Audited, documented and accountable.
Our clients are hospitals, physician practices, law firms and accounting firms. They trust us with patient, legal and financial information, so here is exactly what we hold ourselves to and how you can verify it.
Independently verified
What we claim, and what stands behind it
We use careful words on purpose. Each line below says what it means and how you can check it.
| Area | Our commitment | How you can verify it |
|---|---|---|
| HIPAA | IHS is HIPAA compliant in how it handles protected health information | We sign a Business Associate Agreement with every healthcare client |
| SOC 2 Type II | Our security controls are tested by an independent auditor over time | The report is available under a non-disclosure agreement |
| Data location | Client systems and backups run on IHS-owned infrastructure in Houston and Dallas | We can show you where your data lives, and offer a facility walkthrough |
| PCI DSS 4.0 | We implement and manage PCI DSS 4.0 controls for clients that handle card data | You receive the policies, scans and evidence for your own assessment |
| Texas SB 2610 | Our security program for clients is aligned to CIS Controls and the NIST Cybersecurity Framework | You receive written policies, monitoring records and regular reports |
| Cabling | Our Cat6 plenum cable is ETL Listed and 100% copper | The listing mark is printed on the cable, and every installed run is tested |
| Website accessibility | We aim to conform to WCAG 2.1, Level AA | See our Accessibility Statement, which includes how to report a problem |
Safeguards we apply to our own operations
Encryption
Data is encrypted in transit and at rest across our hosting, phone and AI platforms.
Controlled access
Role-based access, multi-factor sign-in and audit logs of who accessed what.
24/7 monitoring
Our own security operations watch our infrastructure and client environments around the clock.
Owned infrastructure
We run our own hardware and network in two Texas sites, with backups replicated between them.
Managed workforce
Staff in Houston, Ahmedabad and Manila work on IHS-managed devices under the same security policies.
Agreements
Business Associate Agreements for healthcare clients, and written service agreements for every client.
What you can request
Clients and qualified prospects can ask for the documents below. Call us or use the contact form and tell us which you need.
- SOC 2 Type II report (under NDA)
- Business Associate Agreement
- Security questionnaire responses
Compliance questions
Is Infotech Houston Solutions HIPAA compliant?
Yes. IHS is HIPAA compliant and signs a Business Associate Agreement with every healthcare client before handling protected health information.
Does IHS have a SOC 2 report?
Yes. IHS holds a SOC 2 Type II attestation, which means an independent auditor has tested our security controls over a period of time. The report is available to clients and qualified prospects under a non-disclosure agreement.
Where is client data stored?
On IHS-owned infrastructure in Houston and Dallas, Texas. Backups replicate between the two sites.
Is this website accessible?
We aim to conform to the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA. See our Accessibility Statement for details and for how to report a problem.
Ready to talk? The first assessment is free.
Tell us what is slowing you down. We will review your setup and give you a clear plan, with no obligation and no long-term contract.