Companies across the healthcare ecosystem trust Thoropass
.svg)
.svg)
HIPAA can be complex, especially when interpreting safeguards, documenting controls, and preparing for assessments. Your dedicated compliance experts and auditors work with you from scoping through attestation, helping answer questions early, reduce surprises, and keep your program moving forward.
Compliance doesn't stop after an assessment. Thoropass continuously monitors controls, automates evidence collection from more than 100 integrations, and alerts your team to changes before they become audit findings. Stay ready for customer requests, internal reviews, and future audits without the last-minute scramble.
Many organizations need HIPAA alongside SOC 2, HITRUST, ISO 27001, or PCI DSS. Reuse controls, policies, and evidence across frameworks to reduce duplicate work, lower compliance costs, and manage everything from one connected platform.
After a technical deep dive, Thoropass experts help define the scope of your HIPAA assessment, understand your environment, and identify the teams, systems, policies, and safeguards that need to be reviewed.
Your team starts with a clear assessment plan, practical next steps, and visibility into the work ahead. Thoropass helps align stakeholders early so everyone understands evidence needs, timelines, and responsibilities.
Thoropass helps your team prepare for review by organizing key documentation, evidence, risk analysis materials, policies, procedures, and training records. Expert guidance helps reduce confusion and gives your team a more practical path through the assessment.
Thoropass performs a third-party assessment of the safeguards and practices in scope, including how your organization protects PHI and ePHI. Requests, evidence, comments, issues, and status updates are managed through Thoropass's audit lifecycle platform, giving your team and assessor one connected view of progress.
At the end of the assessment, Thoropass delivers a trusted report and attestation that can be shared with customers, prospects, and partners. Your team gets clearer evidence of the privacy and security practices that support healthcare trust.
Whether you are pursuing your first HIPAA assessment or looking for a better way to support customer assurance requests, Thoropass can help you complete the process with expert guidance, structured review, and a shareable third-party report.
TN Outsourcing
Thoropass has significantly streamlined our HIPAA compliance tasks.”
The platform automates many of the manual processes and provides clear, easy-to-follow workflows, reducing the time and effort required from our team.
Product
HIPAA
Industry
Contact Center
Company size
501-1000
Location
Uruguay
Emily Ingram
Business Development and QA Manager
TN Outsourcing
Organizations that create, receive, maintain, transmit, or access protected health information may need to evaluate how their privacy and security practices align with HIPAA. This commonly includes covered entities, such as healthcare providers, health plans, and healthcare clearinghouses, as well as business associates that support covered entities and handle PHI.
Protected Health Information, or PHI, is individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate. PHI can include information related to a person's health condition, care, payment for care, or other identifiers connected to healthcare services.
Electronic Protected Health Information, or ePHI, is PHI that is created, received, maintained, or transmitted electronically. The HIPAA Security Rule focuses on protecting ePHI through administrative, physical, and technical safeguards.
A HIPAA assessment reviews the safeguards, policies, procedures, documentation, and practices your organization uses to protect PHI and ePHI. This can include areas such as risk analysis, access controls, workforce training, incident response, business associate management, audit trails, and physical and technical safeguards.
The HIPAA Privacy Rule addresses how PHI can be used and disclosed and gives individuals rights related to their health information. The HIPAA Security Rule focuses on protecting ePHI and requires regulated entities to use administrative, physical, and technical safeguards to support the confidentiality, integrity, and availability of that information.
A HIPAA incident response plan outlines how an organization identifies, investigates, responds to, and documents potential security incidents involving PHI or ePHI. A clear plan helps teams respond more consistently, reduce the impact of incidents, and support breach notification analysis when needed.
Thoropass combines experienced assessors, a structured assessment process, and an audit lifecycle platform to help teams manage the HIPAA assessment from kickoff through attestation delivery. Your team gets clearer requests, organized evidence review, expert guidance, and a shareable third-party report for customers and partners.
Close
Leith Khanafseh
Audit Managing Partner, Thoropass Assurance
Leith founded and leads Thoropass’s Assurance practice, bringing 15 years of audit experience to the role. At Thoropass, he oversees the audit and assessment offerings, shapes product direction, and drives innovation that modernizes traditionally outdated audit practices.
Matt Udicious
Director of Infosec Assurance
Matt is a seasoned InfoSec assurance professional with over a decade of experience in cybersecurity, specializing in security, auditing, and compliance.
Matt’s career has included roles, across security, auditing, and compliance. He gained invaluable insights during his tenure as a former auditor, concentrating on SOC 2 compliance for technology companies within the prestigious Big 4 consulting firms. His meticulous approach and deep understanding of industry standards have made him a trusted authority in information security.
Bruce Edwards
Senior Manager, PCI Assurance
Bruce has more than 15 years of experience in security and risk management, both as an external consultant and an internal practitioner. His experience includes penetration testing, PCI QSA, ASV, and cloud security, and in his previous role as a security director, Bruce led PCI DSS assessments for Fortune 500 companies in the fintech and healthcare sectors, both in the U.S. and around the world.
.avif)
Lucas Baiocchi
Senior Manager, HITRUST InfoSec Assurance
Lucas has more than eight years of experience in information security audits and assessments. As Thoropass’ HITRUST InfoSec Assurance Senior Manager, he leads and executes HITRUST assessments, working closely with organizations to evaluate their security posture, validate control effectiveness, and deliver clear, actionable insights that align compliance objectives with broader business goals. His approach ensures not only regulatory and standards-based compliance, but also the adoption of efficient, scalable, and realistic security solutions.
Tom Miller
Senior Manager, Enterprise Team, InfoSec Solutions
Tom is an information security and technology audit leader with more than a decade of experience delivering assurance engagements for organizations ranging from large public corporations to high-growth startups. He owns Thoropass’ largest and most strategic client portfolio, leading complex multi-framework audits and serving as a trusted advisor to executive stakeholders on control design, security requirements, and remediation strategy.
Chris Beiro
Senior Director, InfoSec Solutions
Chris is a seasoned cybersecurity executive with over 15 years’ experience in compliance and audit. He has helped hundreds of organizations – from high-growth startups to Fortune 500 enterprises - strengthen their cybersecurity programs, meet rigorous compliance standards, and mitigate risk. Prior to joining Thoropass, he spent more than 13 years in cybersecurity and audit leadership roles at KPMG and Coalfire.
Austin Newcomer
Senior Manager, InfoSec Assurance
Austin is a Senior Information Assurance leader with more than eight years of experience and expert-level command of AICPA attestation standards. Prior to joining Thoropass, he spent three years at IT auditor Coalfire, where he supported clients ranging from Silicon Valley startups to Fortune 100 corporations.
Today, he leads more than 40 concurrent SOC 1, SOC 2, and HIPAA audits for emerging, mid-market, and enterprise technology companies, with particular depth in healthcare compliance and complex cloud environments across AWS, Azure, and GCP. His work spans the full audit lifecycle — assessing security procedures, reviewing configurations, interviewing control owners, and documenting results — including combined assessments across multiple compliance frameworks.
Emmanuel Amos-Abanyie
Head of Quality Assurance, InfoSec Solutions
As Head of Quality Assurance for InfoSec Solutions, Emmanuel leads the firm’s quality assurance program, driving consistency, technical excellence, and standardization across every audit engagement. He works closely with audit teams to strengthen audit methodologies, enhance reporting quality, and promote continuous improvement, helping clients receive accurate, rigorous, and reliable audit deliverables.
