Want independent validation and assurance? Ask for a SAS-70.

The AICPA's Statement on Auditing Standards No.70, Service Organizations addresses CPA audits of service providers conducted to verify that a provider has adequate controls over its operations. Hospitals should request a SAS-70, the report produced by such an audit, from all of their third-party service providers. SAS-70s can be issued for a specific date or for a six-month period, and they typically consist of three sections: a CPA opinion, a description of controls, and information about the design of the controls.