A timestamped, indexed archive of every artefact supporting every control, exported in a format an assessor can navigate.
Primary audience: Auditors and enterprise customers
When an assessor, enterprise customer, or OCR investigator asks you to prove a control, the claim is worth nothing without the artefact behind it — and the artefact is worth little if it takes your team three days of folder archaeology to find it. The evidence package solves the second problem. It is the complete, indexed, timestamped export of everything supporting your programme, organised the way a reviewer works rather than the way your file server grew.
What is inside
The package wraps the standard SuperHIPAA report structure around a full evidence archive:
- Scope statement: entities, systems, and ePHI flows covered
- Assessment date and methodology
- Findings with rule citation, risk rating, and recommendation
- Prioritised remediation plan with effort estimates
- Evidence appendix listing what was reviewed
- Shareable summary version with finding detail suppressed
Beneath that sits the archive itself: every policy with its version history and approval record, every risk analysis, every training completion log, every BAA, every control artefact — each one timestamped, attributed, and cross-referenced to the control it supports. The index is the part reviewers thank you for: a control-to-evidence map that lets an assessor pick any requirement and land on the supporting artefacts in two clicks, instead of asking your team to produce documents one email at a time.
Why indexing is the actual product
Most organisations technically possess their evidence. What they cannot do is navigate it under pressure. An audit or an OCR data request arrives with a deadline, and the difference between a calm response and a scramble is whether evidence was organised before the request existed. The package’s structure — chronological within control, controls mapped to citations, everything dated — is designed so the person answering the request does not need to be the person who filed the documents. That also matters for continuity: compliance knowledge that lives in one employee’s head leaves when they do; an indexed package does not.
Who reads it, and for what
External assessors and auditors work directly from the index during fieldwork. Handing over a navigable package at kickoff typically compresses the evidence-request phase, which is the longest and most expensive part of most engagements.
Enterprise customers with serious vendor-security programmes sometimes ask for evidence beneath the summary — particularly for controls that affect their own data. Selected sections of the package answer those requests without improvisation.
Regulators. If OCR ever comes asking, requests arrive with tight response windows. An organisation that can export a complete, dated evidence package is in a categorically different position from one assembling documents under deadline.
Counsel and diligence teams during funding rounds or acquisitions, where “show us your compliance programme” is a standard diligence item and the quality of the answer affects the timeline.
How it is produced
Generated from your live workspace, then reviewed and signed by a named healthcare compliance lead. It is not an automated export with a logo on it, and it is not a consultant’s Word document disconnected from your data. It is both: the data is live, the judgement is human.
The human review step matters most here of all the report types: an evidence archive with gaps is worse than none, because it documents precisely what you were missing. Review confirms the package is complete against the control set before it carries anyone’s signature.
Refresh cadence
Point-in-time reports carry a date and a validity note. Most customers refresh annually, or ahead of a major procurement cycle, funding round, or insurance renewal.
Because the package is an export of a continuously maintained workspace rather than a manually assembled binder, regenerating it is an operation measured in minutes, not weeks. Many teams export on a fixed schedule and archive each edition, building a historical record of the programme — which is itself evidence of the “regular review” that the Security Rule keeps asking about.
Start where you are
Take the free readiness assessment — 24 questions, about eight minutes, no call required. You get a scored report identifying which required specifications you are missing and what to fix first. If it turns out you are further along than you thought, we will tell you that too.