Evidence expectations
Clinics need clearer evidence that safeguards are operating, risks have been reviewed and corrective action has been taken — not simply documents prepared for the last assessment.
Why Airlock
Healthcare compliance should run continuously — not restart every year
Airlock is being built to help clinics move beyond fragmented tools, point-in-time assessments and manual evidence collection.
The goal is not another annual assessment. It is a managed operating model that keeps risk visible, corrective action moving and evidence current as the clinic changes.
The compliance requirement
Compliance requires more than an annual assessment
Healthcare clinics need to protect patient information, manage risk and be able to demonstrate that appropriate administrative, technical and physical safeguards are operating.
For HIPAA-regulated clinics, that means more than completing a risk analysis once. The practical challenge is being able to show what safeguards are in place, where risk exists, what has changed, what action has been taken and whether the evidence is still current.
The questions clinics need to answer
- What safeguards are operating now?
- Where does risk exist today?
- What has changed since the last review?
- What action has been taken?
- Can you provide the evidence?
Compliance is not only an assessment event. It is an ongoing obligation to protect, review, act and maintain evidence.
The old model
Compliance has become a recurring fire drill
Most clinics still pull compliance evidence together when an audit, insurer renewal, Security Risk Assessment, acquisition review or incident creates a deadline.
Staff search inboxes, shared drives, policy folders and supplier portals. IT providers retrieve screenshots, logs and system information. A snapshot is eventually produced — then the clinic environment keeps changing and the evidence starts to age.
- 01A review, renewal, assessment or incident creates urgency.
- 02Clinic staff, suppliers and IT search for evidence.
- 03A point-in-time assessment or evidence pack is produced.
- 04People, systems, safeguards and data continue to change.
- 05Evidence becomes outdated and unresolved issues can remain between reviews.
- 06The next deadline restarts much of the process.
Clinics are repeatedly rebuilding proof instead of keeping evidence current. That cycle does not just create risk. It creates cost.
The real cost
Clinics can spend heavily on compliance and still not know whether their evidence is current
Compliance spend is already spread across assessments, security and compliance tools, insurer requirements, internal documentation, IT and supplier support and remediation.
But invoices only show the visible cost. Underneath sits the operational burden of chasing evidence, repeated requests across suppliers, duplicated work and time taken away from patients, clinicians and practice development. Then there is the business exposure when problems are discovered late or evidence cannot be produced.
Visible compliance spend
- Assessments and consultants
- Security and compliance tools
- Insurance preparation
- IT and supplier support
- Remediation
Hidden operational cost
- Evidence collection
- Repeated document requests
- Screenshots, logs and exports
- Duplicate work across suppliers
- Staff and management time
Indirect business exposure
- Regulatory, insurance or contractual consequences
- Operational disruption and reputational damage
- Acquisition delays or increased buyer uncertainty
- Higher remediation cost when problems are discovered late
Clinics can spend heavily on compliance and still not know where exposure exists or whether their evidence remains current.
Why now
A changing healthcare environment is putting more pressure on the old model
The case for a better compliance model is not driven by one pressure alone. Clinics increasingly need to answer questions from regulators, insurers, governance teams, buyers and IT partners while the underlying environment keeps changing.
Cyber and operational risk
Healthcare incidents can create significant financial and operational disruption, making earlier visibility and evidence of action more valuable.
Insurance scrutiny
Insurer reviews can require evidence that key controls and risk-management practices are operating and current.
Buyer and DSO diligence
Compliance maturity and the ability to evidence risk management can matter during acquisition, investment and group-governance reviews.
Pressure on IT providers
Compliance requests often pull IT teams into evidence collection, exports, documentation and remediation work beyond traditional support.
The market does not need another disconnected tool or another annual report. It needs a managed way to keep evidence, action and risk connected as the clinic changes.
From point-in-time to continuous compliance
From annual evidence scramble to a compliance process that stays active
Continuous compliance does not mean a clinic is automatically compliant at every moment. It means the compliance process does not stop when an assessment ends.
Airlock is designed to capture and maintain evidence as activity happens, identify gaps earlier, coordinate corrective action and verify outcomes — so the compliance record can stay current as people, systems, safeguards and risks change.
