Dates rather than adjectives.
A control appears here as in place only when the artifact evidencing it exists. Everything else is labelled roadmap, including the things our competitors would describe as “enterprise-grade”.
01 · Current status
In place, and not.
| Control | State | Evidence |
|---|---|---|
| AWS Business Associate Addendum | In place | AWS Artifact |
| Tenant isolation at the data layer | In place | Cross-tenant tests |
| PHI redaction in logs | In place | Automated test |
| Encryption in transit and at rest | In place | TLS 1.3, KMS |
| SOC 2 Type II | Roadmap | Window not started |
| CLIA / CAP certification | Roadmap | Gates clinical use |
02 · Two things commonly got wrong
Stated plainly, because the industry muddles them.
There is no such thing as “HIPAA certified”. The Department of Health and Human Services certifies no one. HIPAA compliance is a maintained posture evidenced by controls and a signed Business Associate Agreement. Any vendor selling you a HIPAA certificate is selling a readiness assessment with a misleading name.
CLIA certification is held by the laboratory, not the software. In the United States, the laboratory reporting a clinical result holds the certificate. GenoAccel supports a certified laboratory's compliance; it does not substitute for it.
03 · Approach
Compliance as a byproduct, not a project.
Most platforms treat compliance as a pre-audit scramble. The architecture here treats it as structural, because retrofitting it is materially more expensive: audit logging is append-only by database grant, results are immutable after terminal state, tenancy is enforced at the repository layer, and a build-breaking analyser rejects any hard-coded user-facing string so twenty-locale accessibility does not become a later tax.
The intent is that the evidence a SOC 2 auditor asks for is a byproduct of normal operation rather than a project run before an audit.
The SOC 2 observation window is wall-clock time. An auditor observes controls operating over three to twelve months; no amount of spending compresses it. That is why it is sequenced early rather than deferred to the point of customer demand.