Enterprise-Grade Security

Trust, Security & Compliance at SPRY

Healthcare organizations rely on SPRY across clinical, operational, and financial workflows. Protecting the information behind those workflows requires more than a single certification.
‍
SPRY combines independently assessed security controls, healthcare-specific privacy safeguards, standards-based interoperability, and responsible data governance to protect the organizations and people who rely on our platform.

SOC 2 Type II
HIPAA Compliant
ONC Certified Health IT
Book a Demo

Recognized Standards. Meaningful Assurance.

Certifications and compliance frameworks matter because they provide an external standard for how healthcare technology is built, operated, and held accountable.

SOC 2 Type II — Controls tested over time

SPRY has completed a SOC 2 Type II examination.

A Type II examination assesses the design and operating effectiveness of in-scope controls across a defined period. It provides independent assurance that the controls supporting the platform are not simply documented, but are operating over time.

What it means: independent validation of the operational controls behind SPRY's security program.

HIPAA — Safeguards built for protected health information

SPRY is designed to support the privacy and security requirements of the Health Insurance Portability and Accountability Act (HIPAA).

Technical and administrative safeguards help protect protected health information across the platform, while Business Associate Agreements establish SPRY's responsibilities when handling PHI on behalf of covered entities.

What it means: healthcare data is handled within a framework designed specifically for protecting PHI.

ONC Certified Health IT — Certified for modern, connected healthcare

SPRY has achieved ONC Health IT Certification, formally recognized as Certified Electronic Health Record Technology (CEHRT).

ONC certification evaluates health IT against federal criteria spanning areas such as interoperability, standardized data exchange, privacy, security, and functionality.

What it means: SPRY meets applicable federal certification requirements for health technology designed to participate in a connected healthcare ecosystem.

Security Built Across the Platform

Security is designed into how SPRY stores information, controls access, monitors activity, and operates its infrastructure.

Encryption — Sensitive information is encrypted at rest and in transit using industry-standard protections.
Role-Based Access — Permissions help ensure users can access the information and workflows appropriate to their roles and responsibilities.
Audit Logging — Platform activity is logged to support visibility, traceability, and accountability.
Secure Infrastructure — SPRY operates within secure, monitored infrastructure environments designed to protect the systems and data supporting clinical, operational, and financial workflows.
Ongoing Security Practices — Security controls and practices are reviewed and strengthened as the platform, its capabilities, and the security landscape evolve.

Privacy & Data Governance

Healthcare data requires clear ownership, appropriate access, and responsible handling throughout its lifecycle.

Your Data Remains Yours — Organizations retain ownership of their patient and operational data.
Purposeful Access — Role-based permissions help control access across clinical, billing, administrative, and operational responsibilities.
Responsible Data Use — SPRY does not sell customer data.
Data Access & Portability — Organizations can access and export their information in accordance with applicable requirements.
Record Stewardship — SPRY maintains processes to support the preservation, retrieval, and appropriate retention of clinical, billing, and operational information.

Privacy & HIPAA Alignment

SPRY supports clinics in meeting HIPAA and patient privacy requirements. Privacy at SPRY is treated as an operational discipline — not a one-time compliance exercise.

Our privacy approach includes:

HIPAA-aligned workflows and access safeguards
Business Associate Agreements (BAAs) available for covered entities
Separation of clinical, billing, and operational user permissions
Ongoing internal review of privacy and access practices

Built to Connect

Secure healthcare technology also needs to exchange information with the systems around it. SPRY supports standards-based and API-driven connectivity across clinical, operational, and administrative workflows.

HL7 & FHIR — Support for established healthcare interoperability standards helps information move between SPRY and connected healthcare systems.
APIs — SPRY APIs support connectivity across scheduling, patient and clinical information, eligibility, authorizations, documents, tasks, and other supported workflows.
Webhooks — Event-driven notifications allow connected systems to respond to supported activity across SPRY.
Flexible Integration — SPRY supports multiple integration patterns to connect with healthcare, operational, analytics, and partner systems.

Reliability & Continuity

Healthcare workflows depend on technology being available, observable, and resilient. SPRY's platform and infrastructure are designed to support reliable access across users, locations, and workflows, with monitoring and operational controls that help maintain continuity as organizations grow.

Our approach includes:

Continuous platform and infrastructure monitoring
Secure preservation of critical healthcare information
Processes supporting continuity and recovery
Historical record access for audit, payer, and regulatory needs

Control Across the Data Lifecycle

Data stewardship should continue for as long as the information itself remains important. SPRY supports access to historical information for patient care, audits, payer requests, reporting, and regulatory obligations — including when an organization transitions to another platform.

Organizations transitioning away from SPRY receive:

  • Secure preservation of historical records
  • Seven years of read-only platform access
  • Read-only access for one designated user at no additional cost
  • Continued access to historical clinical, billing, consent, and operational information
  • Support for data export and record-access requests as required

This helps organizations maintain continuity and control over their records beyond the active life of the platform relationship.
‍

Trust is Built Continuously

SOC 2 Type II, HIPAA compliance, and ONC certification are important validations of the standards behind SPRY.

But trust is not established by a badge alone. It is built through the security controls, privacy practices, reliability, interoperability, and data governance that operate every day as part of the platform.

As SPRY continues to grow, we will continue investing in the infrastructure and safeguards required to protect the healthcare organizations that rely on us.

For security and compliance questions:

security@spryhealth.care