How do you ensure security and compliance in healthcare software projects?

“We scope secure development around the workflow, data and applicable obligations. For HIPAA-covered processing, this includes the client and business-associate responsibilities, a BAA where required, access controls, logging and security assessment. The delivery acceptance record describes tested controls and remaining responsibilities; a software release does not itself establish organization-wide compliance. Discuss your workflow and compliance scope.”