Security and Privacy Overview

As a leading provider of data and analytics technologies and services, Health Catalyst has an unwavering commitment to deliver the highest level of information security and data privacy to its clients.

With safeguards that meet rigorous privacy certification standards, clients can rest assured that their confidentiality, integrity, and availability of nonpublic information is protected.

Protecting Our Greatest Asset

The confidentiality, integrity, and availability of our customers’ data is the focus of our security program.

Health Catalyst adheres to the regulatory framework of Health Insurance Portability and Accountability Act (HIPAA), with adequate measures for saving, accessing, and sharing individual medical and personal information.

Our cybersecurity approach builds its foundation on the National Institute of Standards (NIST) Cybersecurity Framework CSF—a cybersecurity infrastructure focused on preventing, detecting, and managing any security threat or risk.

Center for Internet Security:Health Catalyst operational standards are based upon CIS baselines and benchmarks that provide global standards for cybersecurity.

Health Catalyst Recognized as Cybersecurity Transparent Leader at ViVE 2023

Health Catalyst was recognized by Censinet and KLAS as one of twenty healthcare vendors who have achieved and sustained their KLAS Cybersecurity Transparent designation.

Learn More →

Current Third-Party Audits and Certifications

The Health Catalyst SOC 2 Type II report is an independent assessment of our control environment performed by a third party.The SOC 2 report is based on the AICPA’s Trust Services Criteria and is issued annually in accordance with the AICPA’s AT Section 101 (Attest Engagements). The report covers the 12-month period of June 1 through May 31, and details the design and operating effectiveness of controls relevant to any system containing customer data as part of the Health Catalyst Cloud hosting solution. The Health Catalyst SOC 2 report addresses three of the five Trust Services Criteria (Security, Availability, Confidentiality).

The American Institute of Certified Public Accountants (AICPA) has developed the Service Organization Control (SOC 3) framework for safeguarding the confidentiality and privacy of information that is stored and processed in the cloud.The Health Catalyst SOC 3 report, an independent assessment of our control environment performed by a third party, is publicly available and provides a summary of our control environment relevant to the security, availability, confidentiality of customer data.Follow the below links to access our available SOC 3 reports.

21 CFR Part 11 is the FDA’s regulations for electronic documentation and electronic signatures. This compliance audit considers Health Catalyst’s compliance with the administration as a business associate to our customers in relation to electronic records in Health Catalyst’s data platform. Compliance with 21 CFR Part 11 ensures that data is maintained safely and securely, to ensure data is not corrupted or lost. It also is centered on ensuring data integrity.

HITRUST^®: Leverages nationally and internationally accepted standards including ISO, NIST, PCI and HIPAA to ensure a comprehensive set of baseline security controls. Health Catalyst maintains HITRUST CSF^® Certification across three of its business unit products and platforms. The applicable platforms and supporting architecture included and the applicable HITRUST framework versions certified are:

Health Catalyst, Inc. (HITRUST CSF v9.x certified on 9/28/2022): Health Catalyst Data Operating System Platform, Touchstone, Care Management, and the Business Intelligence Application Platform.
Health Catalyst Interoperability (HITRUST CSF v9.x certified on 9/29/2022): HCI Application Suite, consisting of HCI Connect, HCI Notify, HCI Exchange, HCI Organize, and HCI Explore.
Embedded Application Suite (HITRUST 9.x on 8/12/2022).
KPI Ninja by Health Catalyst (HITRUST CSF v9.x on 4/18/2022): Ninja Universe.
Twistle by Health Catalyst (HITRUST CSF v9.x on 5/23/2023)

KLAS presents a high-level overview of Censinet’s more-detailed risk assessments. This information should not replace a more thorough provider-conducted cybersecurity risk preparedness process. KLAS has invited all vendors, at no cost, to complete a full cybersecurity preparedness evaluation with Censinet, a KLAS partner specializing in risk management, assessment, and operations across the healthcare IT industry.

Visit the KLAS report to see a full breakdown.

Meet Our Security Experts

Kevin Scharnhorst, CISSP, CISM, CPHIMS
‍‍Chief Information Security Officer, Health Catalyst

Stacey Jenkins, JD
‍‍‍Chief Compliance Officer,
Health Catalyst

“Health Catalyst has implemented best-practice data security and privacy standards to provide our clients with the highest information privacy, security, and compliance.”