Continuous compliance monitoring: how Salus watches for PHI risk
Compliance is not a binder you update once a year. How a security persona watches access in real time, contains a threat, and turns HIPAA safeguards into evidence you can show.
From annual attestation to continuous evidence
Most compliance programs are periodic: a policy review, an access recertification, an audit once a year. The gap between those checkpoints is where risk actually lives. Salus is built to make compliance continuous, so the HIPAA administrative, physical, and technical safeguards are not just documented, they are enforced and observable every day.
A Compliance area, visible to a lab director or administrator, presents the control posture directly: who has which access, what the audit activity looks like, and how the current configuration maps to HIPAA and SOC 2 criteria, with evidence a lab can export for an assessor.
A security persona that watches in real time
Eva is the security-monitoring persona. She continuously watches access patterns for the signals that precede a breach: repeated failed logins, unusually high volumes of PHI reads by one account, and access outside normal hours. When a pattern crosses a threshold, she raises a security incident, records it in the audit trail, and notifies the right people, rather than leaving it to be discovered in a quarterly log review.
Detection is only useful if it leads to action. From an incident, an authorized responder can contain the account immediately, and containment takes effect on the very next request, for reads as well as writes, so a compromised or misbehaving account is stopped in real time rather than at the next login.
Shared responsibility under the BAA
Running on Snowflake and AWS under signed Business Associate Agreements means the infrastructure layer, encryption at rest, physical data-center controls, and platform certifications, is inherited. But a BAA is a shared-responsibility model: the application still has to enforce access control, capture a complete audit trail, protect data integrity, authenticate users, and secure transmission. Salus owns that half deliberately, so the combined posture is defensible end to end.
Every sensitive action, including changes to the AI layer itself, is written to an append-only audit log, and each entry is inspectable in detail. When an assessor asks how a control is enforced, the answer is a record, not a recollection.
See it in your laboratory's context.
Explore the live demo, no login and no request form.