Home/Technology/Security & HIPAA
02 / The Platform

ASP-RCM Security & HIPAA. Done the right way.

Healthcare data isn’t a marketing surface. It’s a regulatory obligation. ASP-RCM is built to the same standard as your hospital’s own infosec program. SOC 2 Type 2, ISO 27001, HIPAA-aligned controls, BAAs on every engagement, and an annual third-party audit you can read.

At a glance
SOC 2 Type 2
ISO 27001 + HIPAA
Annual external audit. Reports available under NDA.
Controls in place

The security posture, written down.

No vendor questionnaire dodge. Here’s what’s in place, today, in production.

01

SOC 2 Type 2

Audited annually by a Big-4-tier firm. Type 2 covers operating effectiveness over a 12-month window. Report shareable under NDA.

02

ISO 27001 certified

Information security management system aligned to international standard. Surveillance audits annually, recertification every 3 years.

03

HIPAA + HITECH alignment

Administrative, physical, and technical safeguards mapped 1:1 to 45 CFR 164 §§ 308–312. BAA executed on every client engagement.

04

Encryption everywhere

AES-256 at rest (RDS, S3, EBS, backups). TLS 1.3 in transit. AWS KMS-managed keys, customer-isolated.

05

Role-based access + MFA

Least-privilege RBAC. MFA required for every user. Privileged access is time-boxed and just-in-time.

06

Immutable audit log

Every PHI access logged with user, time, record, action. Logs are append-only, retained 7 years, exportable to client SIEM.

Audit posture

Independently verified, not self-attested.

SOC 2 Type 2
annual audit
Trust Services Criteria, all 5
ISO 27001
certified
externally audited ISMS
HIPAA
BAA in every contract
no exceptions, no add-ons
7 years
log retention
append-only, immutable
How an incident plays out

If something goes wrong, this is what happens.

Documented in our incident response runbook.

01
Detection

Datadog + AWS GuardDuty alerts on anomaly. SOC 2 mandates 24-hour acknowledgement; we run 15-minute SLA.

02
Triage

On-call engineer + security lead engaged. Severity 1 escalates to leadership within 1 hour.

03
Containment

Affected service isolated. Credentials rotated. Snapshot taken for forensics.

04
Notification

Client notified within 24 hours of confirmed breach. HHS notification within 60 days where required.

05
Postmortem

Blameless postmortem published internally. Client receives written summary + remediation plan.

Ready to put Security & HIPAA in front of your CIO?

We’ll walk your team through the platform live, answer the hard questions, and leave you with documentation your security and engineering teams can actually evaluate.