Confidentiality and Compliance

HIPAA + SOC-2 Type I

HIPAA + SOC-2 – An independent third-party audit firm has examined the description of the Systems and Production Support and the related General Information Technology Controls for the services provided to customers by Research Transcriptions and its vendors and contractors.

This audit was based on the Security, Privacy, and breach requirements outlined in the Health Insurance Portability and Accountability Act (“HIPAA”) Administrative Simplification. 

SOC-2 Type II

Following SOC-2 Type I certification, Research Transcriptions was again audited by an independent third party to assess the operating effectiveness of our internal controls. 

Beyond our SOC-2 Type II certification, Research Transcriptions only partners with other vendors who are also SOC-2 Type II certified.

Scroll to the next section for a visual diagram that explains SOC-2 certification in greater detail.

NIH & IRB

All Research Transcriptions transcribers and other personnel who work on NIH-funded human subjects research complete the Human Research Protection Training offered by CITI and/or the HHS Office for Human Research Protections (OHRP).

General Data Protection Regulation (GDPR)

Research Transcriptions’ transcribers receive continuous training on GDPR. Training areas include:

• GDPR and Human Subject Research in the US
• GDPR: Top Noncompliance Risks and Mitigation Strategies

CITI - Protecting Human Subject Research (HSR)

Research Transcriptions’ transcribers receive continuous training on Protecting Human Subject Research (HSR) participants. This material is based on material from CITI and the National Institutes of Health. Training areas include:

• Data Management and Security for Student Researchers
• NIH Data Management and Sharing Policy for SBER: Implications for Researchers and IRBs

Payment Card Industry Data Security Standard (PCI DSS)

Box obtained PCI DSS Level 1 compliance as a service provider which allows customers to store payment card data in the Box platform. Achieving the highest level of compliance demonstrates that the security of the infrastructure meets these extensive and rigorous requirements and safely store information such as payment card data with assurance that they are meeting their compliance obligations.