Passing HIPAA and SOC 2 with a team that owns compliance
A clinical decision-support SaaS had to pass HIPAA, SOC 2 Type II and GDPR audits and stop depending on vendors for compliance. We rebuilt the platform alongside its engineers, then stepped back.
The product outgrew its compliance model
The platform serves clinical teams in North America and Europe, integrates with EHR systems and handles protected health information across hundreds of daily transactions. It was still running on an architecture built for fast MVP iteration, while HIPAA, GDPR and a coming SOC 2 Type II audit waited.
The internal team was strong on product features and had no in-house healthcare compliance expertise. A Big Four security consultancy had already delivered a long audit report and a fixed-price remediation quote. The team's ability to stay compliant after that project ended had not changed.
The brief: pass the audits, and never need a vendor for compliance again.
PHI without boundaries
Protected health information flowed through 140+ endpoints with no consistent classification or boundary enforcement.
Gaps an auditor would find
Access controls were uneven at the database layer, internal service-to-service traffic was not always encrypted, and audit logs existed only in some services.
Releases with no security gate
Deployments were bi-weekly and manual with no security scanning. The team had read the HIPAA Security Rule but had no way to turn it into engineering practice.
Four decisions that left compliance with the client's team
One service pattern instead of eight
Eight diverging service patterns were codified into one standard covering APIs, error handling, eventing, persistence and observability. New services are generated from templates, so squads can't easily drift apart again, and every standard links to an Architecture Decision Record that explains the trade-off.
Build the platform team from inside
Instead of waiting on external hires, we formed a platform team from two existing senior engineers. Together we built self-service deployment on Kubernetes with GitOps, a service catalog and a paved road for new services.
Put security checks into the pipeline
The first CI/CD security pipeline was built in the opening months, with client engineers pairing on every significant change. Compliance became part of shipping instead of a separate gate, and the team now ships PHI-handling features faster than before the rework.
A CoE the client runs itself
We helped design the company's Engineering Centre of Excellence, a rotating group of five senior engineers who own standards, the platform roadmap and engineering practices. MetaProject did not sit in it. Every artifact lived in the client's systems from day one, including a co-written engineering handbook and a skills matrix of who owns what.
Months 1–4 · Co-execution
We led the architecture rework and security pipeline. Client engineers paired on every change.
Months 5–7 · Transition
Client engineers led feature work. We moved to review and mentoring.
Months 8–9 · Self-sufficiency
Internal CoE in place. HIPAA and SOC 2 Type II audits passed without us.
After month 9 · Counsel
A monthly counsel role, ad-hoc and strategic.
The client passed its next audits without us
The exit was planned from kickoff, and the client's leadership knew from week one which milestones marked self-sufficiency. By month 9 the internal CoE was in place, and the client's first independent HIPAA and SOC 2 Type II audits were passed without MetaProject in the audit response.
External compliance help went from every audit to occasional strategic counsel. The weekly tech talks we started became a practice the team kept running after we left.
3 of 3
target audits passed on the first attempt
4
compliance champions owning all reviews
5
senior engineers in the rotating internal CoE
0
data-related security incidents in 18 months
100%
first-attempt pass on HIPAA, SOC 2 Type II and GDPR DPIA
140+
endpoints migrated without service interruption
92%
test coverage, up from 31%
5×
deployment frequency: bi-weekly manual to daily automated
6 wks
new-engineer onboarding, down from six months
0
data-related security incidents in 18 months
Five capability layers, each handed to the internal team before the next: architecture standards, an internal developer platform, a product delivery model, an Engineering CoE and knowledge-transfer systems.
AWS multi-region with EU data residency · EKS + Lambda · PostgreSQL on RDS with row-level security · DynamoDB · OPA · Trivy · Snyk · Vault · AWS KMS · GuardDuty · GitHub Actions + ArgoCD · Auth0 SAML SSO with MFA
Questions about this project
How do you pass HIPAA, SOC 2 Type II and GDPR audits on the first attempt?
By turning compliance into engineering practice: consistent classification and boundaries for protected health information, access control at the database layer, encrypted service-to-service traffic, audit logging everywhere and security checks in the CI/CD pipeline. The client passed all three target audits on the first attempt.
Can a product team stay compliant after the consultants leave?
That was the brief. We built the platform alongside the client's engineers, trained four compliance champions who own all compliance reviews, and helped set up an internal Centre of Excellence. By month 9 the team passed its next HIPAA and SOC 2 Type II audits without us in the audit response.
Does compliance work slow down feature delivery?
Not when it is built into the pipeline. Releases went from bi-weekly and manual to daily and automated, test coverage rose from 31% to 92%, and the team now ships features that handle health data faster than before the rework.
How long did the engagement take?
Eleven months in total. The client's team was self-sufficient from month 9, and our role after that became occasional strategic counsel.
Can you share the client name?
The client name is withheld under NDA. Get in touch if you'd like to discuss the engagement in more detail under a mutual NDA. We can walk through the architecture and operational decisions at a level not appropriate for public material.
See more cases
Could your team pass the next audit without consultants?
Tell us what you are building. We will come back with an honest view of how we would approach it.