Accreditations, Security Certifications, and Awards

Blue Compass and WITS Security and Risk Mitigation

Our solutions comply with a large variety of federal and state laws, regulations, security standards, and corporate policies. Additionally, the Blue Compass platform is hosted in FEI’s Amazon Web Services (AWS) cloud, one of the most flexible and secure cloud computing environments today.

We maintain an annual SOC 2 Type 2 independent audit report, demonstrating our ability to meet key regulations and industry-defined requirements while appropriately managing risk. Our SOC 2 Type 2 report comprises all five (5) Trust Service Criteria (Security, Confidentiality, Processing Integrity, Availability and Privacy) as defined by the American Institute of Certified Public Accountants (AICPA). Additionally, internal security controls were designed and implemented to align to industry leading security frameworks such as:

• HIPAA Security Rule
• NIST Special Publication 800-53
• ISO 27001/2

Supporting Partners with Regular Staff Training, QA

Employees and consultants/contractors working on our projects receive yearly HIPAA training. Further, as part of our formal audit program, we contract an independent assessment firm to produce our annual SOC 2 Type 2 report for our clients. The combination of our formal audit program and satisfying our customers external audit requirements provides assurance that we are continually being assessed and diligently being active in safeguarding our products and customer data.

Additionally, we have the following assessments conducted on an annual basis:

• SSAE 16 SOC 2 Type II: Solution hosted in AWS, which conducts SSAE 16 SOC 2 Type II annual audits and is ISO 27000 and FEDRAMP certified.
• Penetration Testing: On no less than an annual basis, we engage an independent third party to perform both internal and external network penetration tests, activities that include physical and logical social engineering.
• Organizational IT Certifications: We earned CMMI ML3, ISO 20000 and ISO 9001:2015 (PMO only) certifications, which require annual third-party assessments and attest to the maturity of our information security program, systems development, and overall IT operations.

ONC Certification

• 170.315 (a)(1-2, 5, 9, 14)
• 170.315 (b)(1, 10)
• 170.315 (c)(1)
• 170.315 (d)(1-9, 12-13)
• 170.315 (g)(3-7, 9)

• WITS has integrated with NewCropRX’s Electronic Prescribing solution.
• WITS has integrated with Updox’s version 2016.0 Direct Messaging solution.

ONC Disclaimer: “This Health IT Module is compliant with the ONC Certification Criteria for Health IT and has been certified by an ONC-ACB in accordance with the applicable certification criteria adopted by the Secretary of Health and Human Services. This certification does not represent an endorsement by the U.S. Department of Health and Human Services.”

Certified Health IT Cost Disclosure

Real World Test Plan 2022

Real World Test Results 2022

Real World Test Plan 2023

Real World Test Plan 2024

Real World Test Results 2024

Real World Test Plan 2025

Real World Test Results 2025