Why Acme Health chose TrustVendor
Acme Health processes PHI for thousands of patients across its patient engagement platform. Their security team was spending three weeks per vendor review — collecting questionnaires, chasing SOC 2 reports, and manually verifying HIPAA BAA status across 80+ SaaS vendors. The annual point-in-time process meant a vendor could lose their BAA in February and the security team would not know until the next review cycle.
How it deployed
TrustVendor was deployed in a single sprint. The Vanta integration automatically closed their SOC 2 vendor review control. BAA status tracking was configured for all 80 vendors, with alerts routing to Slack when a BAA lapsed or a new subprocessor was added by any vendor handling PHI.
Results
Vendor review cycles dropped from three weeks to two days. The team now reviews exception alerts rather than running full assessments on a calendar. A subprocessor change at a telehealth API vendor — which would have gone undetected for months — was flagged within hours of the page update.