Security in healthtech: How to avoid compliance chaos with audit stacking

Cybersecurity is a moving target for the healthtech industry. Last year, there was a 264% rise in ransomware attacks — and the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) responded with actions to target organizations without proper security and compliance protocol.

There are no indications that the wave of system breaches to access sensitive patient data will slow down. Consider a few trends that will continue to create complexity in today’s security landscape:

• AI is sharpening as a double-edged sword: While AI is making it easier to deploy continuous and effective data security, it is simultaneously helping threat actors launch sophisticated attacks at scale.
• The enterprise attack surface is expanding: As the universe of medical IoT devices expands, so will the attack surface for bad actors to exploit vulnerabilities and find new points of entry.
• Telehealth is complicating data compliance: Providers working across states need to navigate both federal and state privacy laws and work harder to avoid unauthorized data tracking or sharing.

As these various dynamics play out, companies that sell technology services, solutions and devices to primary holders of health information need to purposefully adopt security frameworks that can cover their bases. For most organizations that deal with health data, that means pursuing a multi-framework approach — stacking audits like HITRUST, SOC 2 and more — to go beyond HIPAA’s spirit of the law for truly proactive, ongoing compliance.

But every organization needs to address different security requirements — and it’s not always easy to navigate big-picture compliance. Read on to discover how to think intentionally about audit stacking, and ways that healthtech organizations can get ahead of the complexity involved in layering multiple frameworks.

From certifications to reports: What’s in the stack?

As international, federal and state-level enforcement intensifies, there are a few major frameworks that are often required or strongly recommended to demonstrate robust security practices to their customers, stakeholders and potentially to regulators, auditors and governing bodies.  Each individual framework brings something unique to an enterprise, but areas of overlap can create complexity and confusion for organizations putting the pieces together.

Here’s a quick breakdown of a few common components in a multi-audit stack:

Challenges in audit stacking for healthtech companies

A multi-framework security compliance approach is a journey, and not a check-the-box process. Along the way, it’s common to encounter a few pain points at various levels of the audit stack.

For healthtech companies that may have limited compliance resources — such as startups and mid-sized SaaS providers — these pain points often boil down to efficiency. Here are three challenges that can be avoided with a well-defined enterprise strategy for audit stacking.

Challenge No. 1: Streamlining the audit cycle (so there isn’t constant chaos)

Multiple audits can easily overwhelm information security and IT staff that might already be at capacity. What are these teams up against? Multiple times a year, they might be gathering evidence, preparing for audits and responding to findings — not to mention trying to keep up with constant regulatory changes and addressing customer inquiries on their information security program.

Here’s what helps:

• Coordinating renewal dates and audit periods across audits
• Establishing annual or quarterly compliance seasons (e.g., Q3 is “audit prep”)
• Staggering audits to avoid disruption and to create efficiency

Challenge No. 2: Removing unnecessary duplication (so you’re not reinventing every wheel)

Each security audit has different terminology, evidence formats, scoping and cycles — but there is still notable overlap across requirements and standards. While some duplication is healthy for comprehensive security, healthtech companies don’t have time or resources to re-produce the same reports, scans or policies for multiple audits.

Here’s what helps:

• Identifying which controls and evidence can be collected once and then scaled across multiple audits
• Building a central control library that can feed HITRUST, SOC 2, HIPAA and more
• Automating repeatable compliance tasks or ongoing evidence collection with data platforms and AI

Challenge No. 3: Clarifying governance and sponsorship (so there’s real accountability)

A multi-framework approach to compliance requires cooperation across teams spanning legal, IT, HR, operations and more. Without executive sponsorship, healthtech organizations may end up with patchwork compliance. But security in healthcare is more than just protecting data — it’s about safeguarding patient information and well-being — so patchwork security is not enough.

Here’s what helps:

• Framing compliance as a growth strategy, not just a check-the-box IT effort
• Defining roles and accountabilities, from collecting evidence (e.g., IT) to training employees to comply with new policies (e.g., HR)
• Setting up a governance body to help ensure audits are deliberate and coordinated across the larger compliance stack

Embracing audits as a competitive differentiator

PHI is one of the most valuable types of data on the dark web. So, it’s no surprise that hospitals, insurers and enterprise health systems often demand multiple audits before contracting with a healthtech vendor — and regulators are raising the stakes for multilayered security.

While meaningful compliance requires investment, these security frameworks can also be growth enablers — shortening sales cycles, unlocking partnerships and encouraging investor confidence.

How Wipfli can help

As a trusted auditor and advisor that helps clients manage across the whole audit stack, Wipfli helps you position proactive compliance as a competitive differentiator. We turn a chaotic process into what we call a “one audit experience” for a manageable, efficient and strategic compliance journey.

For a unified approach, our team helps you:

• Decide which audits to prioritize based on goals and expected value.
• Map out all audits to cut duplicative efforts or unnecessary costs.
• Spot gaps between audits to reinforce with additional security practices.
• Oversee documentation and audit readiness to avoid rework.
• Stay updated to help ensure that regulatory changes are addressed before they cause audit issues.

Get in touch to learn about our many services, including SOC 2, HITRUST, HIPAA security risk assessments, tax and financial services, data and analytics integration — along with our change management capabilities that help healthtech companies roll out new strategies across people, processes and technology.

Read more:

• Regulatory shifts bring new strategies for healthtech leaders
• True or false? An authorized external assessor breaks down 9 common HITRUST certification myths
• Protecting PHI in the age of AI