Trident
Log inBook a call

Your auditor asked for a technical evaluation

Trident tests each technical safeguard, ties every gap to a verified finding, and assembles evidence you can hand the assessor.

Book a demo
Access controlHolds under test
Audit controlsHolds under test
IntegrityHolds under test
Transmission securityFails under test
Trident tests technical safeguards. Trident does not certify HIPAA compliance.

One row failed its test

highCWE-319

An integration link will carry ePHI in the clear

EntrySomeone on the networkImpactePHI readable in transit

Observed from the shared network

Shared clinic network
Integration link, encryption optional
Choke point
Feed settles on cleartext
ePHI readable in transit
The endpoint allows plaintext, so the feed reads on the wire.

How the evaluation runs

01

Recon

Read-only roles inventory the systems that hold or move ePHI.

02

Path mapping

Each safeguard maps to the paths it should close.

03

Exploit validation

Sanitized probes demonstrate each gap, never infer it.

04

Draft PR + report

The fix opens as a draft PR; the package typesets.

See the methodology

The evidence package, assembled

Each safeguard, its test, and its result — assembled as an evidence package.

  • Read-only test access, scoped and expiring
  • Evidence is sanitized — no ePHI is captured
  • Each safeguard links to its test and its result
  • Findings ship with reproduction and fix

Focused on the attack surface instead? See the path to PHI →

Safeguards this evidence supports

Referenced to the Security Rule technical safeguards, without claiming to discharge them.

Security Rule

The Security Rule requires a risk analysis, technical safeguards over electronic PHI, and periodic evaluation of whether those safeguards work. Trident supports the evaluation half and produces the evidence with tracked remediation. Trident does not certify HIPAA compliance. The flaw on this page is a transmission-security failure: an integration link that will negotiate ePHI down to cleartext.

Access control
Whether unique user identification and role restrictions constrain what each identity retrieves, tested with separate accounts rather than inferred.
Audit controls
Whether access to ePHI is recorded in a way that survives an investigation, including whether the record captures who performed the read.
Integrity
Whether ePHI can be altered or destroyed through an unauthorized path, including indirect routes through integrations and administrative tooling.
Transmission security
Protection of ePHI in transit across application, API and internal service boundaries, including the internal hops left unencrypted from a trusted-network era.
Evaluation evidence
A periodic, documented evaluation with findings, remediation and retest — the artefact the standard asks for and most often lacks.

Questions about the Security Rule evaluation

No. Trident produces the technical evidence assessors ask for. Compliance is an organizational programme spanning administrative, physical and technical safeguards, training, policies and business associate management. No vendor can make you compliant.

Walk into the evaluation with evidence.

See an evaluation run against your estate, safeguard by safeguard.

Book a demo

Trident does not certify HIPAA compliance.