Skip to content
Pre-publication draft. This Trust Center is prepared for peer review before public launch.
Policies, Standards & Procedures

Policies, Standards & Procedures

Library · v2026.06: The complete set of security, privacy, and operational policies for the Foundry MSO. Last refreshed June 2026.

Bioscope Foundry is a HIPAA business associate to member physician practices, not a covered entity. These policies describe how we operate our platform and workforce in that role. Patient-facing privacy practices are issued by the covered entity (the practice).

Governance

Security program overview
How the program is structured, what it covers, and how it is reviewed.
Policy management
How policies are written, approved, communicated, and retired.
Roles, responsibilities & training
Security Officer, Privacy Officer, workforce training, and AI literacy.
Risk management & risk assessment
How risk is identified, scored, treated, accepted, and reviewed.
Security architecture & operating model
Network design, PHI boundary, and tiered agent operating model.
AI governance
Lifecycle controls for Atlas, Forge Agents, and the Beacon Layer.

Access & people

Access control
Passwordless auth, RBAC, MFA, just-in-time elevation, PHI access gates.
HR & personnel security
Background checks, confidentiality, onboarding, exit, and discipline.
Asset management
Inventory, classification, ownership, and end-of-life for hardware and SaaS.
Endpoint & MDM
Workstation baseline, MDM enrollment, FileVault, and posture checks.
Facility & physical security
Remote-first workforce; physical controls for the Carmel office and PHI media.

Data & privacy

Data management
Classification (Public / Internal / Confidential / PHI), lifecycle, and retention.
Data protection
Encryption in transit, at rest, key management, and secrets.
Privacy
HIPAA Privacy Rule support to practices, individual rights flow, marketing limits.

Build & defend

Secure SDLC
Threat modeling, peer review, secure-development standards, dependency hygiene.
Vulnerability management
Scanning, SLAs, patching, and the supply-chain pinning rules.
Threat management
Threat intel inputs, hunt practice, and detection-engineering posture.
Configuration & change management
Infrastructure as code, change review, and emergency change.

Operate

Incident response
How we detect, triage, contain, eradicate, and learn from incidents.
Breach notification
HIPAA breach risk assessment and the practice-notification timeline.
Business continuity & DR
RTO/RPO targets, AWS regional posture, and the practice-offboarding plan.
System audits & monitoring
Logging, log retention, access reviews, and continuous monitoring.

External

Compliance, audits & external communications
How Foundry publishes its compliance posture, engages independent audits, and offers a Researcher Safe Harbor for coordinated disclosure.
Vendor & third-party risk
How we evaluate vendors, sign BAAs, and monitor subprocessors.