Can't most software and penetration testing be done remotely from India or Northern Va.? But what the hey ... having a monopoly in Hampton Roads sounds good to people that still have TV's with cathode ray tubes.
HIPPA doesn't require outside third-party testing. It's helpful to show a good faith effort to comply, but nothing in the law requires it. You can do the testing yourself and it's just as good in theory.