Healthcare services network, 12 locations, 800+ employees

The client operates a network of 12 outpatient healthcare facilities across three states, serving over 200,000 patients annually. Each location had been acquired or established independently over the past decade, resulting in a patchwork of IT systems, inconsistent security practices, and no centralized governance framework.

When a major health insurance consortium issued an RFP requiring SOC2 Type II certification as a prerequisite for a multi-year enterprise contract worth approximately $18 million in annual revenue, leadership faced an urgent problem. The existing security posture was decentralized at best: each location managed its own Active Directory instance, network infrastructure, and access controls with minimal coordination from a three-person IT team based at headquarters.

A preliminary internal assessment found no centralized logging and monitoring, no formalized information security policies, shared credentials for critical clinical systems, and no consistent access reviews or change management. Without significant remediation, achieving SOC2 Type II within the required timeline seemed impossible.

I brought in a small, dedicated compliance team that worked alongside the client's IT and operations staff through a structured four-phase engagement designed to drive rapid remediation and ensure audit readiness.

Phase 1: Gap Assessment

I conducted a comprehensive assessment against the AICPA Trust Service Criteria covering Security, Availability, and Confidentiality: on-site assessments at all 12 locations, interviews with 40+ staff across clinical and administrative roles, technical infrastructure reviews, and documentation audits. The assessment produced a detailed gap report with 127 discrete findings mapped to specific Trust Service Criteria.

Phase 2: Remediation Roadmap

Working with the client's CIO and compliance officer, I prioritized findings into three implementation waves based on audit impact and operational feasibility: critical infrastructure and access control gaps first, then monitoring and detection, then policy documentation and training. Each item was assigned an owner, a deadline, and measurable acceptance criteria.

Phase 3: Implementation

The team provided hands-on implementation support across several workstreams simultaneously: a centralized SIEM platform aggregating logs from all 12 locations, a unified identity and access management solution with MFA enforcement, standardized endpoint protection across all workstations, and automated vulnerability scanning for the entire network.

Phase 4: Audit Preparation

In the final month, I ran two internal readiness assessments simulating the actual audit process, prepared all required documentation, coached staff on audit interview expectations, addressed remaining evidence gaps, and coordinated directly with the client's chosen audit firm to align on scope and expectations.

Centralized Logging and Monitoring

Previously, each location maintained its own event logs with no aggregation, no alerting, and inconsistent retention (some locations had less than 72 hours of log history). I deployed a cloud-based SIEM platform ingesting logs from firewalls, Active Directory, EHR systems, endpoint protection agents, and network devices across all locations, configured 85 detection rules aligned to healthcare-specific threat scenarios, and established a 90-day log retention policy meeting both SOC2 and HIPAA requirements.

Identity and Access Management Overhaul

The organization had over 200 shared accounts across clinical and administrative systems, making it impossible to attribute actions to individuals. I consolidated identity management into a single directory with role-based access controls, enforced MFA for all remote access and privileged accounts, implemented quarterly access reviews with documented attestation from system owners, and established automated deprovisioning tied to the HR termination process.

Policy and Documentation Framework

The organization had fewer than five documented security policies, none reviewed in over two years. I developed a policy framework covering 23 domains, including acceptable use, incident response, change management, vendor risk management, data classification, business continuity, and physical security, each with defined roles, review schedules, and evidence collection procedures mapped to Trust Service Criteria.

Vendor Risk Management

With over 40 third-party vendors accessing patient data or supporting clinical operations, the organization had no formal vendor assessment process. I implemented a tiered vendor risk management program with standardized security questionnaires, contractual security requirements, and ongoing monitoring for critical vendors processing PHI.

The engagement concluded with the client achieving SOC2 Type II certification with zero exceptions on the very first audit attempt. The auditor noted the maturity and consistency of controls across all 12 locations as particularly impressive given the compressed timeline.

We went from a fragmented collection of clinics with no security governance to a unified organization with enterprise-grade security controls in under four months. Kishin didn't just help us pass an audit: the engagement fundamentally transformed how we think about security as a healthcare provider. The enterprise contract we won has already paid for it ten times over.

Beyond the immediate compliance objective, the client now maintains a continuous compliance posture with automated evidence collection, regular internal assessments, and a dedicated security operations capability. They have since won three additional enterprise contracts that would have been inaccessible without SOC2 certification, and their security program has become a competitive differentiator in the managed care market.