Continuous HIPAA compliance for healthcare organizations — from single clinics through multi-site provider networks and DSOs.
OsirisCare is a compliance substrate purpose-built for healthcare. We install a physical appliance at each site, continuously monitor every control required by the HIPAA Security Rule and the 2026 HHS-OCR NPRM (published December 2024), and produce Ed25519-signed, hash-chained, OpenTimestamps-anchored evidence bundles your auditor verifies independently on their own laptop. No trust-the-vendor leap in the audit chain. Starting at $499/month per site, with fleet pricing for multi-site organizations and partner MSPs.
Built for the 2026 HIPAA Security Rule NPRM
HHS Office for Civil Rights published the first substantive revision of the HIPAA Security Rule in over twenty years on December 27, 2024. Nine technical safeguards are promoted from "addressable" to "required," including mandatory MFA, encryption at rest and in transit, vulnerability scanning every six months, penetration testing annually, documented network segmentation, and tested contingency plans. Read the full 2026 HIPAA guide →
| 2026 NPRM requirement | OsirisCare monitors with |
|---|---|
| MFA enforcement on ePHI access | mfa_enabled check, per host, per cycle, with signed evidence |
| Encryption at rest and in transit | bitlocker_enabled, filevault_enabled, luks_enabled, tls_version, smb_signing |
| Documented network segmentation | Cross-subnet device discovery with signed segmentation reports |
| Asset inventory with annual review | Continuous discovery across every site; timestamped signed exports |
| Vulnerability scanning every 6 months (NEW) | CVE Watch daily across every discovered device, signed per cycle |
| Patching with defined timelines | patching check plus time-to-patch metric per host per CVE |
| Incident response with BA coordination | Append-only signed remediation chain with actor and reason |
| Written, comprehensive risk analysis | Live crosswalk across 9 frameworks tied to real telemetry |
| Tested contingency plan | Backup validation and mesh failover exercises produce signed evidence |
One platform, every scale
Single clinic
One appliance on the LAN. Owner or practice manager as the designated Security Officer. 90-day pilot at $299 applied toward the first month on a paid tier.
Multi-location group
One or more appliances per site. Fleet-wide dashboards with per-site drill-down. Backend-authoritative mesh coordination. No per-seat metering.
DSO and health-system IT
Multiple appliances per site with deterministic failover via hash-ring target assignment. Cross-subnet discovery for multi-VLAN networks. Multi-framework crosswalk — HIPAA, SOC 2, PCI DSS, NIST CSF, CIS, SOX, GDPR, CMMC, ISO 27001 — one evidence chain.
Partner MSPs and compliance consultants
Multi-tenant partner portal with per-client row-level-security isolation at the database layer. Flat 20% partner margin. White-label client portal on Professional tier and above. See the MSP page →
Why cryptographic evidence matters
Traditional compliance platforms produce policy documents, screenshots, and platform-signed reports. That model is ending. Auditors increasingly ask: "can I verify this without trusting the platform that produced it?" OsirisCare's answer is built in. Every evidence bundle is Ed25519-signed with per-appliance private keys (the platform cannot forge a signature from an appliance it does not control), hash-chained (tampering breaks the chain), and anchored to the Bitcoin blockchain via OpenTimestamps (the timestamp is computationally unforgeable). The auditor downloads a ZIP containing README.md, verify.sh, chain.json, bundles.jsonl, pubkeys.json, and OpenTimestamps proofs. They run the script on their own laptop. The verification is independent of OsirisCare's infrastructure.
Three-tier self-healing
- L1 deterministic — pre-approved runbooks resolve 70–80% of incidents in under 100 milliseconds with no human.
- L2 LLM-planned — 15–20% of incidents get an LLM-generated remediation plan; shadow-mode by default, enforce-mode for partners who have pre-approved the class of action.
- L3 human-escalated — the remaining 5–10% reach the operator with full context: discovered devices, signed evidence, prior remediation attempts. No paging-tool noise.
What your auditor actually downloads
When the auditor needs evidence for the audit period, they receive a ZIP verifier kit containing the README with instructions, verify.sh (a shell script they run on their own laptop), chain.json (the full hash chain for the period), bundles.jsonl (every evidence bundle, one per line), pubkeys.json (per-appliance public keys with SHA-256 fingerprints), and ots/ (OpenTimestamps proofs for Bitcoin anchoring). Verification is a single script invocation. No OsirisCare API call, no OsirisCare cooperation, no platform dependency. If OsirisCare disappears tomorrow, every evidence bundle remains verifiable forever.
Resources
- 2026 HIPAA Security Rule — full guide to the 9 requirements
- For MSPs and compliance partners
- Pricing and fleet tiers
- OsirisCare vs Vanta
- OsirisCare vs Drata
- OsirisCare vs Delve
- Blog — HIPAA 2026, audit evidence, DSO-scale compliance
- Migrating from another compliance vendor
- Public changelog
Get started
Start a 90-day pilot → or book a demo if you are evaluating at multi-site or DSO scale.