Empyric Health Compliance

Notes from the field

Short, practitioner-level posts on the frameworks that actually come up — written for people who have to implement them, not just cite them.

HITRUST

7 min read

Scoping a HITRUST assessment without over-scoping your budget

The single most expensive mistake in a first HITRUST engagement isn't a failed control — it's a scope drawn too wide before anyone understood which systems actually touch covered information. A tighter, well-justified scope shortens the assessment, lowers the invoice, and still holds up under review, as long as the boundary logic is documented the way an assessor expects to see it.

The teams that get this right start with a data flow diagram, not a control checklist, and they draw the CSF scope line around systems, not departments.

SOC 2

5 min read

What a SOC 2 Type II observation period actually expects of you

A Type I report proves your controls exist on a given day. A Type II proves they held for the whole observation window — typically three to twelve months — and that difference changes what "ready" means. Evidence has to be collected continuously, not assembled retroactively, which means the operational habit matters more than the initial control design.

Startups moving from Type I to Type II underestimate this almost every time, and it's the single biggest driver of a delayed report.

HIPAA

6 min read

The HIPAA risk assessment isn't a form, it's a decision record

Most HIPAA risk assessments fail an audit not because the risks were wrong, but because the document reads like a checklist instead of a record of reasoning — what was considered, what was accepted, and why. An assessor doesn't just want the list of risks; they want to see that leadership actually made a decision about each one.

That distinction is the difference between a risk assessment that holds up and one that just exists.

More posts land here as the practice grows — always general framework discussion, never a specific client or engagement.

Independent guidance for the moments a bigger firm can't reach.

Advisory Calls

SME Consulting & Advisory

Compliance Templates

Notes from the field

Scoping a HITRUST assessment without over-scoping your budget

What a SOC 2 Type II observation period actually expects of you

The HIPAA risk assessment isn't a form, it's a decision record

Compliance templates

HIPAA Risk Assessment Toolkit

SOC 2 Readiness Checklist

Incident Response Plan Template

Vendor Risk Questionnaire

About