SecureSlate for Healthcare
HIPAA does not come with a certificate. Your buyers still want proof.
So health systems, payers, and their security teams ask for the artifacts that do exist: a SOC 2 report, a HITRUST assessment, a completed questionnaire, and a BAA you can stand behind. SecureSlate builds the program that produces all of them, with a dedicated compliance lead on fixed pricing.
Why now
Handling patient data puts you under obligations nobody hands you a badge for.
Three things are true of every organization touching protected health information, whatever its size.
There is no HIPAA certificate to send
HHS enforces the rules through its Office for Civil Rights. It does not certify anyone. You can run a genuinely compliant program and still have nothing to attach to the email, so buyers close the gap by asking for a SOC 2 report, a HITRUST assessment, or a questionnaire with three hundred lines in it.
The BAA does not stop with you
You sign a Business Associate Agreement with your customer, then you owe equivalent terms to every subcontractor that touches protected health information: your cloud, your logging, your support tooling, your model provider. Each vendor someone adds quietly extends a chain you are accountable for.
The breach clock starts before you understand what happened
The Breach Notification Rule gives you sixty days from discovery to notify affected individuals, and a breach reaching five hundred or more people in one jurisdiction also goes to HHS and to the media inside that window. On day one of an incident, the evidence you need has either been collecting or it has not.
What proof looks like
Four things buyers ask for, and what each one actually gives you.
Most healthcare compliance confusion comes from treating these as interchangeable. They are not, and knowing which one your customer means saves a quarter.
The obligation
HIPAA
Administrative, physical, and technical safeguards, a Privacy Rule that limits use of PHI to the minimum necessary, and a risk analysis you are expected to keep current rather than file once. We implement it and document it so any regulator or customer question has an answer behind it. The deliverable is the program itself.
The artifact most buyers accept
SOC 2 Type II
An independent auditor tests your controls across a window and issues an opinion you can actually send to a procurement team. Its control set overlaps heavily with the HIPAA Security Rule, so a single program produces both instead of running two.
What large buyers escalate to
HITRUST
Health systems and payers often ask for HITRUST once contract value climbs. The CSF has assessment levels, so the right move is matching the level to what the customer actually requires rather than starting at the heaviest one and paying for it twice.
When PHI meets your models
ISO 42001
The moment a clinical or administrative feature runs on a model, buyers ask what happens to patient data inside it: training use, de-identification, and whether the model provider is a subcontractor under your BAA. ISO 42001 answers that in a form procurement recognizes, and it maps onto an existing program rather than starting over.
How it works
We run the program. Your clinicians and engineers keep their week.
Four stages from the first call to proof a health system accepts, with a named person accountable at every one.
Scoping around where PHI actually lives
We establish whether you are a covered entity or a business associate, trace where protected health information enters and rests in your systems, and look at who is asking you for proof. That decides your scope, rather than a default recommendation.
Risk analysis and a dated gap plan
The Security Rule risk analysis is the document everything else references, and it is the first thing an investigator asks for. Your compliance lead runs it against your real architecture and hands back a plan with named owners before any build work starts.
We implement, you approve
Safeguards put in place, policies written for how your organization actually operates, the BAA chain reconciled against your vendor list, access to PHI logged and reviewed on a schedule, and evidence collecting continuously from the systems you already run.
Audit, then keep it alive
We run the readiness review, coordinate your auditor, and stay through fieldwork. Afterwards the program keeps operating, so the risk analysis update, the access reviews, and the workforce training happen on schedule instead of the month before someone asks.
What is included
The work a HIPAA security officer would do, done for you.
The expert work, the platform, and the security scanning arrive together under one fixed price.
A compliance lead who has done this before
An experienced practitioner who owns the program end to end, works in your Slack, handles the security review calls that turn technical, and answers your auditor directly. You get a HIPAA security function without opening a req for one.
A risk analysis that stays current
The Security Rule expects your risk analysis to reflect your environment, not the environment you had two years ago. Risks are scored, tracked to treatment, and revisited as your systems change, so the document holds up when someone asks to see it.
The BAA chain, reconciled
Every subcontractor that touches PHI needs an agreement, and the list changes whenever someone adopts a new tool. We keep the vendor inventory, the due diligence, and the executed agreements matched to each other so the chain holds when a customer audits it.
Access to PHI, reviewed and evidenced
Who can reach patient data, why they still need to, and the record proving someone checked. Recurring access reviews and role-based controls run as a process with output, which is what the minimum necessary standard turns into at audit time.
Questionnaire automation
Healthcare security reviews arrive long and repetitive. Import the questionnaire a health system sent, get answers drafted from your own policies and evidence, then review, approve, and export instead of retyping the same answers each quarter.
A Trust Center your buyers can self-serve
Publish your posture, certifications, subprocessors, and documents on a live page you link from your website and your sales emails. Since there is no certificate to attach, this becomes the thing you send instead.
Technical safeguards
Your risk analysis has to name your vulnerabilities. These find them.
Scanning is part of the engagement rather than a separate subscription, because the systems PHI passes through are the ones a regulator will ask about.
Code security scanning
The applications handling patient data are scanned continuously, findings are classified by CWE and ranked by severity, and each one points at the vulnerable line with a fix your developers can act on.
