IS 17802 Explained: India's ICT Accessibility Standard and How to Test for It
IS 17802 is India's two-part standard for accessible ICT products and services. This explainer covers what Part 1 and Part 2 contain, how the standard maps to EN 301…
Healthcare Software Testing:
HIPAA, PHI and Devices
Vervali tests EHR, telehealth, diagnostics and connected medical device software for HIPAA, secure data handling and clinical safety. Coverage includes the paths where protected health information moves, the load patient volume actually produces, and the evidence a review will ask for. Delivered from an ISO/IEC 27001 environment under CMMI Maturity Level 3 process.
150+ clients
450+ projects
275+ engineers
15+ years
ISO/IEC 17025:2017Accredited testing laboratory
CMMI Maturity Level 3The process is written down and repeats
ISO 9001:2015Quality management
ISO/IEC 27001Information security
What We Test in Healthcare Software
EHR, telehealth, diagnostics and connected devices, tested for HIPAA, secure data handling and clinical safety.
EHR and Clinical Records
Where electronic protected health information sits and who can reach it. We test the write, the retry and the audit trail, not only the happy chart screen.
Telehealth
Session handling, the drop mid-consult and the PHI in chat, video and the note afterwards. Device coverage is on mobile application testing.
Diagnostics
Orders, results and the load patient volume actually produces. A queue at result-release is a failed morning, not a green report.
Connected Medical Devices
Pairing, drop-outs and the server behind the device. A monitoring app that misses a reading is a clinical event, not a bug.
HIPAA in the Product
PHI handling, access control, audit logs, and encryption in transit and at rest. Method is on compliance testing.
Clinical Safety in the Product
Coverage that matches how health software actually fails. A timeout that looks like a save and a record that never wrote is a clinical miss.
Need EHR, telehealth and device coverage that matches how a clinical miss fails?
Free HIPAA CheckHIPAA, Security and the Evidence Pack
What is tested and against what, with the evidence a review will ask for.
PHI, Access and Audit Logs
PHI handling, access control and audit logging, including whether a use can be reconstructed from the logs. See healthcare compliance.
Encryption and FDA Part 11
Encryption in transit and at rest, and FDA 21 CFR Part 11 when you name electronic records and signatures.
Attack Work, Scoped Separately
Application and API attack testing runs on agreed in-scope assets. See security testing.
Controls Tested, Not Certified
We test those controls and do not issue a HIPAA or FDA certificate. Vervali tests client controls and evidence for SOC 2 readiness and does not hold or issue that certification. ISO/IEC 27001 is held by Vervali, and we do not claim certified security staff.
Load That Matches Patient Volume
Generic load testing misses health platforms because the load is not uniform. The profile is modelled from your own volume.
Clinic Open and Morning Labs
Concentrated and predictable. Modelled from your own volumes with orders and results loaded, not only login.
Result Release
The path patients actually wait on. A queue at PDF or portal publish is the bottleneck, so we test that mix, not a second login script.
The App Under a Poor Network
Telehealth and device apps fail on the radio, not on office Wi-Fi. Method is on performance testing.
Case Studies
Two engagements, sector and country only. They show Vervali has tested and rebuilt health software at that scale.
India · Chennai diagnostics chain · mobile and web rebuild
A diagnostics chain rebuilt so patients could actually use it. After: 40% faster pages, and retention up 25 to 30%. The matrix was the devices those patients already used.
40% faster pages retention up 25 to 30%UK · BLE monitoring app · several medical devices
A UK healthcare BLE monitoring app integrating several medical devices. After: 98% user satisfaction, and 90% less manual patient monitoring. A missed reading is a clinical event, and pairing and drop-outs sat in that pack.
98% user satisfaction 90% less manual monitoringHow an Engagement Starts
From one application to a pack that keeps pace with your releases, 9am to 1pm Eastern with delivery from India.
-
01
Share the Product
Tell us the surfaces in play (EHR, telehealth, diagnostics, devices), where PHI sits and staging access under NDA.
-
02
Get the Coverage Model
A first assessment is quoted after that look: the coverage model, the controls in scope and the load shapes that apply.
-
03
Start With One Application
A free HIPAA gap check on one application is the fastest first look. We do not copy production patient records into a test environment.
-
04
Keep It Current, Build What's Next
We keep the pack current as releases and rules change. The same team can build through our custom software development.
Frequently Asked Questions
The Office for Civil Rights enforces HIPAA, and the covered entity owns its HIPAA status. Vervali tests PHI handling, access, logs and encryption in the software and produces a dated evidence pack. We do not issue a HIPAA certificate. See healthcare compliance.
We do not treat a proposed rule as a deadline, and we test PHI handling, access, logs and encryption under the rules that apply today. Check HHS for anything that later comes into force. Method is on healthcare compliance and compliance testing.
Testing the product against the named framework, testing the evidence a review will ask for, and retesting after remediation. HIPAA-led work is on healthcare compliance. PCI DSS, GDPR and accessibility obligations are on compliance testing. We do not issue those certificates.
It depends on the framework, the application and how much evidence already exists, so we do not publish a fixed week count. A free HIPAA gap check on one application is the first look, and the quote after it names the weeks. Retesting after remediation is a second pass.
Yes, when those frameworks are named in the quote. ISO/IEC 27001 is held by Vervali, and we test client controls and evidence. We do not issue a GDPR certificate. HIPAA-led work still comes first, and a free HIPAA gap check shows what evidence overlaps.
Yes. The pack names the gaps and a path, with owners, and a findings dump is not remediation. Retesting after the change is a second pass, quoted separately unless you ask for both in the same week. A free HIPAA gap check shows the gaps first.
It looks at whether the controls a SOC 2 review will ask for are present and evidenced in the software and the estate around it. Vervali tests client controls and evidence for SOC 2 readiness and does not hold or issue that certification. HIPAA still leads on health products.
We do not sell a HIPAA certificate. You are buying testing and a dated evidence pack, and most engagements land at $25 to $49 an hour blended. Price follows the application, how much PHI it handles and how much evidence already exists. A free HIPAA gap check shows the surface first.
Email Us
Call Us
