How we report status
We state each status as it is.
Buyers should know what operates today, what an outside body has reviewed, and what remains in progress.
Atticus is a HIPAA covered health care provider for care under its own provider NPI, including electronic eligibility transactions. Atticus also acts as a HIPAA Business Associate for delegated customer work.
Current standing
What each status means today.
| Framework | Status | What it means |
|---|---|---|
| HIPAA | Active | Covered-provider safeguards apply to Atticus care. Business Associate safeguards apply to delegated work. See our Notice of Privacy Practices. |
| URAC Artificial Intelligence in Healthcare 1.0 | Provisional | URAC voted to grant Atticus Health Provisional Accreditation for Artificial Intelligence in Healthcare 1.0: Developer + User. Award AIHC010009 is effective September 1, 2026 through March 1, 2028. |
| URAC Case Management v7.0 | Provisional | URAC Case Management v7.0 Provisional Accreditation, certificate CMT010061, effective August 1, 2026 through February 1, 2028. |
| SOC 2 | In progress | Our SOC 2 audit is underway. Security, availability, and confidentiality controls operate today. The SOC 2 report is not yet available. |
| NCQA HEDIS MY2026 | Capability | Atticus supports HEDIS measure calculation, gap evidence, and reporting workflows. This is a product capability, not NCQA certification. |
| CMS Stars | Capability | Atticus supports Star measure tracking and intervention evidence. This is a reporting capability, not CMS accreditation. |
| Privacy rights | Operational | Access, correction, deletion, export, and objection workflows support applicable privacy requests and customer obligations. |
Artificial Intelligence in Healthcare
Expires 03/01/2028
Case Management
Expires 02/01/2028
Control system
A control model built for review.
Atticus connects policy, operating controls, review records, and corrective action.
Access governance
Named access, MFA, scoped roles, and regular reviews support least-privilege decisions.
Data protection
Encryption, approved AWS services, and defined data boundaries protect health information.
Incident readiness
Response, escalation, assessment, recovery, and retained evidence support coordinated action.
Operational assurance
Change review, monitoring, and corrective action create evidence for customer oversight. We require a BAA before a subprocessor receives PHI.
AWS foundation
A BAA-backed security boundary.
The AWS Business Associate Addendum is executed. Atticus uses HIPAA-eligible AWS services, encryption, access controls, and managed security monitoring.
Review our AWS security controlsCustomer assurance
Evidence is available through review.
Qualified customers can review relevant policies, control evidence, and oversight materials through the diligence process.
Reviewing Atticus?
Continue the review with our team.
Qualified customers can request security materials, accreditation evidence, vendor information, and delegation review documents.