Compliance and training questions, answered
The questions we hear most, gathered in one place — by framework, and by how the training works. Can't find what you're after? We're one message away.
HIPAA questions we hear a lot
See more QuestionsWho has to comply with HIPAA?
Covered entities — providers, health plans, and clearinghouses — and the business associates who handle PHI for them. If your team touches protected health information, the law almost certainly applies.
Is training required?
Yes. Workforce training is part of the law, which is why it's built into every HIPAA program we run.
What is a business associate agreement?
The contract that spells out how a vendor will protect PHI it handles for a covered entity. If you touch PHI for a client, or a vendor touches it for you, you need one.
SOC 2 questions we hear a lot
See more QuestionsIs SOC 2 a certification?
No. An independent auditor examines your controls and issues a report. It isn't a government certificate.
Type I or Type II?
Type I is a point in time. Type II covers months of operation. Customers usually want Type II.
Do you work with the auditor?
Yes. We coordinate the independent CPA firm so you aren't managing that relationship alone.
ISO 27001 and ISO 42001 questions we hear a lot
See more QuestionsWhat gets certified?
Your information security management system — how you run security — not a single report.
What is ISO 42001?
The management-system standard for governing AI. It sits next to ISO 27001 for teams that need both.
Does the certificate expire?
It runs on a cycle with surveillance audits. We stay through those, because the credential depends on them.
HITRUST questions we hear a lot
See more QuestionsWhich assessment do we need?
e1, i1, or r2, depending on what your partners require. We scope that before anyone builds controls you don't need.
Does HITRUST replace HIPAA?
No. HIPAA is the law. HITRUST is harder proof that you're meeting it.
Let's talk about where you stand
Whether you're starting from scratch or shoring up a program you already have, the first step is a straight conversation about your organization and your risk.