Medsense Health recently selected a partner to build a SOC 2 audit, an independent review of the controls we use to protect pharmacy and patient data. We expect to complete our SOC 2 Type 1 report by the end of 2026.
When our pharmacy customers run a clinical program with Medsense, they trust Medsense with sensitive information: patient health data, device readings, medication records and billing details. Pharmacies have always asked how we protect that data. Increasingly, regional chains, pharmacy networks and GPOs also ask for independent, 3rd party verification as part of vendor reviews.
SOC 2 is the standard way to give them that verification.
What is SOC 2?
SOC 2 is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). An independent auditor reviews how a company secures data across its systems, people and processes, then issues a formal report.
A Type 1 report confirms that the right controls are designed and in place at a point in time. After that, a Type 2 report, which is part of an ongoing process, confirms they keep working over a period of months. We're starting with Type 1, with Type 2 to follow in 2027 and every year thereafter.
What does SOC 2 mean for pharmacies?
Faster vendor reviews. Pharmacies and networks that require a security review will be able to request our SOC 2 report instead of working through long questionnaires.
Independent verification. Our security practices will be checked by an outside auditor, not just described by us.
No change to your program. Patients, devices and day-to-day workflows stay the same. This is work on our side.
Why now?
“Pharmacies are taking on more clinical work, and every patient they enroll means trusting a partner with sensitive health data,” says Matt Tabakin, MD, Medsense CEO. “SOC 2 lets us show them, through an independent auditor, that the trust is earned.”
SOC 2 builds on the safeguards Medsense already uses to protect patient health information under HIPAA.
“We've built security into the platform from the start,” says Matthew Burroughs, CIO. “SOC 2 puts those controls in front of an independent auditor and holds us to a recognized standard going forward.”
What's next?
We'll share an update when our Type 1 report is complete. In the meantime, pharmacies and partners who want to talk about data security and data privacy or vendor review requirements can reach us at: contact@medsense.health.