# Medplum

Medplum is the open source healthcare developer platform that helps you build, test, and deliver any healthcare product or service.

## Compliance

HIPAA

SOC 2

ONC

HITRUST

## Resources

### SOC2 Report

[SOC 2 Type II Report 2025](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=6952139d6c3d7b7e70292635)

### Policies

[Asset Management Policy](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=683fd54510f2a651687c71fe)

[Human Resource Security Policy](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=683fd57c88f757d9739cbb90)

[Code of Conduct](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=683fd5a82eaec77d4cce960e)

[Third Party Risk Management Policy](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=683fd5d167e40c583d1ac18f)

[View 12 more](https://trust.medplum.com/resources#6a303a45010a0902f50fc969)

### Test Reports

[BC/DR and IR Tabletop exercise report](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=683fdf122131f0ea76fc8177)

[Penetration Test Report](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=686d60af4ae4b388ba32a13d)

### HITRUST

[HITRUST e1 Certificate](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=6a3035779978cbc38350b680)

[HITRUST Assessment Report](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=6a3035f898bfcc55e994cd37)

### ONC

[ONC Criteria](/content/docs/compliance/onc/index.html)

[CHPL Listing](https://chpl.healthit.gov/#/listing/11745)

### Other resources

[Medplum MNDA](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=686c51a61dcb60805126f945)

[Business Associate Agreement](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=686d1d262551f51834b7d859)

[HIPAA Attestation](https://trust.medplum.com/?requestAccessOpen=true&requestedResources=686e664e2e2dc7674434373f)

## Controls

Updated 17 minutes ago

[View all](https://trust.medplum.com/controls)

### Infrastructure security

- Unique production database authentication enforced
- Encryption key access restricted
- Unique account authentication enforced

[View 18 more Infrastructure security controls](https://trust.medplum.com/controls#infrastructure-security)

### Organizational security

- Asset disposal procedures utilized
- Production inventory maintained
- Portable media encrypted

[View 13 more Organizational security controls](https://trust.medplum.com/controls#organizational-security)

### Product security

- Data encryption utilized
- Control self-assessments conducted
- Penetration testing performed

[View 1 more Product security control](https://trust.medplum.com/controls#product-security)

### Internal security procedures

- Continuity and Disaster Recovery plans established
- Continuity and Disaster Recovery plans tested
- Cybersecurity insurance maintained

[View 32 more Internal security procedures controls](https://trust.medplum.com/controls#internal-security-procedures)

### Data and privacy

- Data retention procedures established
- Customer data deleted upon leaving
- Data classification policy established

## Subprocessors

[View all](https://trust.medplum.com/subprocessors)

**Amazon Web Services**  
• Cloud provider  
  
**Google Workspace**  
• Identity provider  
**Snowflake Inc.**  
• Cloud data warehouse and analytics infrastructure  
United States  
**Salesforce**  
• Sales  
Vanta connects to a company's core systems to continuously monitor these controls.