Identity & access
- Unique named accounts with single sign-on and enforced multi-factor authentication
- Role-based, least-privilege access approved per client and per project
- Quarterly access reviews and same-day de-provisioning on role change or exit
Trust center
Security and compliance, built into delivery.
Our clients trust us with ERP records, financial data, customer information and protected health information. Security and compliance are designed into how we staff, connect, build and operate, not added at the end.
Frameworks
Aligned with the standards your auditors use
Our controls are mapped to recognized regulatory and industry frameworks, so your compliance team can assess us quickly.
HIPAA & HITECH
Privacy, Security and Breach Notification Rules for PHI. Business Associate Agreements signed before any PHI access.
GDPR & UK GDPR
Processor obligations, Standard Contractual Clauses and UK IDTA for international transfers.
India DPDP Act 2023
Data fiduciary and processor duties, grievance redressal and cross-border transfer rules.
CCPA / CPRA & U.S. state laws
Service-provider restrictions on use, retention and combination of personal information.
SOC 2 Trust Services Criteria
Security, availability and confidentiality controls mapped to the AICPA criteria.
ISO/IEC 27001 & NIST CSF
Information security management practices and control families used to structure our program.
PCI DSS scope reduction
Card payments handled by PCI-compliant processors; card data kept out of our systems.
OWASP ASVS & Top 10
Secure development standards applied to the applications and websites we build.
Controls
How we protect your data
Encryption
- TLS 1.2+ for all data in transit, including client VPN and SFTP channels
- AES-256 encryption at rest for databases, backups and managed endpoints
- Secrets held in managed vaults, never in source code or chat tools
Secure delivery center
- Badge-controlled production floor for healthcare and regulated work
- Clean-desk policy: no mobile phones, paper, printing or removable media at PHI workstations
- Client work performed through virtual desktops or client-hosted systems, so data never leaves the client environment
Infrastructure & endpoints
- Hardened, patched servers with network segmentation per client
- Company-managed laptops with full-disk encryption, EDR and USB storage blocked
- Daily backups with tested restores and documented recovery objectives
Monitoring & logging
- Centralized audit logs for access to systems containing client data
- Alerting on anomalous log-ins, privilege changes and data exports
- Log retention aligned to contract and HIPAA documentation requirements
People
- Background verification before access to client data, where lawful
- Confidentiality and acceptable-use agreements signed by every team member
- HIPAA, privacy and security-awareness training at onboarding and annually, with phishing simulations
Secure development
- Peer code review, dependency and secret scanning on every change
- Production data never used in development or test without de-identification
- Change management with approvals, rollback plans and release notes
Incident response
- Documented incident response plan with named roles and escalation paths
- Client notification within contractual timelines, and within 48 hours for personal data breaches
- Post-incident reviews with corrective actions tracked to closure
Healthcare
A HIPAA program built for outsourced revenue cycle work
Medical coding and billing teams handle some of the most sensitive data in any business. Our healthcare delivery runs under a dedicated HIPAA privacy and security program, so providers, billing companies and health-tech firms can extend their teams with confidence.
Explore medical coding & billing services- Business Associate Agreement executed before onboarding; subcontractor BAAs flow down to any approved vendor
- Minimum-necessary access: coders and billers see only the encounters and accounts assigned to them
- Work performed inside the client's EHR, practice-management or clearinghouse systems, or our access-controlled VDI
- No PHI by email, chat or the public website, and no PHI used for AI model training
- OIG/SAM exclusion screening of personnel assigned to U.S. healthcare clients
- Coding accuracy audits and documented provider queries, supporting compliant, defensible claims
- Designated HIPAA Privacy and Security Officer with annual risk analysis and policy review
Available for your security review
Procurement and compliance teams can request the following under NDA. We typically respond within two business days.
- Security questionnaire responses (SIG Lite, CAIQ or your own format)
- Information security and HIPAA policy summaries
- Data Processing Addendum and Business Associate Agreement
- Sub-processor list for your engagement
- Business continuity and incident response overviews
- Certificates of insurance, where required by contract
Responsible disclosure
If you believe you have found a security vulnerability in our website or a system we operate, please report it to support@consultifyit.com with enough detail to reproduce it. Please do not access or modify data that is not yours, degrade service, or publicly disclose the issue before we have had a reasonable chance to fix it. We will acknowledge your report promptly and will not pursue legal action against good-faith research that follows these guidelines.
See also: Privacy Policy · Terms of Service
Security questions we are often asked
Will you sign our Business Associate Agreement?
Yes. We sign a BAA before any protected health information is shared, and we routinely review and sign client BAA templates. Our standard business associate terms are also published on our Data Processing & BAA Terms page.
Does patient data leave our systems?
In most healthcare engagements, no. Our team works directly inside your EHR, practice-management system or clearinghouse through secure, access-controlled connections, or within our virtual desktop environment where nothing can be downloaded, printed or copied locally.
Can you work within our security requirements?
Yes. We adapt to client controls such as your VPN, SSO, device policies, data residency, named-user access and audit logging. Requirements are captured in the statement of work and our onboarding checklist.
How do you handle international data transfers from the EU and UK?
We use the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, with transfer impact assessments and supplementary measures such as encryption and strict access control.