Enterprise Security Controls
Security practices designed for healthcare operations and enterprise due diligence.
SOC 2-Aligned Controls
Controls mapped to AICPA Trust Services Criteria
Continuous Monitoring
24/7 security monitoring and automated alerting
Encryption at Rest & Transit
Encryption in transit and at rest where supported
Security Documentation
Security overview available for enterprise due diligence
Trust Services Criteria Framework
Controls aligned to the AICPA Trust Services Criteria used in SOC 2
Security (Common Criteria)
- Logical & physical access controls
- Firewalls and intrusion detection
- Vulnerability management program
- Incident response procedures
- Employee security awareness training
Availability
- High-availability call routing and monitoring
- Redundant infrastructure
- Disaster recovery procedures
- Business continuity planning
- Real-time system health monitoring
Confidentiality
- Data classification policies
- Access restricted to authorized personnel
- Confidential data encryption
- Secure data disposal procedures
- NDA requirements for all staff
Privacy
- Patient data handling per HIPAA requirements
- Purpose limitation on data collection
- Consent management
- Data retention and deletion policies
- Privacy impact assessments
Security Documentation Package
Enterprise clients and qualified prospects can request our security documentation package under NDA.
- ✓ Security controls overview (access, monitoring, and incident response)
- ✓ Access control model and audit logging summary
- ✓ Change management and vendor risk practices overview
- ✓ Documentation shared with qualified enterprise prospects under NDA
- ✓ Scope and availability may vary by engagement
Security documentation is shared only under executed non-disclosure agreements.
Enterprise-Grade Compliance Controls
Additional operational controls for multi-location healthcare groups
Change Management
Structured processes for all system and configuration changes.
- Change Request Process: All changes documented, reviewed, and approved before implementation
- Impact Assessment: Security and operational impact evaluated for every change
- Testing Requirements: Changes tested in staging environment before production deployment
- Rollback Plans: Every change includes a documented rollback procedure
- Post-Change Review: Changes verified and monitored after implementation
Vendor Risk Management
Third-party vendors assessed and monitored for security compliance.
- Vendor Assessment: Security questionnaires and due diligence before onboarding
- Contractual Controls: Security and data protection requirements in all vendor agreements
- Ongoing Monitoring: Periodic review of vendor security posture and compliance
- Access Restrictions: Vendors granted minimum necessary access with audit logging
- Incident Coordination: Documented procedures for vendor-related security events
Data Backup & Recovery
Resilient backup and recovery procedures to ensure data availability.
- Automated Backups: Regular encrypted backups of all critical systems and data
- Geographic Redundancy: Backups stored in separate geographic locations
- Recovery Testing: Backup restoration tested on a scheduled basis
- RTO & RPO Targets: Defined recovery time and recovery point objectives
- Disaster Recovery Plan: Documented and tested DR procedures for all critical systems
Employee Lifecycle
Security controls throughout the employee lifecycle from hire to separation.
- Background Checks: Pre-employment screening for all team members with data access
- Security Training: Mandatory security awareness training during onboarding and annually
- Confidentiality Agreements: NDAs and acceptable use policies signed before access granted
- Access Reviews: Periodic review of access rights to ensure appropriateness
- Offboarding Procedures: Immediate access revocation and asset recovery upon separation
Our security controls work alongside our HIPAA compliance program to protect healthcare operations data.
Learn about our HIPAA compliance program →Ready to Review Our Security Documentation?
Enterprise prospects can request our security documentation package under NDA.
Request Security Package