Security leadership, on retainer

vCISO for healthtech and digital health

For companies handling PHI and facing HIPAA, HITRUST, or SOC 2. Built for telehealth, EHR integrations, clinical SaaS, and life sciences vendors.


HIPAA Security Rule readiness, HITRUST preparation, SOC 2 readiness, BAA libraries, and PHI data flow diagrams built from your real architecture.

  Trusted for

SCOPE FOR Fintech

Your buyer's security team decides whether you launch

Selling into healthcare means selling to institutions with mature security functions and long memories. A hospital system, payor, or EHR vendor will review you properly, and the review is often the longest stage of the deal.


They will ask for a BAA, then ask what sits behind it. They will ask for HITRUST when you thought HIPAA was enough. And they will ask for a PHI data flow diagram that most companies cannot produce, because nobody has mapped where patient data actually goes.


None of this is work your engineering team can absorb between sprints. It needs someone senior who has been through these reviews before.

WHAT WE DO

What we do for healthcare specifically

01

HIPAA Security Rule readiness

Administrative, physical, and technical safeguards mapped end to end. A risk analysis tied to your real data flows rather than a template. We help you decide which addressable safeguards to implement and document the reasoning regulators expect to see.

02

BAA library and vendor PHI review

A vendor inventory tiered by PHI access, BAA templates and tracking, and a workflow for reviewing new sub-processors before they touch patient data. Sub-processors are where a large share of healthcare breaches originate, and most companies have no working BAA process.

03

Breach response leadership

HIPAA breach response runs on a regulated clock that starts at discovery. We write the playbook, run the tabletop, and lead the response so your team is not reading the notification rule for the first time during an incident.

04

PHI data flow diagrams

Where PHI enters, how it moves between services, where it rests, who can reach it, and how it leaves. Built from your actual cloud architecture. It is the one artefact auditors, security questionnaires, and incident responders all ask for.

05

HITRUST preparation

Enterprise healthcare buyers increasingly ask for HITRUST rather than HIPAA alone. We prepare you for certification and align controls so the assessor finds a coherent programme instead of a HIPAA programme with HITRUST gaps.

06

SOC 2 run alongside HIPAA

Most healthcare buyers want both. The underlying controls overlap heavily, so one evidence cycle serves both. ISO 27001 stacks on when European or insurance customers ask.

Ready to move faster?

Too much to do,

too important to ignore.

Start with a 30-minute discovery call. If we're not the right fit, we'll tell you and point you in the right direction. If we are, we'll leave the call with a clear plan to get you up and running.

TIMING

When to engage

A hospital system or payor asked for HITRUST.

You have HIPAA covered and now the buyer wants certification on a tight timeline. HITRUST is materially more rigorous, and the gap between the two is where the work sits.

You handle health data and are not certain HIPAA applies.

Wellness apps, fitness data, clinical decision support, life sciences workflows. The line between PHI and ordinary personal data is genuinely unclear in places, and being wrong in the wrong direction is expensive. We make the determination and document the reasoning.

You are integrating with an EHR and the security review is brutal.

EHR vendor reviews are unlike ordinary procurement. We answer the questionnaire, defend it on the joint call, and own the relationship until you go live.

You had a near miss and now the CEO wants a real programme.

An exposed storage bucket, a phishing attempt that nearly worked, a questionnaire that surfaced gaps nobody knew about. The buy-in to fix it properly exists right after the scare and rarely lasts.

FRAMEWORKS

Frameworks we run for healthcare

SOC 2 Type I and Type II

What most enterprise buyers want alongside HIPAA. Run together, one evidence cycle.

ISO 27001:2022

For European and insurance customers. Stacks on top of the above.

HIPAA

Security and Privacy Rule readiness for covered entities and business associates. Risk analysis, safeguards, BAA library, breach playbook, PHI flow diagrams. The baseline for anyone touching patient data.

HOW WE WORK

How we work together

01

Discovery call (30min)

Which buyer is asking, what they asked for, what PHI you handle, and the real deadline.

02

Scoped proposal

Fixed scope, timeline, and price within a few days. No open-ended hours.

03

Kickoff

We map where PHI actually sits before anything else. Most findings start here, usually in logs, backups, analytics, or support tooling.

04

Delivery

We write the documentation, answer the diligence, and work alongside your engineers on technical fixes. You approve decisions.

05

Ongoing

HIPAA is a continuing obligation, SOC 2 Type II runs continuously, and HITRUST recertifies. We stay on or hand over documented processes and a calendar.

The questions that come up on every first call.

  • What is the difference between HIPAA and HITRUST?

    HIPAA is federal law setting baseline expectations for handling PHI, and there is no certificate for it. HITRUST CSF is a private certification that prescribes how to implement those expectations at much higher rigour, drawing in controls from ISO 27001, NIST, and others. Being HIPAA compliant does not make you HITRUST certified — that requires a third-party assessor and a multi-month engagement.

  • Do you handle EHR vendor security reviews?

    Yes. The major EHR vendors each run distinct review processes. We answer the questionnaire, defend the answers on the joint call, and own the security relationship until you go live. It is one of the slowest parts of healthcare go-to-market.

  • Can you run SOC 2 and HIPAA in parallel?

    Yes, and most healthtech companies should, because enterprise buyers usually want both and the controls overlap heavily. HITRUST is the natural next step when buyer demand surfaces it.

  • Do you have experience with PHI on AWS and GCP?

    Yes. Both publish HIPAA-eligible service lists and sign BAAs, but the problems that catch healthtech companies are not in the provider documentation. They are in storage policies, key rotation, IAM drift, and default network exposure.

  • What does it cost?

    Fixed monthly pricing by engagement level, quoted before work begins. HITRUST preparation is scoped within the engagement based on your starting position and assessor timeline.

Book a discovery call

Thirty minutes on what is blocking the deal, what you have in place, and when you need it. You leave with a recommended engagement level.