/ Guide / Healthcare

HIPAA compliant IT services are defined by what gets signed and what gets recorded.

HIPAA compliant is a claim every IT provider makes and no IT provider can make on your behalf. HIPAA responsibilities apply to covered entities and business associates as applicable. Surya provides the technical safeguards, handling practices and records within its contracted scope. Your organization retains its wider compliance program, clinical decisions and access policy. Where the contracted work makes a provider a business associate, it signs a business associate agreement for that work, operates to a written standard and produces the records a review asks for.

This page lists what to require, and states what Surya signs, what it operates and what stays with your organization.

Find your starting point →

/ How it is run

The clinic roster runs it: June, Ana, Theo, Nora and Sam, with Nora producing the evidence, on dedicated agentic compute at RTP. Meet the hires →

/ What to require

Five things to ask for before the word compliant means anything.

  • A signed business associate agreement where the contracted work creates, receives, maintains or transmits protected health information.
  • A written device and configuration standard applied at every location, not per technician.
  • Serial-level custody records for every device that moves.
  • Certified media sanitization to NIST 800-88, with a certificate per device.
  • An independent audit of the provider's own controls: a SOC 2 Type II report.

/ What Surya signs

The agreement and the attestations.

  • A business associate agreement is available for contracted work that involves protected health information.
  • HIPAA-aligned handling at every site in scope.
  • SOC 2 Type II audited, covering Surya's own controls. Report available on request under NDA. It is not a certificate of your organization's compliance.
  • Certified data erasure to NIST 800-88, with a certificate filed against the serial number.
  • Serial-level chain of custody.

HIPAA responsibilities apply to covered entities and business associates as applicable. Surya provides the technical safeguards, handling practices and records within its contracted scope. Your organization retains its wider compliance program, clinical decisions and access policy.

/ What Surya operates

Controls as operating practice.

  • Configuration baseline. Supported device configurations and the agreed security baseline are applied when a module enters service, not after the fact.
  • Identity and access. Identity, sign-in and secure access are operated to the standard in the tenant the customer owns. Access to the Surya RTP Distribution Center is controlled and logged.
  • Endpoint protection and updates. Endpoint protection and update handling for supported devices are operated within the standard.
  • Support records. Requests, troubleshooting and changes inside the supported environment produce an operational record available for review.
  • Device custody. Devices in Surya's custody are tracked by serial number, and every handoff, return and swap is documented.
  • Media sanitization. Drives are erased to NIST 800-88 where erasure applies, with a certificate per device, before approved disposition.
  • Vendor responsibilities. A business associate agreement is available. Clinical application and equipment vendors retain their own responsibilities.
  • Incident escalation. Issues needing a vendor, a physical action or your approval follow an agreed escalation path with named owners.

Routine infrastructure analysis uses configuration and telemetry rather than patient records. The agreed data-flow controls and applicable contracts govern device handling and any ePHI involved in the purchased service. Device and media handling follows the contracted scope. Surya covers the technology that supports the clinical device: the workstation, printer, network connection and supported computing layer. The clinical device itself remains under the authority of the healthcare organization and its medical-equipment vendor unless separately qualified and contracted. We work up to the port, not past it.

/ What stays with you

Your program, your decisions.

  • The risk analysis, policies and workforce training.
  • Clinical application vendors and their own agreements.
  • Access decisions and data authority.
  • Medical equipment vendors and the clinical device itself.

Find your starting point.

Tell us how many locations hold devices near protected health information and what your last audit asked for.

Find your starting point