Deadline-driven evidence gathering
Evidence maintained as work happens
Reduce the need to rebuild the same story every time a review appears.Problems sitting between reviews
Risk and evidence gaps staying visible
Surface missing evidence, unresolved risk and areas requiring attention earlier.Corrective action separated from the finding
Remediation and verification staying linked
Keep what was found, what was done and what was verified in one evidence trail.Restarting at each review
A record that builds over time
Preserve evidence from each review, action and outcome so the next request starts from a current record rather than from zero.That is the shift Airlock is designed to support: point-in-time compliance → an ongoing managed model for continuous compliance. Current evidence is what that model maintains; ongoing discovery, remediation and verification are what keep it useful.
The value of continuous compliance
Better patient care, practice growth and long-term value — not just audit readiness
Compliance already consumes clinic time and money, yet fragmented tools, manual evidence collection and point-in-time assessments can still leave evidence outdated between reviews.
Airlock changes the operating model by keeping risk visible, remediation moving, outcomes verified and evidence current throughout the year — helping clinics spend less time chasing compliance administration and more time focused on patient care, growth and long-term practice value.
As risks are identified, actions are completed and outcomes are verified, the clinic builds a stronger record of compliance maturity. That can reduce uncertainty when insurers, governance teams or buyers ask for proof. Continuous compliance does more than reduce risk — it turns compliance into a more useful operational capability.
Reduce compliance administration
Spend less time collecting evidence, updating documents, chasing screenshots and preparing audit packs.
Redirect capacity to patient care and growth
Give clinic and management teams more time for patients, clinicians and practice development.
Improve visibility over risk and remediation
Give clinic managers, IT providers and DSO leaders a clearer view of risk, completed action and evidence status.
Build evidence that becomes more useful over time
Create a stronger record of findings, actions and verified outcomes instead of reconstructing proof for each new deadline.
Strengthen insurer and buyer confidence
Use clearer, current evidence to support renewal discussions, governance reviews, Security Risk Assessments and acquisition diligence.
Support practice value and diligence
Demonstrate greater compliance maturity by showing that safeguards are evidenced, risks are being managed and completed actions can be verified — helping reduce uncertainty during buyer diligence.
Airlock helps turn compliance from a recurring regulatory burden into an operational capability that supports better care, growth and long-term enterprise value.
Why Airlock starts with Detect
Continuous compliance starts with continuous discovery
Airlock starts with Detect for two reasons.
First, exposed patient data is an immediate, measurable problem that many clinics cannot clearly see.
Second — and strategically more important — Detect establishes the discovery-led mechanism the wider Airlock model depends on.
Airlock cannot keep compliance current using questionnaires, uploaded documents and information gathered for the last assessment alone. It needs a way to scope the real clinic environment, capture evidence from the systems and safeguards operating there, identify where risk or evidence gaps exist and turn those findings into corrective action and verified evidence.
Detect is the first implementation of that mechanism. Today, discovery is applied to patient-data exposure across agreed locations. Over time, the same discovery-led approach is intended to extend across wider administrative, technical and physical safeguards, using the appropriate evidence sources and integrations for each.
Detect starts with patient-data exposure, but its strategic role is larger: it proves the discovery → action → verification → evidence mechanism Airlock can extend across the clinic.
Built from direct market experience
The next iteration of a model shaped by real dental delivery
Airlock is not approaching this market from theory.
The idea grew from prior experience delivering patient-data exposure discovery and remediation across US dental environments alongside existing IT providers, including clinic groups and DSO environments.
That work exposed a recurring gap: IT teams were managing systems and security controls, while sensitive patient data could still accumulate across workstations, shared drives, email, cloud apps and user accounts.
Clinics then needed the exposure identified, remediation coordinated and evidence produced — work that did not always fit neatly inside traditional IT support.
As delivery expanded, audits, assessments and governance requests repeatedly surfaced other compliance-evidence gaps. The recurring question became: ‘Can you help us fix this as well?’
That experience helped shape Airlock: not another point-in-time compliance tool, but a managed evidence layer built around discovery, corrective action, verification and evidence — starting with exposed patient data.
Detect turns the first problem into a repeatable managed service. Airlock is being built around the larger evidence problem.
Start with Detect
The future of healthcare compliance starts with the exposure clinics cannot see
Request a Free Exposure Check to understand where patient data may already exist outside controlled systems and which areas require attention.
From there, Airlock Detect provides a clear route into ongoing patient-data exposure discovery, authorised remediation, verification and audit-ready evidence throughout the year.
- Works With Your Existing IT Provider
- Scope Agreed Before Discovery
- Clear Route Into Current, Audit-Ready Evidence