How Assemblage Health got SOC 2 Type II and its HIPAA risk analysis in one programme.
Assemblage Health builds Avnii, an AI app that helps healthcare providers with clinical documentation. It needed a SOC 2 Type II report and a HIPAA security risk analysis. We ran both from one kickoff and one roadmap, and about 20 weeks later the auditor issued the report and Assemblage accepted the risk analysis.
An AI app for clinical documentation.
Avnii helps healthcare providers turn patient encounters into structured clinical notes and spend less time on administrative work.
Avnii is built to handle electronic protected health information (ePHI), so alongside SOC 2 the programme covered HIPAA’s Security Rule.
What Assemblage needed.
Two pieces of assurance for the same product, planned together from the first week.
- 1
A SOC 2 Type II report on Avnii, covering all five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy.
- 2
A HIPAA security risk analysis of how Avnii handles ePHI, across administrative, technical and physical safeguards.
- 3
Policies and procedures for both, which our team wrote, so none had to come from Assemblage’s side.
What we did, step by step.
Our team wrote, mapped and prepared the work. Assemblage reviewed it, approved it and signed where only the client can sign.
- 01Kickoff
A kickoff package in the first week: a scoping questionnaire, an ePHI asset inventory template, a sample data-flow diagram and a RACI matrix that set out who owned each part of the work.
- 02Data flows
A data-flow diagram of how ePHI moves through Avnii, drafted by us and revised with the team that builds it, followed by a walkthrough of the product.
- 03Risk
The risk register, the ePHI asset inventory and a draft risk treatment plan, in Assemblage’s hands within three weeks of kickoff. The treatment plan came with suggested actions for Assemblage to decide on, and we went through the completed registers together.
- 04Evidence
A SOC 2 evidence checklist, then the evidence itself, gathered with the team and organised into structured folders for the auditor.
- 05Policies
35 policy and procedure documents, written by our team and delivered in four batches for Assemblage to review. They run from the code of conduct, access control and incident response to encryption, secure coding, third-party risk, business continuity and data subject requests.
- 06Templates
Four templates alongside the policies: inbound and outbound business associate agreements (BAAs), a data protection impact assessment (DPIA) and a service level agreement (SLA).
- 07Cloud
Step-by-step guidance on accepting the AWS Business Associate Addendum in AWS Artifact, and a check that the AWS services in use were HIPAA-eligible. The addendum was in place the same day.
- 08Training
A one-hour workshop for the team on HIPAA’s Security and Privacy Rules, the HITECH Act, business associate agreements, privacy by design, the minimum necessary standard and penalties, with written minutes afterwards.
- 09Privacy policy
Proposed wording for the public privacy policy on business associate duties, breach notification and data subject rights.
- 10Risk analysis
The HIPAA security risk analysis, following NIST SP 800-30, NIST SP 800-66 and HHS Office for Civil Rights guidance, across administrative, technical and physical safeguards and the full life of ePHI in Avnii.
- 11Audit
The liaison with the auditor, from handing over the structured evidence to delivering the signed SOC 2 Type II report to Assemblage.
What we handed over.
- A SOC 2 Type II report on Avnii covering Security, Availability, Processing Integrity, Confidentiality and Privacy, issued by the auditor in January 2026.
- A HIPAA security risk analysis, accepted by Assemblage in January 2026.
- The risk register, the risk treatment plan and the ePHI asset inventory.
- 35 policy and procedure documents, with BAA, DPIA and SLA templates.
- The ePHI data-flow diagram and the RACI matrix.
- A HIPAA security and privacy workshop for the team, with written minutes.
From August to January.
- August 2025
Kickoff, with one roadmap for the SOC 2 Type II report and the HIPAA security risk analysis. The kickoff package went out within the week, then the ePHI data-flow diagram and the product walkthrough.
- September 2025
We delivered the risk register, the draft risk treatment plan and the ePHI asset inventory, went through the completed registers with Assemblage and issued the SOC 2 evidence checklist.
- October 2025
The AWS Business Associate Addendum was accepted with our guidance, and we ran the HIPAA security and privacy workshop.
- November 2025
We proposed wording for the public privacy policy on business associate duties, breach notification and data subject rights.
- December 2025
We completed the HIPAA security risk analysis after review rounds with Assemblage.
- January 2026
Assemblage accepted the risk analysis, and the auditor issued the SOC 2 Type II report, about 20 weeks after kickoff.
Let’s plan your SOC 2 and HIPAA together.
Tell us what you are building and where you stand today. We will map SOC 2 and HIPAA as one programme with you, drawing on 1,000+ audits and 300+ SOC 2 engagements.
Related Reading
HIPAA Compliance
US health-data rules for healthtech and business associates.
Read moreHIPAA Knowledge Hub
Privacy Rule, Security Rule, BAAs, cloud guides and penalties.
Read moreSOC 2 for Healthtech
Where SOC 2 meets HIPAA for healthcare SaaS selling into the US.
Read moreSOC 2 Overview
The AICPA attestation US and global enterprise buyers ask for.
Read moreCase Studies
Client stories from AI, healthtech and air cargo teams, and representative engagements by sector.
Read moreProof & Track Record
Every number we publish — explained, sourced and verifiable.
Read more