For healthcare
HIPAA and SOC 2, on the same evidence
Protected health information changes what you must prove and who you must prove it to. Handle both without running two programs.
Two programs, one set of safeguards
HIPAA is not optional for you, and it is not what your buyers ask about. They ask for SOC 2. So you end up maintaining two programs that overlap heavily but are tracked separately.
The safeguards are largely the same ones. What differs is who you prove them to, and in what form.
What we do about it
PHI-aware scoping
Identify which systems touch protected health information and scope controls to them, rather than treating every system identically.
Business associate agreements
Track BAAs against the vendor record, with expiry and renewal dates. A missing BAA is a common finding.
Overlapping frameworks
HIPAA and SOC 2 ask for many of the same safeguards. Map once, satisfy both.
Access, evidenced
Who accessed PHI, when, and whether their access was reviewed: the question that comes up first.
Frameworks you can start with
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.