Where a security incident becomes a patient-safety incident.
Health systems, health-tech companies and device makers carry clinical, regulatory and reputational risk at once. We protect patient data and keep clinical operations running.
What is at stake.
- 01
Clinical continuity
Ransomware that takes down records or imaging diverts patients.
- 02
Data sensitivity
Health data is among the most sensitive categories under every regime.
- 03
Device security
Connected devices must be secured and documented before they reach the market.
Where the exposure actually sits.
- R1
Ransomware & extortion
Encrypted clinical systems combined with stolen records.
- R2
Unpatchable systems
Imaging and lab systems that cannot follow normal patch cycles.
- R3
Third-party access
Vendors with remote access to clinical systems.
- R4
Clinical AI
Summarization and triage tools that leak data or invite over-reliance.
The rules that shape the work.
The instruments that set the bar in this sector, and what each one demands.
HIPAA Security Rule
United StatesThe current rule remains in force. HHS proposed an update in January 2025 and is targeting a final rule in 2027.
HITRUST CSF
Market expectationCertifiable e1, i1 and r2 assessments, performed by HITRUST Authorized External Assessors.
FD&C Act section 524B
United StatesPremarket cybersecurity requirements for cyber devices, including an SBOM.
EU MDR / IVDR and NIS2
EUCybersecurity sits within device safety requirements; NIS2 covers providers and some manufacturers.
How we respond.
Each engagement is scoped to your regulator, your deadline and the evidence your assessor will ask for.
A digital-health company asked for HITRUST by a payer partner.
The contract required certification within a year, with no clarity on assessment type or inheritance. We compared e1, i1 and r2 against the payer’s real requirement, mapped existing SOC 2 controls and built a readiness plan ahead of fieldwork.
Questions clients ask us.
Does HIPAA require a penetration test?
The current rule requires risk analysis and periodic evaluation but does not name penetration testing. The 2025 proposal would add it. Most organizations test anyway, and their partners expect it.
Is HITRUST the same as HIPAA compliance?
No. HIPAA is a law; HITRUST is a certifiable framework that maps to it. A HITRUST certification is not a regulator’s determination.
Can you test medical devices safely?
Yes. We agree rules of engagement, use test environments or maintenance windows, and work with clinical engineering throughout. Devices connected to patients are never tested.
Talk to a practitioner who knows your sector.
Tell us what you are preparing for. A senior practitioner who has done this work will reply within one business day.