Security your IT lead can verify
HIPAA, hosting, access, accessibility and incident response, in the detail a vendor review asks for.
You’ve been asked to prove your websites are compliant, and your IT lead needs specifics. Everything on this page is how we operate today.
Requests arrive at the edge, where attacks are turned back before they reach your site. Clean traffic goes through encrypted, and patient details from a form go straight to a separate system, so the website never holds them.
Written for the two people who sign off
If you run marketing
Your CEO asks whether the websites are HIPAA compliant and you don’t have a clear answer. Your agency says it’s handled but can’t tell you what that means, so you forward emails between IT and the vendor and hope something concrete comes back. We handle the technical side and give you the documentation to show leadership.
If you run IT
You’ve read enough vendor questionnaires to know “we take security seriously” means nothing. You need to know who has access, where data goes, how backups work and what happens during an incident. Each of those has a specific answer below.
HIPAA starts by keeping PHI off the website
- No PHI on the site
- We architect sites to keep protected health information out of the website layer entirely. Forms, scheduling tools and patient portals hand off to third-party systems built to hold it, so your websites never store PHI.
- Encrypted in transit
- Every site runs on SSL/TLS with HTTPS enforced. We provision, renew and configure the certificates, so nothing lapses and no traffic travels unencrypted.
- Analytics that fit healthcare
- We’ve moved healthcare groups off standard tracking before. Whether you’re weighing server-side analytics, a CDP or an alternative to GA4, we’ll tell you what works.
Hosting security, from the edge to the backups
CDN and web application firewall
Malicious traffic and known attack patterns are filtered at the edge, before a request reaches your sites.
DDoS protection
Mitigation is automatic and keeps sites online under attack, with nothing for you to manage.
Patch management
WordPress core, plugins and themes update on a managed schedule, and security patches go out promptly.
Separate staging and production
Changes are tested on staging before they reach a live site.
Uptime monitoring around the clock
Synthetic monitoring runs on every site, so we usually know about a problem before you do.
Automated backups
Every 6 to 24 hours, kept for 30 days. Recovery tests are available through a support retainer.
Access control and data handling
Every account gets the least access its job needs, and your IT team can see exactly who has what.
| Capability | Admin | Editor | Local manager |
|---|---|---|---|
| Content editing | Yes | Yes | Yes |
| Plugin management | Yes | No | No |
| User management | Yes | No | No |
| Theme changes | Yes | No | No |
| Compliance settings | Yes | No | No |
How we handle your data
- Defined retention practices, with data deleted once it’s no longer needed
- Full exports if you leave, so your data goes with you
- Cookie consent, data subject requests and privacy policies handled for CCPA and GDPR as part of maintenance
WCAG Level AA, without overlays
We design and remediate to Level AA in the code, never with a widget. Scope and timeline depend on portfolio size, third-party tools and existing technical debt.
When something goes wrong
No vendor can promise zero incidents. This is the plan if one happens.
Put us through your vendor review
Security questionnaires, vendor assessments and compliance reviews are routine for us. We’ve done them with enterprise healthcare groups, and we won’t slow your timeline with vague answers.
What we can send your team
- Completed security questionnaires
- Infrastructure and architecture documentation
- Access control and data handling policies
- Incident response procedures
- Accessibility compliance reports
- References from similar healthcare groups
Bring your IT lead to the call
We’ll walk them through the architecture and answer their questions on the spot.