HealthTech · Virtual Care
From HITRUST Complexity to an Embedded Security & IT Partnership
Client Overview
- Industry: HealthTech, Virtual Care
- Company: Vheda Health
- Services: vCISO, HITRUST Readiness, Managed IT, Security Operations, Security Awareness, Vendor Risk Reviews, Incident Response, Penetration Testing Support
- GRC Platform: Vanta
- Engagement: March 2024 – Present
The Challenge
Vheda Health delivers virtual-first healthcare programs across chronic care, maternal health, and behavioral health. Operating in healthcare means security, privacy, regulatory requirements, and customer assurance are closely tied to everyday business operations.
As the organization worked through HITRUST readiness, the scope of security and compliance responsibilities continued to grow. The team needed to manage assessment requirements and remediation while also supporting employees, endpoints, cloud infrastructure, vendor security reviews, payer requirements, incident response, and day-to-day IT operations.
The challenge was no longer simply completing a compliance project.
Vheda Health needed additional security leadership and hands-on operational support that could work alongside its internal team and keep security, compliance, and IT moving together.
Com-Sec’s Approach
Com-Sec began by supporting Vheda Health’s HITRUST readiness program, helping the team interpret requirements, identify gaps, organize evidence, coordinate remediation, and prepare for assessment activities.
As the relationship developed, the engagement expanded into an embedded security and IT partnership.
Com-Sec provides ongoing vCISO leadership and works directly with Vheda Health on security governance, risk management, vendor security reviews, incident response, business continuity, cloud security, access management, security awareness, and compliance initiatives.
A dedicated Com-Sec IT support analyst also works directly with Vheda Health, providing hands-on support for day-to-day IT operations.
The program includes:
- HITRUST readiness and assessment support
- Ongoing vCISO leadership
- Managed IT and end-user support
- Microsoft Intune device management and compliance
- Security incident response and documentation
- Vendor security and risk reviews
- Penetration-test remediation
- AWS and GuardDuty security reviews
- Access management and onboarding/offboarding improvements
- Risk register and security governance management
- Phishing simulations and security awareness campaigns
- Security Champions initiatives
- Partner and payer security-assurance support
- Recurring security, compliance, and IT leadership meetings
Rather than treating compliance, security, and IT as separate projects, Com-Sec helped establish an operating model where these activities could be managed together.
The Results
The engagement has produced measurable improvements across Vheda Health’s security, compliance, and IT operations.
70 → 96
External SecurityScorecard rating improvement
123 users
Enrolled in Microsoft Intune for improved endpoint visibility and device compliance
Penetration-test remediation completed
Identified security findings were tracked through remediation
Embedded IT support
A dedicated Com-Sec IT analyst works directly with the Vheda Health team
Recurring security governance
Security, compliance, risk, and IT priorities are reviewed with leadership on an ongoing basis
Improved cloud-security visibility
AWS and GuardDuty security monitoring incorporated into ongoing security operations
Centralized IT support
IT requests and operational activities organized through established support workflows
Formalized security awareness
Phishing simulations, awareness communications, and Security Champions activities became part of the security program
Structured vendor risk management
Vendor security reviews and third-party risk activities are incorporated into ongoing operations
Ongoing HITRUST support
Assessment preparation, evidence management, remediation, and readiness activities are managed as part of the broader security program
More Than Compliance Support
The relationship with Vheda Health evolved beyond a traditional compliance engagement.
Instead of providing recommendations and leaving implementation to the client, Com-Sec works alongside Vheda Health across strategic security leadership and day-to-day execution.
The same team can help address a HITRUST requirement, review a security risk, respond to a partner questionnaire, investigate an incident, improve endpoint compliance, coordinate remediation, and support ongoing IT operations.
This gives Vheda Health a consistent security and compliance function without having to coordinate multiple disconnected providers.
Why Com-Sec
Healthcare organizations often need more than help preparing for an assessment.
They need someone who can connect compliance requirements with the technical and operational work required to maintain them.
For Vheda Health, Com-Sec provides that combination through an embedded model covering security leadership, compliance, technical security, and IT operations.
The result is a security program that operates as part of the organization rather than as a separate compliance exercise.
Need Security, Compliance, and IT to Work as One Program?
If HITRUST, security operations, and IT responsibilities are stretching your internal team, Com-Sec can provide the leadership and hands-on support needed to bring them together.
Talk to Com-Sec