Long Tail Health Solutions

CHALLENGE

An early-stage company needed a one-stop shop to make compliance achievable

Chris Ingrao, Co-founder and COO of Long Tail, was experienced in the challenges of compliance. At the previous company he founded, he handled compliance the old-fashioned way: with manual spreadsheets, documentation kept in various places, and an audit disconnected from the rest of the process.

When launching Long Tail, Chris knew there had to be a more efficient way to manage governance, risk, and compliance (GRC). As a team of one, his wishlist was expansive: a tool to streamline the process, support for multiple frameworks including SOC 2 and HIPAA, integrated audits, and penetration testing, all in one place.

Chris explained, “the biggest concern was team size. I was the only person doing this work, and the thought of writing all the policies, designing and implementing all the controls, and operationalizing the procedures across the company to obtain and maintain compliance felt like a herculean task.”

Many well-known vendors offered services like document acknowledgements, access reviews, and risk registers, but lacked a critical piece for Chris: the integrated audit. 

Only one solution offered the one-stop shop he was looking for: Thoropass.

SOLUTION

Thoropass’ up-to-date policy knowledge and automation unlocked multi-framework compliance

From the earliest stages of the company, Chris began working with Thoropass to pursue HIPAA attestation and SOC 2 certification. Right away, Chris found great value in working with his Thoropass Customer Success Manager (CSM).

“Our CSM was very helpful as we erected our entire program from scratch,” shared Chris.

The CSM put a roadmap in place and walked Chris through the process for both frameworks, answering questions along the way. Thoropass’ up-to-date policy templates, reflecting the latest best practices, were particularly valuable.

Chris explained, “having an expert maintain an updated set of policies and controls for compliance frameworks over time is super helpful. It saves a ton of time to go to one place rather than sourcing it ourselves.”

Thoropass’ easy-to-use platform simplified evidence collection, automating data collection from integrated platforms while keeping evidence organized and aligned to the frameworks.

For Chris, an unexpected benefit of Thoropass was the guidance provided to his engineering teams while their software products were in development. Starting this process early helped Long Tail Health to build from the ground up with security in mind. He explained, “by assigning certain GRC tasks to engineering leadership, it’s easier to ensure security is factored into their software development lifecycle in a way which was more challenging previously.”

Long Tail Health completed two penetration tests of its web application with Thoropass’ in-house pentesters. The pentests were scoped to Chris’ requirements, and the results were integrated into the Thoropass platform as data to be used for their SOC 2 audit. With the actionable feedback provided in the pentest reports, Chris and his team were able to quickly remediate the priority findings.

Once the required policies were in the place, Chris successfully completed Long Tail Health’s HIPAA self-attestation. When it came time for the SOC 2 audit, Chris had a kickoff call with the Thoropass in-house auditor, exchanged several messages with the auditor within the platform, and soon received his SOC 2 Type 2 report.

RESULTS

SOC 2 and HIPAA offer proof of a robust security posture, improving customer confidence

For Chris, working with Thoropass made compliance feel achievable, while saving time and headaches.

Having robust policies in place enables Chris to answer customers’ detailed security questionnaires to their satisfaction. Additionally, the HIPAA attestation and SOC 2 report increase customer confidence. 

LOOKING AHEAD

Ongoing compliance management and maintenance made easy

According to Chris, Thoropass’ continuous risk monitoring has been helpful throughout the process, including their audit window for SOC 2 Type 2. Once Long Tail Health’s SOC 2 Type 2 certification is complete, he will continue to leverage Thoropass for ongoing compliance management.