Solutions · Healthcare

Clinical systems change daily. Show which changes were allowed.

HIPAA and GDPR ask you to protect the systems that hold special-category data. On servers patched, configured and integrated every week, the useful question is not whether something changed but whether the change was expected.

What is asked of you

Three constraints most tools ignore.

Uptime beats everything

Clinical systems cannot be taken offline to be inspected, and an agent that fights the host for CPU gets uninstalled by the first person it slows down.

Whatever you deploy, collects

Anything installed on a system holding patient data has to justify what it takes off the host.

Many sites, one small team

Hospitals, clinics and a data centre often sit under one team with one budget and one on-call rota.

Our answer

What it does within those constraints.

  1. Metadata, not your files

    Paths, hashes, sizes, ownership, package facts and, with the deep sensor, command lines and the user behind them. File contents do not leave the host, with one bounded exception that is listed in the open.

    What leaves the host

  2. It gets out of the way

    An adaptive governor targets a share of CPU, runs at low priority, and slows down file by file as the host gets busy rather than stopping and lurching.

    Footprint

  3. Sites separated properly

    Hospitals or units can be separated as sub-tenants, and the separation is enforced in the database with row-level security rather than in application code.

    The shape of it

  4. Expected change, marked as expected

    Change windows, suppression rules with an expiry date and standing allow rules mean a planned migration stops producing alerts without anyone turning detection off.

    Incidents and workflow

  5. Retention you set

    Retention periods are configurable per tenant, a legal hold overrides deletion, and what was purged is written into an enforcement log.

    Hosting, residency and retention

RuleNothing is trusted for having been there yesterday.

The server you inherit is checked too.

Clinical servers arrive with years of history. The first scan weighs every binary, library and package already on them against the original, so a change made before the install surfaces on day one instead of becoming part of the baseline.

the day-one timeline
system file altered · before the install · found in the first scanSee the proof: Nothing is trusted for having been there yesterday.
Control catalogues

Mapped to HIPAA, GDPR and ISO 27001.

  • HIPAA Security Rule
  • GDPR
  • ISO/IEC 27001:2022
  • KVKK Personal Data Security Guide

The mapping produces control statuses and evidence. It does not produce a certificate, and nothing here is legal advice.

Evidence

What an auditor gets.

  1. 01The audit trail is hash-chained, so an altered or removed entry is detectable.
  2. 02Reports export as PDF, CSV or JSON, with the control evidence attached.
  3. 03A breach and data-subject request register is part of the product, with the statutory clocks on it.
  4. What is handed overA record where a later edit shows up, and exports that leave the building.
Each piece of evidence leads to what is handed over at the end.
Boundaries

What it is not.

  • There is no HIPAA certification for a product, and we do not claim one. What exists is control mapping and evidence.

  • It does not discover or classify patient data, and it does not inspect what files contain. There is no data-loss prevention.

  • It does not delete personal data from your clinical systems. Retention and legal hold apply to its own records.

Bring your clinical estate to a demo.

Thirty minutes on servers like yours: what leaves the host, what the agent costs a busy server, and how a planned migration stays quiet.

Book a demo