It seems everyone understands that a SaaS Hosting Facility must be certified at the highest current federal standards. But no-one seems to question why their EHR vendor, who has access to the same patient ePHI, hasn’t completed the same examinations.
The following information is provided to help explain why your EHR vendor should be examined by an independent third party, what SOC is, why Medicat chose the more rigorous Type 2 SOC 2 Examination on your behalf, and what that means to you.
The short version is that the Sarbanes Oxley Act (SOX) requires all publicly traded companies to establish internal controls and procedures for financial reporting to reduce the possibility of fraud. To properly conduct this financial statement examination, an audit must be performed for any organizations that affect the security or financials of the publicly traded organization. All such organizations should also be audited using SOC 1 (financial reporting) or SOC 2 (security reporting). The same holds true for privately held Hosting Facilities and their relationship with their clients (e.g., EHR vendors); both should pass audits at the highest Federal and Industry standards to ensure the security of your students’ ePHI.
Service Organization Control (SOC) reports—created by the American Institute of Certified Public Accountants (AICPA)—are internal control reports on the offerings furnished by a service organization, which provide important information for users to appraise the risks involved with an outsourced service. These reports are essential for service providers to build trust with clients, as they are performed by an independent third party.
SOC 2 reports focus on service providers that host or store data, ensuring that they are following industry best practices and their operations are up to code. The SOC 2 report contains a description of the infrastructure, software, people, and procedures (the “system”) that the company has in place to protect and safeguard data. A SOC 2 report contains descriptions of what components the company has and what it does to make sure it successfully delivers on the five Trust Service Principles.
Service organizations can choose which type of SOC 2 audit to undertake: Type 1 or Type 2.
Type 2 SOC 2 compliance is an outstanding standard for business owners and decision makers because it provides them with the peace of mind that the service provider they choose can deliver what it promises.
A company that has performed Type 2 SOC 2 Examination has therefore proven that its system is designed to keep its clients’ sensitive data secure over time. When it comes to the cloud and related IT services, such performance and reliability is essential, and is being required more often by regulators, examiners, and auditors.
Medicat’s Private Cloud Infrastructure ensures the storage and handling of your students’ electronic Patient Health Information (ePHI) meets and exceeds all government and industry standards. There are two components of that infrastructure:
These rigorous requirements provide an important level of confidence and comfort when considering a move to the cloud. It is critical to insist on an EHR partner that has achieved a level of security that meets these standards.
That is why SOC 2 audits matter, and why Medicat has invested in the highest compliance possible; the Type 2 SOC 2 Examination. After all, the security of your patients’ data depends on it!
© Medicat, LLC