Information Security
Security and Privacy Overview
As a leading provider of data and analytics technologies and services, Health Catalyst has an unwavering commitment to deliver the highest level of information security and data privacy to its clients.
With safeguards that meet rigorous privacy certification standards, clients can rest assured that their confidentiality, integrity, and availability of nonpublic information is protected.
Protecting Our Greatest Asset
The confidentiality, integrity, and availability of our customers’ data is the focus of our security program.

Health Catalyst adheres to the regulatory framework of Health Insurance Portability and Accountability Act (HIPAA), with adequate measures for saving, accessing, and sharing individual medical and personal information.

Center for Internet Security:
Health Catalyst operational standards are based upon CIS baselines and benchmarks that provide global standards for cybersecurity.

Our cybersecurity approach builds its foundation on the National Institute of Standards (NIST) Cybersecurity Framework CSF—a cybersecurity infrastructure focused on preventing, detecting, and managing any security threat or risk.
Current Third-Party Audits and Certifications

The Health CatalystSOC 2 Type IIreport is an independent assessment of our control environment performed by a third party.The SOC 2 report is based on the AICPA’s Trust Services Criteria and is issued annually in accordance with the AICPA’s AT Section 101 (Attest Engagements). The report covers the 12-month period of June 1 through May 31, and details the design and operating effectiveness of controls relevant to any system containing customer data as part of the Health Catalyst Cloud hosting solution. The Health Catalyst SOC 2 report addresses three of the five Trust Services Criteria (Security, Availability, Confidentiality).

美国注册会计师协会(AICPA)开发了服务组织控制(SOC 3)框架,以保护在云存储和处理的信息的机密性和隐私。Heal世界杯葡萄牙vs加纳即时走地th Catalyst SOC 3报告是由第三方对我们的控制环境进行的独立评估,可公开获取,并提供了与客户数据的安全性、可用性和保密性相关的我们的控制环境的摘要。
Follow the below links to access our available SOC 3 reports.
SOC 3用于健康催世界杯葡萄牙vs加纳即时走地化剂DOS,互操作性,Healthfinch和Able Health。
SOC 3 Vitalware

21 CFR Part 11 is the FDA’s regulations for electronic documentation and electronic signatures. This compliance audit considers Health Catalyst’s compliance with the administration as a business associate to our customers in relation to electronic records in Health Catalyst’s data platform. Compliance with 21 CFR Part 11 ensures that data is maintained safely and securely, to ensure data is not corrupted or lost. It also is centered on ensuring data integrity.
HITRUST®: Leverages nationally and internationally accepted standards including ISO, NIST, PCI and HIPAA to ensure a comprehensive set of baseline security controls. Health Catalyst maintains HITRUST CSF®Certification across three of its business unit products and platforms. The applicable platforms and supporting architecture included and the applicable HITRUST framework versions certified are:
- Health Catalyst, Inc. (HITRUST CSF v9.x certified on 10/22/2022): Health Catalyst Data Operating System Platform, Touchstone, Care Management, and the Business Intelligence Application Platform.
- Health Catalyst Interoperability (HITRUST CSF v9.x certified on 10/16/2020): HCI Application Suite, consisting of HCI Connect, HCI Notify, HCI Exchange, HCI Organize, and HCI Explore.
- Healthfinch (HITRUST CSF v9.x on 6/5/2020): Charlie Platform hosted by Amazon Web Services (AWS) and Employees’ Workstations.

KLAS presents a high-level overview of Censinet’s more-detailed risk assessments. This information should not replace a more thorough provider-conducted cybersecurity risk preparedness process. KLAS has invited all vendors, at no cost, to complete a full cybersecurity preparedness evaluation with Censinet, a KLAS partner specializing in risk management, assessment, and operations across the healthcare IT industry.
Visit theKLAS report看一个完整的分解。
Meet Our Security Experts

Kevin Scharnhorst, CISSP, CISM, CPHIMS
Chief Information Security Officer,
世界杯葡萄牙vs加纳即时走地

Stacey Jenkins, JD
Chief Compliance Officer,
世界杯葡萄牙vs加纳即时走地
H世界杯葡萄牙vs加纳即时走地ealth Catalyst实施了最佳实践的数据安全和隐私标准,为我们的客户提供最高的信息隐私、安全性和合规性。”