Compliance
Every framework. Every page. On the record.
Conceptual Health is a regulated healthcare network operating under HIPAA, SOC 2, HITRUST, GDPR, state medical-practice acts, FDA pre-cert, and money-transmitter law in 49 states. This page is the index. The threaded posture is the long-form, framework by framework. The regulator portal is the cleared-access door.
Operating numbers
What the company looks like right now.
Framework grid
Twelve frameworks we live under. Eleven we honor.
The frameworks below are unfolded with status, owner, audit cadence, last-tested date, and the document an auditor can request on the threaded posture page. Tap into any framework name for the long-form record.
Honor
NIST CSF 2.0
Tier-4 Adaptive target. NIST 800-66 Rev. 2 as HIPAA-Security implementation reference.
Honor
Common Rule + IRB
45 CFR 46 — research-marketplace queries above threshold require IRB approval.
Cleared access
If you are a regulator or accredited auditor.
The regulator portal grants 24-hour cleared access to gated documents — SOC 2 Type II detail, pen-test reports, breach forensics, AI model cards, training records — for HHS OCR, HHS OIG, CMS, FDA, FTC, FinCEN, DEA, ONC, SEC, state AGs, state DOIs, state medical boards, state pharmacy boards, state DFRs, EU/UK Data Protection Authorities, PCI QSAs, FedRAMP 3PAOs, HITRUST assessors, and IRBs.
Direct contacts
Four officers. All inboxes monitored.
Privacy Officer: privacy@conceptualhealth.com
Chief Compliance Officer: cco@conceptualhealth.com
Chief Information Security Officer: ciso@conceptualhealth.com
24/7 SOC: soc@conceptualhealth.com