Case study · Healthtech / SaaS · Tampa, Florida, USA
A Florida healthtech company facing HIPAA exposure and enterprise security reviews put one ITSECOPS fractional CISO in charge — and came out with HIPAA compliance and a SOC 2 Type 1 report from a single control set, in under five months.
The client
A Tampa-based healthtech SaaS provider (~60 employees) whose platform handles patient scheduling and billing data for clinics across the Southeast — making it a HIPAA business associate with PHI in production. Hospital-system prospects had started demanding a SOC 2 report on top of HIPAA assurances.
The challenge
- Two overlapping obligations — HIPAA Security Rule and SOC 2 — and no security leadership to own either.
- A signed BAA backlog with clinics, but no documented risk analysis: the single most-cited HIPAA enforcement gap.
- IT was run by two sysadmins focused on uptime; security decisions defaulted to “later”.
- Cyber insurance renewal came back with a premium hike and a list of required controls.
What we did
- Fractional CISO, 1–2 days/week — owning risk, policy, vendor management and board reporting; backed by ITSECOPS compliance engineers and the 24×7 SOC for monitoring.
- One control set, two frameworks. HIPAA Security Rule safeguards and SOC 2 Trust Services Criteria mapped into a single control matrix — every control implemented once, evidenced once.
- HIPAA risk analysis across the platform, corporate IT and 25+ vendors; PHI data-flow mapping; BAA program cleaned up and centralized.
- Technical hardening with the in-house sysadmins: MFA and SSO rollout, EDR on all endpoints, encrypted backups with tested restores, Microsoft Purview DLP for PHI, logging into Sentinel monitored by our SOC.
- SOC 2 Type 1 — readiness, auditor selection and evidence walkthroughs managed by the vCISO; report issued with zero exceptions noted.
- Insurance leverage — the completed controls list went back to the carrier with the renewal.
Results
| Metric | Outcome |
|---|---|
| HIPAA risk analysis & remediation | Complete — first documented risk analysis in company history |
| SOC 2 Type 1 | Issued in month 5, zero exceptions; Type 2 observation window now running |
| Hospital-system deals | First enterprise hospital group signed after security review |
| Cyber insurance | Renewal secured; premium increase reversed after controls evidence |
| Security hires needed | 0 — fractional CISO + existing IT team + ITSECOPS SOC |
FAQ
Does a Florida healthtech company need both HIPAA and SOC 2?
Legally you need HIPAA if you touch PHI as a covered entity or business associate; commercially, hospital systems and enterprise buyers increasingly demand SOC 2 as proof. The efficient path is one control set mapped to both — which is exactly what a vCISO builds first.
What does a fractional CISO do that a compliance consultant doesn’t?
A consultant hands you findings; a fractional CISO owns outcomes — makes the risk decisions, runs the auditors, reports to the board and carries the program between audits. In this engagement the same leader answered the insurer, the auditor and the hospital’s security team.
How much does a vCISO cost in Florida?
A fraction of the $250k+ full-time market rate — retainers scale with days per week and audit season. Because ITSECOPS delivers globally, Florida clients get US-facing leadership with delivery economics most local firms can’t match.
HIPAA and SOC 2 with one leader, one control set
Get a fractional CISO and a scored gap analysis across both frameworks in two weeks.