Healthcare · Identity Governance for ePHI Environments

Close the revoke gap.
Epic to AWS,
in 30 days.

Identity governance for the systems that touch ePHI — and the contractors who rotate through them.

Hospital IAM teams have a specific problem the cloud-first vendors don't address: Epic, Oracle Health (Cerner), and legacy clinical systems sit alongside Workday, Okta, and AWS — and the contractor population (residents, locums, travel nurses, vendor reps, BAA-bound third parties) rotates every 30-90 days. Termination-to-revoke gaps on ePHI systems are an OCR enforcement risk waiting to happen.

30-Day Proof of Revoke on your real Epic + AD + cloud stack. Outbound-only mTLS. Immutable SHA-256 evidence chain. HIPAA § 164.308 mapped. BAA available with the Founding Partner agreement. SOC 2 audit underway, target Q3 2026.

Plan a 30-Day Proof of Revoke See HIPAA mapping Check Connector Fit
The ePHI Access Gap

30 days.
Not 30 months.

A rotating contractor population, an 18-month enterprise IGA migration, and an OCR audit letter in the same quarter is not hypothetical — it's last Tuesday. STRATUS proves closed-loop revoke across your scoped systems in 30 days, with auditor-grade evidence, while the bigger program continues.

Industry baseline

4h 17m

Average termination-to-revoke gap across FY2025 enterprise studies. In healthcare the gap compounds with credentialing, on-call rosters, and visiting-clinician arrangements legacy IAM was never designed to track.

STRATUS lab measurement

8 seconds

Closed-loop revoke across AD, Okta, and AWS in lab validation — HR event in, sealed Evidence Pack out. Production timing varies by connector maturity, approval policy, and clinical-system workflow.

Inbound exposure

0 ports

Hybrid Connector Gateway dials outbound over mTLS from inside your VPC. No inbound listener, no VPN tunnel to clinical networks, no firewall change request to the hospital network team.

Methodology: 4h17m reflects the mean termination-to-revocation gap across 47 enterprise studies (FY2025). 8 seconds is the measured lab time across AD, Okta, and AWS. Customer production timing varies by connector maturity tier, approval policy, target system API rate limits, and workflow-dependent paths.

Built for the hospital, not the cloud-native unicorn

Four pillars for real ePHI environments.

01 · EHR coverage

Epic and Oracle Health, governed without rip-and-replace.

Many EHR environments were not designed around modern IGA-grade lifecycle APIs. STRATUS treats them as legacy targets — discover and evidence work today through existing user-management surfaces; certify is partial; revoke is workflow-driven or partner-dependent depending on your specific EHR configuration and gets validated explicitly during Days 1-7 of the POC. Maturity is named, not promised.

02 · Contractor offboarding

Residents, locums, travel nurses, vendor reps — all closed-loop.

The fastest-turning identity population in your hospital is the one most likely to keep live access after their contract ends. STRATUS treats contract-end events as first-class HR signals — not afterthoughts — and fans out revoke across the systems that contractor actually touched, with sealed evidence for the compliance file. Travel-nurse rotations stop being a quarterly cleanup project.

03 · Break-glass discipline

Emergency access without an evidence gap.

Break-glass access in clinical environments isn't optional — but it's the most-reviewed line item in any OCR audit. STRATUS captures break-glass grants as explicit elevated-access events with rolling expiration, paired approvers, and a hash-chained record that survives the patient-care-first urgency that created it. Auditor sees the why, the who, and the proof it auto-expired.

04 · Evidence for OCR / state DOH

SHA-256 chain. S3 Object Lock. HIPAA-mapped.

Every revoke, every certification, every break-glass grant, every contractor offboarding lands in an independent immutable evidence chain separate from your application and database audit controls — under Object Lock in Compliance Mode, with customer-controlled retention, tamper-evident within the configured evidence boundary. When OCR sends the letter, you produce proof, not policy.

Healthcare Control Mapping

Compliance,
mapped to STRATUS modules.

The frameworks healthcare orgs actually have to satisfy. STRATUS doesn't claim certification on your behalf — it gives you mapped policy rationale and the evidence to defend the control.

HIPAA § 164.308 — Administrative Safeguards

"Workforce access management for ePHI."

  • (a)(3)(ii)(A) Authorization & supervision — birthright + approval workflows
  • (a)(3)(ii)(B) Workforce clearance — HR-event-driven JML
  • (a)(3)(ii)(C) Termination procedures — closed-loop revoke with sealed Evidence Pack
  • (a)(4) Access management — JIT for ePHI systems
  • (a)(5)(ii)(C) Log-in monitoring — UEBA across clinical SSO + EHR

HITRUST CSF — Access Control Domain

"Mapped policy rationale, not a certification claim."

  • 01.b User registration & deregistration
  • 01.c Privilege management — JIT, SoD, periodic review
  • 01.d User password management — passwordless / MFA passthrough
  • 01.e Review of user access rights — risk-weighted campaigns
  • 01.h Removal of access rights — closed-loop with cryptographic receipt

42 CFR Part 2 — SUD Records

"Heightened access controls for substance-use-disorder records."

  • Separate access policy + decision path for Part-2-flagged systems
  • Stricter approval graph (no implicit role inheritance into Part 2)
  • Independent evidence chain segregated from general ePHI evidence
  • Auto-revoke if cross-policy consent expires or is withdrawn
  • Patient consent linkage captured in the Evidence Pack at grant time

Joint Commission · Medical Staff Standards

"Credentialing + privileging tied to system access."

  • MS.06 Credentialing — credentialing system as authoritative source
  • MS.07 Privileging — privilege-driven access provisioning
  • Locums & visiting clinician handling — time-bounded access
  • Re-credentialing date triggers — auto-revoke if not refreshed
  • FPPE / OPPE-aware role assignment (where credentialing supports)

STRATUS is not HITRUST CSF certified and not HIPAA-attested today; alignment is documented and a BAA is available with the Founding Partner agreement. Full mapping and the Healthcare Evaluation Packet available under NDA — request via [email protected].

Coexistence · Not Replacement

Already running SailPoint for enterprise IGA?

You don't have to wait 18 months for the next phase of your SailPoint program to deliver value on contractor offboarding and EHR-side revoke evidence. STRATUS sits adjacent, runs the 30-day Proof of Revoke on the systems your current program hasn't reached, and produces independent OCR-ready evidence — without disturbing what's already running.

Layer · Evidence

Traditional IGA audit trails often depend on application-layer and database controls. STRATUS sits adjacent and writes SHA-256 hash-chained Evidence Packs to S3 Object Lock in Compliance Mode — independent of the source IGA's audit layer. Same compliance evidence requirements. Independent proof layer.

Layer · Coverage

The clinical targets your IGA struggles with — Epic, Oracle Health, legacy AD edges, contractor on-call rosters — are governed via outbound-only HCG. No firewall change requests to the EHR vendor's hosted environment. No VPN to clinical networks.

Run a 30-Day Proof of Revoke on your real Epic + AD + cloud stack.

Plug in the Hybrid Connector Gateway. Within 72 hours we surface every former employee, contractor, locum, travel nurse, and vendor still holding live access across your scoped systems. By Day 30 you have a closed-loop revoke on a real production target with an auditor-grade Evidence Pack sealed in S3 Object Lock. Paid Founding Partner engagement, credited toward year-one contract upon conversion.