HIPAA cloud compliance evidence, ready before the audit
HIPAA asks you to safeguard electronic PHI wherever it lives, and in the cloud that means configuration: encryption, access and exposure on every store that may hold it. Onam gives health systems, payers and digital health companies visibility into those controls, re-checked on every scan.
One platform for healthcare teams
Security evidence is covered in detail below. Inventory, cost and recovery work from the same discovery, so your cloud accounts are connected once.
Auditors start with what you run. Onam Estate keeps one inventory of every discovered resource across accounts and regions, and records every discovery run — so the asset list carries its own provenance instead of being an export from last quarter.
Posture, identity, data security and compliance evidence for healthcare workloads. The detail is on the rest of this page.
Billed and effective cost side by side, cost attributed to owners and cost centres with the unattributed amount stated plainly, and forecasts as low, expected and high figures. Read-only: accepting a saving records a decision and changes nothing in your accounts.
Regulators expect tested recovery plans. Onam DRM maps applications and what they depend on, predicts RTO and RPO against the targets you set, records the drills you run with your own tools, and measures drift from the recovery model you approved. It plans and records; it does not run the failover.
Onam AIOps
Early accessAI agents that investigate your Onam Security data with evidence on every claim, and propose changes a person approves. Nothing changes your cloud without that approval.
What healthcare teams solve with Onam Security
PHI discovery across every data store
Onam labels data stores — S3 buckets, Azure Storage accounts, RDS databases, BigQuery datasets and more — as likely PHI from their metadata: names, descriptions, tags and schema. Each labelled store is checked for encryption, access and public exposure on every scan.
Encryption-at-rest & in-transit assurance
Managed data services are checked for encryption at rest, TLS enforcement and key-rotation settings. Non-conforming resources are surfaced at the next scan.
Access to PHI stores — who and why
Observed access from cloud audit events over the last 30 days shows which principals touched each PHI-labelled store, and with which operations. Identity permissions sit alongside in CIEM, and attack paths that end at a PHI store are scored as reaching a crown jewel.
HIPAA audit evidence
Control status and timestamped evidence per control, mapped to HIPAA and exported as PDF or CSV for your compliance officer and assessors.
Regulations & frameworks Onam Security maps to
Security Rule safeguards mapped to cloud checks; process controls are marked for manual review.
Control families mapped to cloud checks — for organizations that report in NIST terms.
Trust Services Criteria evidence, collected from every scan, for vendor risk reviews.
Annex A controls mapped to cloud checks, with evidence per control.
For US health orgs with EU cohorts — data-residency, DPIA-relevant controls, and access logging.
Why healthcare teams choose Onam
PHI labels that drive priority
Stores labelled as likely PHI raise the findings and attack paths that reach them, so the riskiest gaps come first.
Evidence per control
Timestamped evidence for each HIPAA control, exported as PDF or CSV.
Classification without opening your data
PHI labels come from metadata. Onam does not open objects, query rows or sample files.
Works for health systems, payers, and digital health
One control set covers hospitals, insurers and digital health apps.
Evidence, in the Onam Security console.
An animated walkthrough of Onam console views with demo-account data — compliance scores, FAIR-style risk estimates and data classification.
Questions we get a lot
See Onam on your healthcare cloud
Security evidence mapped to your frameworks, one inventory of what you run, cost you can attribute, and a recovery plan you can check — on one platform.