Multi-state behavioral health network closes its HIPAA + 42 CFR gap in 12 weeks.

A HITRUST finding, a HIPAA gap, and no central SOC.

The customer had grown from 3 clinics to 14 in five years on the back of acquisitions. Each acquired clinic brought its own MSP, its own EDR (or none), and its own “we documented it somewhere” HIPAA posture. The 42 CFR Part 2 overlay — required for substance-use disorder records — meant a single missed control could pause expansion entirely.

Their most recent HITRUST gap assessment flagged three structural problems:

• No central SOC. Three different EDR consoles, no SIEM correlation, alerts triaged by the IT manager in his inbox.
• No signed BAA with the helpdesk vendor. Tickets routinely contained PHI; the contractual exposure was material.
• Evidence collection was a manual fire drill. Quarterly reviews ate two weeks of the IT manager's time and still produced incomplete packs.

The CIO had budget but no time to run a 6-month RFP. They needed an operator who could land a compliant baseline in a quarter, not a year.

Dedicated tenant. AiT Hosted Agents. SOC Sentinel. BAA before week one.

We scoped Enterprise / Regulated in the discovery call and structured the engagement around three parallel work streams so onboarding wouldn't sequence into a 9-month project:

• Dedicated GCP subproject under our intelligentit.io org. Customer telemetry, ticket data, AI workloads, and evidence vault all live in a tenant only this customer can access. BAA signed before any PHI moved.
• AiT SOC Sentinel correlation layer on top of SentinelOne EDR, Adlumin MDR, and Trustify email security. One queue, AI-triaged, escalated to a named analyst pod with a 1-hour P1 SLA.
• AiT Hosted Agents trained on the customer's clinical operations playbooks. The intake-triage agent now drafts compliant patient-handling notes that previously took clinicians 8–12 minutes per session.
• AiT Trust Portal wired into the evidence pipeline. Continuous control collection replaced the quarterly fire drill; auditors get a single read-only URL.
• vCISO hours scaled to the audit calendar — 16 hrs/mo during HITRUST renewal quarters, 8 hrs/mo steady-state. Same named CISO across the engagement.

Audit-ready in a quarter. Clinician-hours back. Zero PHI exposure.

Hypothetical-but-representative outcomes inside the first two quarters under management:

Beyond the numbers: the customer's compliance officer now spends her time on policy work instead of chasing screenshots. The CIO's standing “security risk” line on the board deck moved from amber to green. And the expansion pipeline that the HITRUST finding had quietly frozen was reopened the same quarter.