Identity that survives the OCR audit.
IGA, PAM, and zero-trust programs for hospital systems, payers, and digital-health platforms. HIPAA, HITRUST, and 42 CFR Part 2 aligned.
- HIPAA
- HITRUST
- 42 CFR Part 2
- SOC 2
- NIST 800-53
- NIST 800-66
Use cases we have shipped in healthcare.
- Use case · 01
EHR access governance — Epic, Cerner, Meditech
Role-based access reviews aligned to clinical context. Break-glass workflows engineered with named approvers and audit-grade evidence captured per access. The same artifact serves OCR and your internal compliance team.
- Use case · 02
Privileged access for clinical infrastructure
Privileged session governance for EHR backbone, imaging, and laboratory systems. FDA-validated environments treated with extra care — change control and recording wired in without disrupting clinical operations.
- Use case · 03
Patient identity for portals + telehealth
Customer identity for patient portals, scheduling, and telehealth — designed to support proxy access, parent-of-minor scenarios, and consent flows without abandoning the auth surface to a vendor.
- Use case · 04
Clinical trial + research data access
Access governance for IRB-approved clinical research environments. 42 CFR Part 2 substance-use record protections honored in policy, evidence, and audit trail.
- Use case · 05
Provider lifecycle + privileging
Joiner-mover-leaver flows that account for credentialing, privileging, and locum-tenens cadence. The HRIS-driven pattern most other industries use breaks here — we engineer for the actual provider lifecycle.
- Use case · 06
Third-party + business-associate access
Consultant, vendor, and BA access lifecycled with the same rigor as employees. BAA terms and contractual access scopes wired into the access policy directly.
- Use case · 07
M&A integration for hospital systems
Acquisition-cadence identity merging across hospital systems with disparate EHRs and directories. Right-sized access by close-date; deferred merger of identity stores planned over the first audit cycle.
The buyer archetypes we have shipped programs for.
We hold NDA on most engagements. Tiers below reflect the buyer archetypes we have shipped programs for. References available on request, after mutual NDA.
- TB
Tier-1 US Bank
FFIEC · SOX
- CB
Custody Bank
GLBA · FFIEC
- FA
Federal Agency
FedRAMP High
- SS
State System
StateRAMP
- HS
Top-10 Hospital
HIPAA · HITRUST
- HP
Health Payer
HIPAA
- FP
FinTech Platform
PCI-DSS · SOC 2
- AM
Asset Manager
SOX · SOC 2
Practices that anchor this industry.
Common questions.
Do you have direct experience with HIPAA Security Rule and HITRUST CSF?+
Yes — every IAM program we deliver in healthcare is mapped to the HIPAA Security Rule (45 CFR §164.312 access control + audit controls), the HITRUST CSF, and where applicable 42 CFR Part 2 substance-use record protections. Our deliverables include the control mapping artifacts your auditors and OCR investigators will request directly.
Can you align IAM evidence across HIPAA, HITRUST, and SOC 2 simultaneously?+
Yes. We engineer evidence-as-code so a single control test produces artifacts mapped to HIPAA, HITRUST CSF, and SOC 2 CC-series controls. Auditors receive reusable evidence; your team does the work once per cycle, not three times.
How do you handle break-glass access in clinical settings?+
Break-glass is engineered with named approvers, post-event review, and a written justification policy that holds up in OCR review. The pattern preserves clinical urgency while ensuring every break-glass event becomes an audit artifact — automatically captured rather than reconstructed.
Do you work with Epic, Cerner / Oracle Health, and Meditech directly?+
Yes. We have shipped access governance and lifecycle integrations for all three. Each EHR has its own role model and integration surface; we engineer the IGA layer to fit the EHR rather than forcing the EHR into a generic IGA pattern.
What is a typical engagement timeline for a regional health system?+
8-week diagnostic + reference architecture, then 12-to-16-week build for the first audit-scope workflow (typically EHR access reviews + privileged session governance). Audit-ready evidence by month 6 for the in-scope program; broader rollout follows on a quarterly cadence.
Ready to scope a healthcare engagement?
Same-day reply during business hours. NDA on request before discovery.