Protect PHI, clinical workflows, medical devices, and AI used in care or operations.
Detect PHI leakage and unsafe model behavior, test clinical AI, preserve evidence, and route incidents through containment, notification, remediation, and retest workflows.
Sector problems
Regulations and frameworks
Mappings help you collect and organize evidence. An assessor, examiner, auditor, or authorizing official still decides whether the obligation is met. The platform does not certify an organization or file a regulatory notice.
| Framework | What it asks for | How the platform helps |
|---|---|---|
| HIPAA and HITECHOfficial source ↗ | Safeguard ePHI, limit use and disclosure, and support breach assessment and notification. | Risk analysis, business-associate tracking, safeguard evidence, and incident workflows support the privacy and security officers. A proposed Security Rule update published in January 2025 was not final as of September 2026; mappings follow the current rule. |
| HITRUST CSF | Many covered entities and business associates use HITRUST to harmonize HIPAA with other control sets. | The healthcare evidence pack can map collected safeguards to HITRUST CSF for the assessor. Certification remains the assessor's decision. |
| FDA device cybersecurityOfficial source ↗ | Device makers provide cybersecurity plans, software bills of materials, and postmarket vulnerability management. | Connected-device discovery and supply-chain records support premarket and postmarket expectations. Active tests stay inside an approved change window. |
| 21 CFR Part 11 | Electronic records and signatures must show who did what, and when. | The evidence chain records the actor, the action, and the time for the records the platform holds. |
Typical workflows
These workflows show how documented capabilities apply. They are not customer case studies, and they do not describe a guaranteed outcome.
PHI/DLP guardian · AI HealthCheck · medical-device assessment · incident response · evidence chain of custody
Select the installed agents and test their models, tools, permissions, and connectors before authorizing the mission. The available catalog depends on your deployment and release.
Agent verification and testing →HIPAA · HITECH · SOC 2 · ISO 27001 · NIST AI RMF · medical-device security practices
Set applicability for your assets, jurisdictions, and system boundaries. Connect control owners, current policies, technical tests, exceptions, and review decisions.
Explore regulatory evidence workflows →01
Define the customer profile, authorized assets, and responsible owners. Protect PHI, clinical workflows, medical devices, and AI used in care or operations.
02
Use PHI/DLP guardian, AI HealthCheck, medical-device assessment workflows with approved credentials and mission limits. Preserve source evidence and failures alongside findings.
03
Assign corrective work, obtain approvals, capture changes, and retest. Export the evidence, exceptions, and status history for business owners and assessors.
Questions for this sector
It maps evidence to the HIPAA Security, Privacy, and Breach Notification Rules and to HITECH, including risk analysis, business-associate tracking, safeguard evidence, and incident timelines. It does not make a covered entity or business associate compliant by itself.
The AI Firewall can redact personal and health information before a prompt reaches a model. Local models can keep inference on the customer's network. External model use for sensitive data stays behind approval.
A low-impact testing profile limits work to rate-limited discovery and excludes disruptive templates, so checks can be scheduled around clinical hours. Moving to a more active profile needs written approval.
Connected-device workflows inventory devices that should not be actively scanned and map findings to FDA premarket and postmarket cybersecurity expectations, including software bills of materials. Confirm the device standards that apply to your product.
