SOC 2, HITRUST, and BAAs should be treated as starting points, not trust signals. They tell you what a vendor claims about its controls. They do not tell you whether those controls are actually working today or whether the evidence behind the attestation was real.
The post Healthcare’s Assurance Infrastructure Is Broken. The Compliance Industry Built It That Way appeared first on MedCity News.
