Get through the health system's security review.
We prepare digital-health products for health-system and enterprise security reviews: we find what would fail, fix it in your product and infrastructure, and help you answer the questionnaire with real evidence.
What a health system's security review usually asks for
- Who can access patient data, how access is approved and removed, and whether multi-factor authentication is enforced.
- Audit logs of access and changes, and who reviews them.
- Encryption of data at rest and in transit.
- Backups that are tested by restoring them, and a disaster-recovery plan.
- An incident response procedure with notification timelines.
- Written policies, a risk assessment, workforce training, and business associate agreements.
What we do
- Find what would fail the review today, ranked by risk.
- Fix it in your product and infrastructure: access control, logging, encryption, backups and restore tests, incident response.
- Draft the policies and evidence the review asks for, and prepare questionnaire answers with you.
- Keep it working afterward, if you want us to run it.
Built fast, now under review
Products built quickly, including with AI coding tools, often work well and still fail a review on access control, logging, or backups. That is a normal starting point, and it is the work this service is for.
Security Review Readiness FAQ
Do you have SOC 2 or HITRUST?
No, not today. For most projects we work inside your environment under your controls, and we help you pass your customer's review with your own program and evidence.
Can you answer our health system's security questionnaire?
We prepare the answers and evidence with you, including standard formats such as SIG and CAIQ and custom health-system questionnaires. You stay the party that submits it.
Will you sign a business associate agreement?
Yes. Our US company signs business associate agreements when our work involves PHI.