Beyond automation: How Array Behavioral Care found a true audit partner in Thoropass

CHALLENGE

Scaling HITRUST compliance from scratch

As a technology-enabled behavioral health provider, Array Behavioral Care knew that earning HITRUST certification was a critical milestone. Patients and partners expected it, and the company needed to demonstrate a strong security posture to work with payors and expand its reach. 

As Perry Wilson, Director of Information Security at Array, began his hunt for a vendor he knew that they weren’t just looking for a tool, they were looking for a partner. With no previous HITRUST assessments to build from and no preexisting policies, the team needed more than a vendor, they needed support and expertise.

SOLUTION

Unified support, automations, and assessment

When the Array Behavioral Care team began their search, they were just looking for validated HITRUST assessors, that was until Thoropass entered the equation. Perry selected Thoropass in the end because it offered more than just compliance software.

Thoropass was the only solution to offer intelligent automations, in-house audit expertise, and proactive customer support—all within a single, unified platform. 

From day one, Thoropass partnered closely with Array Behavioral Care, helping them interpret HITRUST requirements, build documentation from the ground up, and stay focused on the right priorities.

‍

The Thoropass platform was instrumental in helping Array Behavioral Care draft, review, and publish more than 20 new policies in a matter of months. Using the AI-powered policy creator and pre-built templates, the team avoided the typical trial-and-error of writing documentation from scratch. In addition, their dedicated Customer Success Manager and Thoropass auditors offered clear, consistent guidance—walking the team through each step of the process and helping them maintain momentum.

RESULTS

Full attestation in 8 months, and sustained momentum

With Thoropass by their side, Array Behavioral Care went from zero documentation to a completed HITRUST attestation in just eight months. The team credited this success to the structured guidance, embedded support, and smart use of automation that allowed them to move quickly without sacrificing quality.

When reflecting on this progress Perry shared, “The thought of going through your first HITRUST attestation without Thoropass sounds impossible.”

What’s more, maintaining their HITRUST status has required very little ongoing effort. In their second year, the team avoided the heavy lift of manual prep and was able to cut down the compliance work significantly. Rather than rebuilding documentation or re-collecting evidence, they simply reviewed their policies, ensured all employees had completed their security trainings, and were ready to move forward. 

Perry shared, “this year, all we had to do was revisit policies and ensure security trainings were up to date. That was it.” By their own estimate, the Array Behavioral Care team saved at least three months of hands-on work compared to the previous year.

LOOKING AHEAD

Compliance that scales with the business

Array Behavioral Care now has a repeatable, sustainable process for managing compliance and the right partner to support future growth. With HITRUST in place, they’re able to demonstrate trustworthiness with partners, accelerate sales cycles, and reduce the internal burden of staying secure.

Thoropass continues to serve as their single source of truth for compliance– managing policies, automating evidence collection, and providing guidance as regulations and business needs evolve.

For Array Behavioral Care, compliance is no longer a blocker. It’s a strength.

To see similar results for your organization, Talk to a Thoropass Expert.

‍