HIPAA + SOC 2 + HITRUST readiness as one program. Real vCISO included. Priced for Series A.

§ Common questions on HIPAA scope, HITRUST readiness, and AI

What health-tech founders and covered entities ask us

• Do we need HITRUST if we have HIPAA?

  Depends on which hospital is asking. Some hospital systems (particularly large integrated delivery networks, academic medical centers, payers, and PBMs) require HITRUST i1 or r2 certification specifically as a purchasing condition. Others accept SOC 2 Type II + HIPAA attestation. Ask your customer which they'll accept before choosing a path. vCISO Lite ships HITRUST readiness: we project your existing HIPAA + SOC 2 + ISO 27001 evidence against the HITRUST control catalog and tell you where you stand across e1 / i1 / r2. When you're ready to certify, bring the readiness report to a HITRUST Assessor Organization. They issue the certification, not us. That's a deliberate boundary.

• We use AWS / GCP / Azure. Do we need our own BAA with them?

  Yes. AWS, GCP, and Azure all sign BAAs, but the BAA is not on by default. It has to be requested and countersigned per your account. There's also a specific subset of each cloud's services that are BAA-eligible (AWS calls this the HIPAA Eligible Services List); running PHI on a non-eligible service is a violation even under a signed BAA. Our vendor register tracks BAA capture per subprocessor with PHI-access flagged so you can see the chain.

• Our AI feature analyzes patient records. Different HIPAA rules?

  Same rules, higher scrutiny, and this is a boundary we're honest about. If PHI reaches the model as an input or as training data, the model provider is a subprocessor and needs a BAA. Under the FTC's amended 2024 Health Breach Notification Rule, AI wellness / AI health features outside HIPAA carry their own breach-notification duty parallel to OCR. Hospitals are actively reshaping AI vendor procurement. Kaiser Permanente published formal AI Requirements for Vendors in Sept 2025, and Joint Commission RUAIH certification launched June 2026. What vCISO Lite ships today: your AI subprocessors go in the vendor register with PHI-access flagged, and ISO 42001 controls are loaded in the SCF corpus. What we do NOT ship today: HTI-1 FAVES source-attribute tracking, CHAI model card generation, HITRUST ai1/ai2 workflow, FDA PCCP tracking. If your buyer is asking for those specifically, we can help you draft the procurement conversation but we're not the CHAI-aligned tool of record.

• We're not a covered entity. Do we still need HIPAA?

  If you receive, create, maintain, or transmit PHI on behalf of a covered entity, you're a business associate and you inherit the HIPAA Security Rule directly. That includes many SaaS vendors serving healthcare, RCM providers, medical billing platforms, patient-communication tools, analytics vendors, and AI features running on patient data. The HITECH Act extended HIPAA to business associates directly in 2013; this is not a covered-entity-only regime.

• What actually happens in an OCR investigation?

  OCR opens most investigations from three triggers: a self-reported breach (500+ affected individuals), a patient complaint (right-of-access is the fastest-growing category), or a random compliance review. The investigator requests: the risk analysis and the date it was last conducted, the workforce training log, the list of BAAs in place, encryption evidence for PHI at rest and in transit, the incident-response plan, and the sanction policy with any recent disciplinary actions. The investigator does not want a marketing deck; they want the artifacts, dated, findable.

• We already use Vanta or Drata or Sprinto. Why not just add HIPAA there?

  You can. You're here because that's obviously not working. Generic compliance-automation platforms handle HIPAA as a checkbox with reasonable Security Rule mapping, good enough for many SMB scenarios. Where they run out of runway: when the hospital's procurement team asks for HITRUST readiness alongside HIPAA + SOC 2, when the subprocessor BAA chain needs to be a governed register (not a spreadsheet), or when the cyber-insurance renewal packet needs FAIR-quantified LEC. Our differentiator vs Vanta/Drata is (a) HITRUST readiness projection via SCF cross-map, (b) BAA + PHI as first-class data model, (c) real fractional CISO included at Ultra tier, not a partner-referral network.