# Meditology Services, LLC - **Type:** Advisory firm - **Website:** https://www.meditologyservices.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US consultancy working only in healthcare privacy, security and AI governance, and an authorised HITRUST assessor. ## Meditology Services scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 4/5 Firm is HIPAA expert witness for OCR and advises ONC/HHS; publishes named incident-response and breach-analysis service pages. ### Qualifications of the people who do the work: 5/5 CEO has 20+ years as CISO/Privacy Officer; Managing Partner Cliff Baker architected the HITRUST CSF framework. ### What it publishes about fees: 2/5 No fee schedule, rate card, or pricing model found on any service or overview page checked directly. ### Knowledge of your sector: 5/5 Exclusively healthcare-focused since founding; authorized HITRUST assessor with named health-system clients. ### Independence from what it sells: 2/5 Meditology acquired CORL's AI-enabled TPRM software in Nov 2025 and co-brands case studies with vendor Spirion. ### Who carries the risk if the advice is wrong: 3/5 Entity is Active/Compliance with Georgia's registry; no public professional-liability insurance or guarantee disclosed. ## Sources for Meditology Services Every line carries the page it was read on and the date it was checked. - Meditology Services, LLC is registered as a Domestic Limited Liability Company in Georgia, company number 10081650, status Active/Compliance, with an annual registration filed 13 Jan 2026 and registered agent Jeffrey B. Sladkus. - Source: https://opencorporates.com/companies/us_ga/10081650 - Checked: 2026-09-20 - Meditology Services is an authorized HITRUST CSF Assessor, and its Managing Partner Cliff Baker served as the lead architect for the HITRUST CSF framework. - Source: https://www.meditologyservices.com/hitrust-certification-services/ - Checked: 2026-09-20 - Meditology markets itself directly on its own HIPAA & OCR compliance page as the 'HIPAA expert witness firm for OCR' and as 'Advisors to ONC / HHS'. - Source: https://www.meditologyservices.com/hipaa-and-ocr-compliance/hipaa-expert-witness-services/ - Checked: 2026-09-20 - CEO Nadia Fahim-Koster has more than 20 years of operational experience as a former CISO and Privacy Officer with two large regional hospital and physician networks in Atlanta. - Source: https://www.meditologyservices.com/meet-the-leadership-team/nadia-fahim-koster/ - Checked: 2026-09-20 - On 12 November 2025 Meditology Services announced it had acquired CORL Technologies, which it describes as providing 'AI-enabled, workflow-driven' third-party risk management (TPRM) solutions. - Source: https://www.meditologyservices.com/news/meditology-services-acquires-corl-technologies/ - Checked: 2026-09-20 - NASCO's Chief Information Security Officer, Kristen Ellis, is quoted stating a Meditology data-risk engagement gave her team 'enhanced visibility and valuable insight into data risk at NASCO,' with results used to eliminate redundant sensitive data and strengthen compliance posture. - Source: https://www.meditologyservices.com/news/meditology-services-and-spirion-announce-strategic-partnership-to-strengthen-data-privacy-and-cybersecurity-in-healthcare/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Published - Client results: Published - How it uses AI: Not published ## Strengths - Authorized HITRUST CSF Assessor; Managing Partner Cliff Baker was the lead architect of the HITRUST CSF framework itself. - Firm positions itself as the named HIPAA expert witness firm for OCR and as advisors to ONC/HHS, a rare direct regulatory-facing credential. - CEO Nadia Fahim-Koster brings 20+ years as a former hospital-system CISO and Privacy Officer, not just a consulting background. - Exclusively healthcare-focused practice for over a decade, with named enterprise clients (NASCO, McLaren Health Care, Grady Health System, Dartmouth-Hitchcock Medical Center, Kelsey-Seybold Clinic). - Verified, named client outcome on record: NASCO's CISO credits a Meditology engagement with concrete data-risk reduction results. ## Things to check Each one carries the factual basis it rests on. - Meditology acquired CORL Technologies, an AI-enabled third-party-risk-management software platform, creating a structural software-sales conflict for a firm that also sells independent assessments. - Basis: Meditology's own 12 Nov 2025 release states it 'announced the acquisition of CORL Technologies,' describing CORL's offering as 'AI-enabled, workflow-driven TPRM solutions.' - No public fee schedule, hourly rate, or pricing model is published on any Meditology service, about, or overview page reviewed. - Basis: Direct review of the overview, HIPAA/OCR consulting, HITRUST certification, and homepage found no pricing or fee-structure disclosure. - Meditology's privacy policy discloses nothing about its own internal use of AI tools or how client engagement data is handled by any AI system. - Basis: Direct review of the published privacy policy page found only generic 'service providers under confidentiality agreements' language, no AI-specific text. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.