SOLUTIONS // HEALTHCARE · HIPAA · HITRUST

PHI governance, audit-ready by default.

VERTICALHHS OCR · BAA-ALIGNED

OCR enforcement is up 4× since 2024. HIPAA fines now routinely exceed $1M. PolicyCortex maintains continuous control over PHI environments — auto-remediating misconfigurations across cloud accounts the moment they drift.

Book 30-min demo Pricing

PolicyCortex governance — HIPAA-mapped control families with PHI boundary scope — Application view · /governance · HIPAA scope

MISSION READINESS

FRAMEWORK

HIPAA + HITRUST

● MAPPED

SAFEGUARDS

.308 / .310 / .312

● COVERED

BAA SCOPE

ALL CLOUDS

● DEFINED

OPERATIONS

24 / 7 LIVE

● ACTIVE

HHS OCR // ENFORCEMENTEffective ONGOINGScope: every covered entity + BA handling ePHIPopulation: ~700,000 entities

LIVE OPS // SAMPLE TENANT

STREAM

14:22:09okremediation.applied target=s3/phi-archive action=enable-encryption-at-rest

14:22:11infohipaa.evidence.captured safeguard=164.312(a)(2)(iv) status=PASS

14:22:14warndrift.detected resource=rds/clinical-db severity=HIGH phi-scope=YES

14:22:15okremediation.applied target=rds/clinical-db action=enable-tls-1.2 gates=3/3

14:22:18infoaudit.log.captured action=phi-access user=user-7a3b duration=00:04:12

14:22:21okbaa.scope.validated provider=aws boundary=defined

CAPABILITIES

CAP-01
PHI-aware scopingBoundary auto-detected; resources outside scope ignored.
CAP-02
Continuous control validation164.308 / .310 / .312 safeguards live-checked.
CAP-03
Audit-trail evidenceEvery PHI access logged · 6-year retention enforced.
CAP-04
BAA-aligned by defaultCloud provider BAAs honored without custom config.
CAP-05
Auto-remediationMisconfig fixed before OCR audit · rollback contract.
CAP-06
Breach-risk telemetryAnomalous PHI access flagged in real time.

OPERATIONS · 30-DAY PILOT

01
ScopePolicyCortex discovers PHI-bearing resources across cloud accounts.
02
BaselineHIPAA + HITRUST controls validated. Drift surfaces with AI confidence.
03
Hand offOCR-ready audit log + risk analysis · continuously regenerated.

FIELD-TESTED · FOUNDER OPERATED AT

DOE National LabActive consultant
MITRECybersecurity engineering
USAAFinancial-grade ops
FrontierProduction cloud architecture

CLEARANCES · PATENTS

DoD SECRETDoE Q

Founder runs every engagement personally. 4 U.S. patent applications filed.

FAQ

Does this satisfy HIPAA Security Rule?

Yes — 164.308 (admin), 164.310 (physical, inherited from cloud provider), and 164.312 (technical) safeguards are continuously validated. Evidence captured and retained for the required 6 years.

What about HITRUST CSF?

HITRUST CSF v11 controls are mapped end-to-end. Same engine, same evidence model — adds the certification-grade artifacts assessors expect.

How is PHI handled?

PolicyCortex processes configuration metadata, not PHI. Cloud APIs return resource state; PolicyCortex never sees patient records. BAA coverage provided where applicable.

State-level breach notification?

Anomalous access patterns flagged in real time, giving you the window to determine whether HHS notification (and state-specific notifications) are required before the 60-day clock starts.

PROCUREMENT · NEXT STEP

Connect a cloud. Walk away with HIPAA evidence.

$15,000 flat. Cleared founder runs the engagement. No hourly billing, no overages.

Book 30-min demo Full pricing