Medical ANS operates as an extension of your security and compliance teams. Below is what we maintain, and what we make available to clients in writing.
Our technical and administrative safeguards are mapped to HIPAA's network and security requirements. We sign Business Associate Agreements as part of every engagement, and our quarterly business reviews surface evidence-collection artifacts your auditors will want.
Our internal control set is aligned to the HITRUST CSF — particularly for managed-services clients who need to evidence vendor controls to their own auditors. Available on request.
We're in active SOC 2 Type II readiness, with a target attestation period closing in Q4. Letters from our auditor are available under NDA for clients in evaluation.
Every managed-services engagement has a named principal engineer. Incident escalation is one phone number with a one-hop bridge to the engineers who designed your network — not a ticket queue.
Not aspirational — operational. Every client network we manage runs against this baseline.
A note on language. We use "HIPAA-aligned," "HITRUST-aligned controls," and "SOC 2 readiness" deliberately. These are accurate descriptions of program state — not certifications. If a vendor tells you they're "HIPAA-certified," ask which certifying body issued it. There isn't one.
For procurement, security questionnaires, or BAA requests, write to [email protected].
We respond to security and procurement questionnaires within five business days. Most evaluations close in one round.
