PHI visibility
Locate your PHI
Identify patient data across medical records, billing, and other systems so you can apply safeguards where they’re needed.
HIPAA 
compliance.Done right. Done fast.
Protect patient data with a HIPAA program built for your business. We help implement safeguards for protected health information (PHI), backed by security tools and continuous monitoring.
Tailored to healthtech- Pentest included
- Continuous monitoring
HIPAA safeguards.
Put into practice.
Implement administrative, physical, and technical safeguards for electronic PHI, with evidence of how they operate.
Administrative safeguards
Build risk analysis, workforce training, and incident response into the processes your team follows.
Physical safeguards
Support workstation security with device encryption checks and continuous monitoring through our agent.
Technical safeguards
Implement and monitor access controls, encryption, and audit logging for systems that handle PHI.
Security tools
to protect PHI.
Test your safeguards, monitor systems, and collect supporting evidence in one platform.
IncludedPenetration testing
OSCE-certified experts test PHI-handling systems to check whether technical safeguards work as intended.
IncludedCode security
Scan for vulnerabilities before deployment to help protect PHI in your application.
IncludedDevice compliance
Check workstation encryption and screen locks continuously with our device agent.
IncludedAttack surface monitoring
Discover external assets around the clock and identify accidentally exposed PHI-handling systems.
IncludedSecurity training
Teach your workforce to handle PHI and spot threats through HIPAA training and phishing simulations.
IncludedRisk analysis
Assess risks to electronic PHI and identify the safeguards your environment needs.
Security first. Compliance follows.Build on your security.
Build on your security.
Keep PHI protected.
Reuse shared security work across frameworks, then address HIPAA-specific safeguards. Continuous monitoring helps keep your program current.
Security first. Compliance follows.Build on your security.
Build on your security.
Keep PHI protected.
Reuse shared security work across frameworks, then address HIPAA-specific safeguards. Continuous monitoring helps keep your program current.
Real security.
Starts with a closer look.
We test the systems you actually run, not a questionnaire. Every check shows what’s working, what isn’t, and which frameworks each gap touches.
One gap.
More than one framework.
Every result maps to the frameworks it belongs to. One gap can hold back several at once.
Your agent fixes what it can.
It prepares the fix, you approve it, and we retest. One verified fix counts toward every framework that needs it.
An expert handles the rest.
Some gaps need human judgment. Your Oneleet expert works through the details with you and verifies the result.
One fix. Progress everywhere.
The same security work moves SOC 2, ISO 27001, GDPR, HIPAA, FedRAMP and ISO 42001 forward together. Explore the checks they share.
HIPAA questions,
answered plainly.
PHI, safeguards, business associate agreements, and ongoing readiness.
Does HIPAA apply to a healthtech or SaaS company?
It can. Handling PHI for a covered entity or another business associate may make you a business associate. We review your services, customers, and PHI flows to establish scope.
What safeguards does a HIPAA program need?
The Security Rule requires administrative, physical, and technical safeguards for electronic PHI. Risk analysis guides appropriate measures, supported by clear responsibilities, workforce training, and ongoing evaluation.
Is a BAA enough to make us HIPAA compliant?
No. A Business Associate Agreement defines responsibilities and permitted PHI uses. You must also implement applicable safeguards and meet the commitments in that agreement.
Does using a cloud provider remove our HIPAA responsibilities?
No. You still need appropriate agreements, risk analysis, and safeguards. Responsibilities depend on the cloud services, their configuration, and how you use them.
Will we receive an official HIPAA certificate?
HHS does not recognize private HIPAA certifications as proof of Security Rule compliance. We help build and document a working program; your legal obligations continue.
What happens after the initial HIPAA setup?
Review risks, train staff, check safeguards, and maintain evidence as your systems, vendors, and PHI handling change.
Protect what matters.
Let’s build a HIPAA program around your PHI, systems, and healthcare customers.