Compliance engineering
Healthcare app development with HIPAA and SOC 2 controls built in
This is for healthcare startups that handle patient data, and for B2B companies whose customers now ask for a SOC 2 report. We build the technical controls an auditor will test: who can see what, what gets logged, how data is encrypted, how infrastructure changes, and the evidence that shows it all working.
It's the engineering side only. It isn't legal advice, and it isn't an audit. We work alongside your compliance lead and your auditor, and take on the parts of the work that live in code and cloud accounts.
What we do, and what we don't
We do
- Build access control, audit logging and encryption into your app and cloud.
- Put your infrastructure in code, so every change is reviewed and recorded.
- Map which vendors touch PHI or customer data, and which of them need a BAA.
- Set up evidence collection and answer your auditor's technical questions.
We don't
- Give legal advice or decide whether HIPAA applies to you.
- Perform the audit or issue a SOC 2 report. A licensed CPA firm does that.
- Replace your compliance lead, your policies or your compliance software.
The controls we build
Access control
Role-based permissions, so each person sees only the records their role allows. SSO and MFA for your team, and least-privilege service accounts.
Audit logging
A record of who viewed or changed sensitive data and when, stored where it can't be quietly edited.
PHI-safe logs
Application logs that help debug production without exposing patient data.
Encryption and secrets
TLS in transit, encryption at rest, and secrets in a secrets manager instead of code or config files.
Private networks
Databases and internal tools with no public IP, reachable only over a VPN.
Infrastructure as code
Every cloud resource in Pulumi or Terraform. Pull requests become your record of who changed what, and why.
SOC 2 readiness for startups
A SOC 2 report is an independent auditor's opinion on your controls. Security is always in scope, and availability, confidentiality, processing integrity and privacy are optional. Type I looks at a single point in time. Type II covers a period, usually several months, so the controls have to run every day, not just in audit week.
Scope
Decide which systems, data and trust criteria are in scope.
Gap assessment
Compare what you have with what your auditor will test, ranked by risk and effort.
Fix
Build the missing controls in code and infrastructure.
Evidence
Make each control produce its evidence as it runs, so the audit isn't a scramble.
What you get
Gap assessment
Your setup compared with SOC 2 criteria or HIPAA safeguards, with fixes ranked by risk and effort.
Access control and audit logs
Roles, permissions and an audit trail in your app and cloud accounts.
Encryption and private networks
Encryption in transit and at rest, managed secrets, and no public databases.
Infrastructure as code
Your cloud in Pulumi or Terraform, with every change reviewed.
Vendor and BAA map
Every vendor that touches PHI or customer data, and the agreement each one needs.
Evidence collection
Logs, reports and change history your auditor can sample without a scramble.
What we've done for clients
Crosby Health
HIPAA-safe foundations for senior care coordination
We owned authentication, permissions, Stripe payments and the data layer for Crosby360, which helps medical groups run CMS care programs like GUIDE for dementia care. HIPAA shaped every decision, down to logging that lets the team debug production without exposing patient data.
Read the Crosby Health case studyHexis
Rebuilding the platform behind elite sports nutrition
We built audit logging, access controls and data protection into the Hexis platform, and we're leading the company's SOC 2 audit. The audit is in progress.
Read the Hexis case studyEmblem
AI due diligence that cites its sources
We set up Emblem's Google Cloud infrastructure and led the security work behind its SOC 2 program. Emblem has completed SOC 2 Type II.
Read the Emblem case studyHow a project starts
From a free call to the end of the second week.
A free 30-minute call
Tell us what data you handle, who your customers are and what they're asking for: a BAA, a SOC 2 report or a security questionnaire. If you already have an auditor or a deadline, bring that too.
A fixed price, or hourly
After the call we send a fixed-price quote for a clear scope, or agree on hourly work at $100 to $150 an hour. A gap assessment is usually a fixed price. The fixes can be fixed-price or hourly, depending on how clear the scope is.
The first two weeks
- We review your architecture, cloud accounts, data flows and vendors, and trace where PHI or customer data goes.
- You get a gap list ranked by risk and effort, mapped to the controls your auditor will test.
- We start on the fixes that unblock the most, which are often access control and logging.
Frequently asked questions
Can you make our app HIPAA compliant?
We build the technical safeguards HIPAA expects: access control, audit logs, encryption and secure infrastructure. Compliance also covers policies, training, risk assessments and agreements, which your compliance lead owns. Treat our work as engineering, not legal advice.
Does HIPAA apply to our health app?
HIPAA covers healthcare providers, health plans and clearinghouses, and the business associates that handle PHI for them. A consumer fitness app that people sign up for directly is often outside HIPAA, though other privacy laws can apply. Ask a lawyer, and we'll build to whichever standard applies.
What's the difference between SOC 2 Type I and Type II?
Type I checks that your controls are designed properly at one point in time. Type II checks that they worked over a period, usually several months. Many startups get a Type I report first, then Type II.
How long does SOC 2 readiness take?
It depends on what's already in place, and the gap assessment tells you. A Type II report also needs an observation period, so plan in months, not weeks.
Do you work with our auditor and compliance software?
Yes. We answer the technical questions, build the controls they test and set up evidence collection. We don't replace your auditor, and we don't audit our own work.
Which cloud services can we use with PHI?
On Google Cloud and AWS, only the services covered by the provider's BAA, and each provider publishes that list. We check every service in your design against it and keep PHI out of tools that aren't covered.