Secrets detection
A leaked credential in a repository is a direct path to a system holding PHI. Exposed keys and tokens are found and pinpointed to the file and line, so revocation happens in hours rather than after someone else finds them.
Dependency and license risk
An SBOM for every repository, with the open source licenses that create real obligations flagged in plain language. Health system procurement increasingly asks for the component inventory, and this is where it comes from.
Outdated and end-of-life software
Unmaintained frameworks and runtimes are the finding that shows up in almost every healthcare risk analysis. Each one is dated from the day support ended, traced to the file that pins the version, with the upgrade target named.
Public surface monitoring
Patient portals, scheduling pages, and the subdomains nobody remembers standing up, scanned on a schedule and whenever you ship. Findings arrive explained in plain language with a recommended fix.
Dark web monitoring
Workforce credentials checked against known breach corpora, with what was exposed, when, and whether it is verified. Reused staff passwords are a common first step in healthcare incidents.
Frameworks
One control set, mapped to whichever framework the contract names.
HIPAA safeguards overlap heavily with SOC 2 and ISO 27001, and HITRUST builds on the same foundation. Implement once and the second framework becomes an extension rather than a second program. These collections walk through what each involves.
Testimonials
Teams that had the same obligations to prove
What operators say once the program stopped running on a scramble.
HIPAA isn’t something you do once. SecureSlate connected our tools, owners, and evidence so we can prove our program without the constant scramble, and we get 50+ hours a week back.
Edward CEO at HealthHaven
We always knew the next step. SecureSlate made ISO 27001 feel manageable for a non-security team, and we reclaimed 200+ hours while getting audit-ready in under seven weeks.
Catherine Director at Quality Early Years
We needed compliance that scaled with us. SecureSlate cut compliance costs while improving audit readiness. The ROI showed up immediately.
Michael CTO at Echonet
Reasons teams wait
The obligations already apply. Only the proof is optional, and only until someone asks.
“We have signed BAAs. We are covered.”
A BAA is a contract, not a control. It commits you to safeguards the Security Rule already requires, and it does not implement any of them. When a customer or an investigator asks for your risk analysis and your access records, the agreement you signed is the reason for the question rather than the answer to it.
“Nobody has asked us for SOC 2 yet.”
That changes the first time you sell to a health system. Because HIPAA produces no certificate, SOC 2 is the artifact procurement falls back on, and the request usually arrives with weeks of runway rather than the months a first audit window takes.
“We are a business associate, so our obligations are lighter.”
Business associates have been directly liable under the Security Rule and the Breach Notification Rule since the Omnibus Rule took effect. The obligations are not lighter. They are just less visible, right up until an incident makes them visible.
“We cannot justify HITRUST.”
Then do not start there. HITRUST has assessment levels precisely so effort can match the requirement, and most companies need SOC 2 with HIPAA mapped into it long before anyone needs r2. We scope to the customer actually asking, not to the largest engagement.
FAQs
What healthcare teams ask before they start.
No. HHS does not certify organizations against HIPAA, and any vendor selling you a HIPAA certificate is selling their own opinion. What exists is a defensible program: a current risk analysis, implemented safeguards, executed BAAs, workforce training, and records showing all of it operating. Buyers who want an independent artifact ask for SOC 2 or HITRUST, which is why we usually run those alongside.
The Security Rule applies to you directly, as do the breach notification obligations and the parts of the Privacy Rule your BAA passes down. You also owe equivalent agreements to your own subcontractors that handle PHI. The practical difference is that your obligations arrive through contracts with your customers as well as through regulation, so both need to be satisfied.
They serve different purposes and the work overlaps substantially. HIPAA is the legal obligation and produces no external artifact. SOC 2 is an independent audit that produces a report you can send to a buyer. Because the control sets overlap heavily, we build one program and use it to satisfy both rather than running two projects with separate evidence.
Usually when a large health system or payer makes it a condition of the contract. Before that point, SOC 2 with HIPAA mapped into it satisfies most buyers at lower cost. When HITRUST does become necessary, the assessment levels let you meet the requirement at the right depth, and the controls you already implemented carry into it.
The questions you get change first. Expect buyers to ask whether PHI is used for training, how records are de-identified, and whether your model provider is a subcontractor covered by a BAA. Those need real answers in your vendor documentation. ISO 42001 gives you a recognized way to demonstrate governance over it, and it maps onto an existing HIPAA and SOC 2 program rather than starting from zero.
We reconcile your vendor inventory against your executed agreements, flag every service touching PHI that does not have one, and keep the list current as your team adopts new tools. Your subprocessor disclosures stay published on your Trust Center so customers can check without opening a thread with your team.
Our customers have reached ISO 27001 audit readiness in under seven weeks, and HIPAA readiness moves on a similar footing because the risk analysis and safeguards are the bulk of the work. Pricing is fixed and agreed before anything starts, covering the platform, the expert work, and the security scanning together. Audit fees go directly to your independent auditor and we tell you what to expect for those up front.
Give your buyers something to open
Tell us where PHI lives and who is asking you for proof. You will leave the call with a scope, a timeline, and a fixed price, whether or not you work with us.
