We're not certified yet. Here's exactly where we are, and what we won't do until we are.

Where we are right now

8Medicore is pre-launch. We have not yet completed a SOC 2 audit, HITRUST certification, or formal HIPAA compliance assessment. We're building the infrastructure to those standards from the ground up — but we will not onboard production PHI (protected health information) until the relevant safeguards are independently verified, not just internally claimed.

HIPAA-aligned architecture

In Progress

Data handling, access controls, and audit logging are being designed against HIPAA's Security Rule safeguards from initial build — not retrofitted later. This includes role-based access control, encryption requirements, and minimum-necessary data handling principles baked into the architecture.

SOC 2 Type II

Planned

A formal third-party audit is planned ahead of our first production pilot onboarding. SOC 2 Type II specifically verifies that security controls operate effectively over a sustained period — not just on paper at a single point in time.

HITRUST

Roadmap

Targeted post-pilot, aligned with the procurement requirements most health systems require before signing an enterprise contract. HITRUST certification is a heavier lift than SOC 2 and typically follows it.

Encryption at rest & in transit

Built-In

All claim and policy data moving through the pipeline — ingestion, retrieval, drafting, storage — is encrypted end-to-end. This is foundational infrastructure, not a future milestone.

How we handle data during the pilot phase

• De-identified or synthetic claims data used for all early pilot testing
• No data shared across hospital systems or used to train models for other clients
• Every appeal draft routed through human review before submission — no autonomous action on PHI
• Transparent reporting to pilot partners as each certification milestone completes