Security & trust
The story starts with a person’s data. It continues with rules for its use, evidence for assessment and decisions to protect it.
PHI & PII · HIPAA · SOC 2 · ISO 27001 · COBIT
Follow the story01 · The information
First, understand the data we protect.
PII identifies a person, directly or indirectly. PHI is identifiable health information protected by HIPAA within its scope of application.
Laura requests an appointment. Her name and contact details identify her; the study linked to her record adds health information.
Recognizing the information is the first step in protecting it.
02 · Authorized use
Next, set rules for access.
HIPAA sets privacy and security obligations in the United States for covered entities and business associates. Its applicability depends on the organization, the service and the use.
Reception confirms Laura’s appointment. The clinical team views the study according to their responsibilities and permissions.
Purposeful access, clear policies and safeguards.
03 · The evidence
Trust needs evidence.
SOC 2 allows a service organization’s controls to be examined independently within a defined scope. We are preparing documentation and evidence for that process.
The clinic needs to assess how access is reviewed: the policy, control and evidence need to connect.
Documented controls. Preparation for an independent examination.
04 · Continual improvement
Review risks. Keep improving.
ISO/IEC 27001 defines requirements for an information security management system: assess risks, assign responsibilities and review controls. Our preparation aims to sustain that continual improvement.
The clinic grows and adds a location. Access and risks change; the assessment needs to be updated.
A management system with defined risks and responsibilities.
05 · The direction
Set direction. Define accountability.
COBIT offers a framework for technology governance and management, connecting business objectives, responsibilities and decisions. We use it as a reference for that direction.
Continuity of care is the priority. Leadership sets the goal; accountable owners coordinate execution and oversight.
Clear goals. Defined responsibilities. Decisions with direction.
Where we stand today
Preparation is underway. CalenBook does not yet hold its own SOC 2 report or ISO/IEC 27001 certification.
Let’s review your service scope, your organization’s requirements and the available evidence.
Let’s talk security
