Compliance

Attunio operates a comprehensive compliance program that spans privacy, security, clinical quality, and regulatory obligations. Our program is overseen by dedicated Privacy and Security Officers and reviewed regularly by independent auditors.

The pages below go deeper on specific areas — this page gives you the high-level map.

We comply fully with HIPAA and the HITECH Act, with Business Associate Agreements in place across every vendor that may touch protected health information. Read more on our HIPAA Compliance page.

Attunio is SOC 2 Type II audited with LegitScript certification pending, alongside encryption, access controls, and continuous monitoring across our infrastructure. Details are available on our Security page.

We collect the minimum information necessary, never sell your data, and never use health information for advertising. Our full Privacy Policy explains what we collect, how we use it, and the rights you have over your data.

• All clinicians are independently licensed and verified through primary-source credentialing.
• Ongoing license monitoring and re-credentialing on a defined cycle.
• Clinical oversight and quality review processes for care delivered on the platform.
• Adherence to state-specific telehealth regulations in every state we operate.

We are committed to making Attunio usable by everyone and work toward conformance with WCAG 2.1 AA. If you encounter an accessibility barrier, please let us know at accessibility@attunio.co so we can address it.

To request compliance documentation, a Business Associate Agreement, or to report a concern, contact our compliance team at compliance@attunio.co.