HIPAA compliance monitoring, built for your practice

Compliance monitoring for your practice. Clear answers, the same day.

Your practice's appliance checks the computers, servers and network at your clinic. When something drifts out of compliance, you'll see it that day, which machine and what changed, written for people, not log files.

Ready for the proposed 2026 HIPAA Security Rule: 10 control areas, 71 automated checks, mapped against the requirement.

Trusted from solo clinics to multi-location groups and DSOs. Built for HIPAA, and maps to SOC 2, PCI DSS and the other frameworks your partners may require.

Ready for the new rule, not scrambling to catch up

In December 2024, HHS proposed the most significant update to the HIPAA Security Rule in over twenty years. It is still a proposal, not yet final, but its direction is clear: nine safeguards that were once flexible would become firm requirements. OsirisCare gives your practice a clear, continuous view of where you stand on each of them, with evidence your auditor can verify independently. Preparing for the change becomes a matter of record, not a last-minute project. See what the nine requirements mean for your practice →

One platform, every scale

Single clinic

One appliance on the LAN. Owner or practice manager as the designated Security Officer. 90-day pilot at $299 applied toward the first month on a paid tier.

Multi-location group

One or more appliances per site that back each other up automatically. One dashboard with detail for each site. No per-seat pricing.

DSO and health-system IT

Multiple appliances per site that back each other up if one goes offline. Finds devices across every network segment for multi-VLAN networks. Multi-framework crosswalk: HIPAA, SOC 2, PCI DSS, NIST CSF, CIS, SOX, GDPR, CMMC, ISO 27001, with one evidence chain.

Partner MSPs and compliance consultants

Multi-tenant partner portal with per-client row-level-security isolation at the database layer. Flat 20% partner margin. White-label client portal on Professional tier and above. See the MSP page →

Why cryptographic evidence matters

Traditional compliance platforms produce policy documents, screenshots, and platform-signed reports. That model is ending. Auditors increasingly ask: "can I verify this without trusting the platform that produced it?" OsirisCare's answer is built in. Every evidence bundle is Ed25519-signed with per-appliance private keys (the platform cannot forge a signature from an appliance it does not control), hash-chained (tampering breaks the chain), and anchored to the Bitcoin blockchain via OpenTimestamps (the timestamp is computationally unforgeable). The auditor downloads a ZIP containing README.md, verify.sh, chain.json, bundles.jsonl, pubkeys.json, and OpenTimestamps proofs. They run the script on their own laptop. The verification is independent of OsirisCare's infrastructure.

Fixes your practice can choose

Nothing on your systems is changed automatically. Fixes are something your practice can choose to turn on, once it is comfortable. Until then you get clear findings with signed evidence attached, and your team decides what to do.

What your auditor actually downloads

When the auditor needs evidence for the audit period, they receive a ZIP verifier kit containing the README with instructions, verify.sh (a shell script they run on their own laptop), chain.json (the full hash chain for the period), bundles.jsonl (every evidence bundle, one per line), pubkeys.json (per-appliance public keys with SHA-256 fingerprints), and ots/ (OpenTimestamps proofs for Bitcoin anchoring). Verification is a single script invocation. No OsirisCare API call, no OsirisCare cooperation, no platform dependency. If OsirisCare disappears tomorrow, every evidence bundle remains verifiable forever.

Resources

Get started

Start a 90-day pilot → or book a demo if you are evaluating at multi-site or DSO scale.