice is wrong 3/5

What Meditology Services offers, and what it publishes

Meditology is an authorised HITRUST assessor, and says managing partner Cliff Baker was lead architect of the HITRUST framework. Chief executive Nadia Fahim-Koster has over 20 years' experience as security chief and privacy officer at two Atlanta hospital and physician networks. The firm calls itself the 'HIPAA expert witness firm for OCR'. HIPAA is US health privacy law.

Meditology Services does not publish a price. We found no fee schedule, hourly rate or pricing model on its service, HITRUST, HIPAA or overview pages. It does not publish its professional liability insurance or engagement terms. Its privacy policy says nothing about how the firm itself uses AI.

On 12 November 2025 Meditology bought CORL Technologies, which it describes as AI-enabled third-party risk management software. It now sells that software alongside its own assessments, so ask how it keeps the two apart. NASCO's security chief, Kristen Ellis, is quoted on Meditology's site crediting a data-risk engagement with 'enhanced visibility and valuable insight into data risk'.

Strengths

  • Authorized HITRUST CSF Assessor; Managing Partner Cliff Baker was the lead architect of the HITRUST CSF framework itself.
  • Firm positions itself as the named HIPAA expert witness firm for OCR and as advisors to ONC/HHS, a rare direct regulatory-facing credential.
  • CEO Nadia Fahim-Koster brings 20+ years as a former hospital-system CISO and Privacy Officer, not just a consulting background.
  • Exclusively healthcare-focused practice for over a decade, with named enterprise clients (NASCO, McLaren Health Care, Grady Health System, Dartmouth-Hitchcock Medical Center, Kelsey-Seybold Clinic).
  • Verified, named client outcome on record: NASCO's CISO credits a Meditology engagement with concrete data-risk reduction results.

Things to check

  • Meditology acquired CORL Technologies, an AI-enabled third-party-risk-management software platform, creating a structural software-sales conflict for a firm that also sells independent assessments.
  • No public fee schedule, hourly rate, or pricing model is published on any Meditology service, about, or overview page reviewed.
  • Meditology's privacy policy discloses nothing about its own internal use of AI tools or how client engagement data is handled by any AI system.

Common questions

Is Meditology an outsourced DPO firm?

No. It is a US consultancy working only in healthcare privacy, security and AI governance, and an authorised HITRUST assessor.

Does Meditology publish its fees?

No. We found no fee schedule, hourly rate or pricing model on the pages we checked.

Does Meditology say how it uses AI itself?

No. Its privacy policy says nothing about the firm's own use of AI, or how any AI tool handles client data.

Does Meditology sell software as well as advice?

Yes. On 12 November 2025 it bought CORL Technologies, which it describes as AI-enabled third-party risk management software, and now sells it alongside its own assessments.

Evidence for each Meditology Services score

Show our working

Notes behind each thing to check

  • Meditology acquired CORL Technologies, an AI-enabled third-party-risk-management software platform, creating a structural software-sales conflict for a firm that also sells independent assessments. (Meditology's own 12 Nov 2025 release states it 'announced the acquisition of CORL Technologies,' describing CORL's offering as 'AI-enabled, workflow-driven TPRM solutions.')
  • No public fee schedule, hourly rate, or pricing model is published on any Meditology service, about, or overview page reviewed. (Direct review of the overview, HIPAA/OCR consulting, HITRUST certification, and homepage found no pricing or fee-structure disclosure.)
  • Meditology's privacy policy discloses nothing about its own internal use of AI tools or how client engagement data is handled by any AI system. (Direct review of the published privacy policy page found only generic 'service providers under confidentiality agreements' language, no AI-specific text.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 Firm is HIPAA expert witness for OCR and advises ONC/HHS; publishes named incident-response and breach-analysis service pages.
Qualifications of the people who do the work 5/5 CEO has 20+ years as CISO/Privacy Officer; Managing Partner Cliff Baker architected the HITRUST CSF framework.
What it publishes about fees 2/5 No fee schedule, rate card, or pricing model found on any service or overview page checked directly.
Knowledge of your sector 5/5 Exclusively healthcare-focused since founding; authorized HITRUST assessor with named health-system clients.
Independence from what it sells 2/5 Meditology acquired CORL's AI-enabled TPRM software in Nov 2025 and co-brands case studies with vendor Spirion.
Who carries the risk if the advice is wrong 3/5 Entity is Active/Compliance with Georgia's registry; no public professional-liability insurance or guarantee disclosed.

Sources for Meditology Services

  • Meditology Services, LLC is registered as a Domestic Limited Liability Company in Georgia, company number 10081650, status Active/Compliance, with an annual registration filed 13 Jan 2026 and registered agent Jeffrey B. Sladkus. (GA LLC #10081650, Active/Compliance) (opencorporates.com, checked 20 September 2026)
  • Meditology Services is an authorized HITRUST CSF Assessor, and its Managing Partner Cliff Baker served as the lead architect for the HITRUST CSF framework. (HITRUST Authorized External Assessor) (meditologyservices.com, checked 20 September 2026)
  • Meditology markets itself directly on its own HIPAA & OCR compliance page as the 'HIPAA expert witness firm for OCR' and as 'Advisors to ONC / HHS'. (HIPAA expert witness firm for OCR; Advisors to ONC/HHS) (meditologyservices.com, checked 20 September 2026)
  • CEO Nadia Fahim-Koster has more than 20 years of operational experience as a former CISO and Privacy Officer with two large regional hospital and physician networks in Atlanta. (20+ years, former CISO & Privacy Officer) (meditologyservices.com, checked 20 September 2026)
  • On 12 November 2025 Meditology Services announced it had acquired CORL Technologies, which it describes as providing 'AI-enabled, workflow-driven' third-party risk management (TPRM) solutions. (Acquired CORL Technologies, 12 Nov 2025) (meditologyservices.com, checked 20 September 2026)
  • NASCO's Chief Information Security Officer, Kristen Ellis, is quoted stating a Meditology data-risk engagement gave her team 'enhanced visibility and valuable insight into data risk at NASCO,' with results used to eliminate redundant sensitive data and strengthen compliance posture. (Named client outcome: NASCO CISO testimonial) (meditologyservices.com, checked 20 September 2026)

HITRUST Authorized External Assessor

Seeking ISO 42001 certificationRegulated sectorsAfter a breach or ICO contact

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.