trio.so

HIPAA compliance for every laptop and phone

The HIPAA Security Rule expects every device that stores or opens patient data to lock, encrypt and stay accounted for. trio.so sets those safeguards on laptops, desktops, phones and tablets, checks that they stay on, and keeps a record you can show. It covers Windows, macOS, Linux, iOS/iPadOS and Android from one console.

Start free trialBook a demo
  • Regional Leader, EMEA, Spring 2025
  • Easiest To Do Business With, Mid-Market, Spring 2025
  • Momentum Leader, Spring 2025
  • High Performer, Middle East, Spring 2025
  • Best Support, Mid-Market, Spring 2025

Rated 4.8 on G2

Endpoint compliance  ›  Compliance  ›  Device safeguards
  • Screen lock on164.312(a)(2)(iii)Automatic logoff
    414 passing4 failing
  • Disk encryption on164.312(a)(2)(iv)Encryption
    418 passing0 failing
  • Anti-malware active164.308(a)(5)(ii)(B)Malware protection
    416 passing2 failing
  • Device owner assigned164.312(a)(2)(i)Unique user ID
    418 passing0 failing
  • Firewall onSecurity baselineFirewall
    412 passing6 failing
Configuration policyDisk encryption policy · 13 laptops
Resolved
Resolved after next evaluation
Audit trail

08:14Trio · Finding resolved · Disk encryption on (164.312(a)(2)(iv)) · open → resolved after next evaluation · 13 devices

  • Diyar Private Academy
  • Wires & Fabriks
  • Corvuss American Academy
  • Arabi Company W.L.L.
  • Loglass
  • Skill Authority
  • Bright Learners
  • Synonym
  • Trell

Patient data lives on more devices than you think

Practices open patient records on front desk PCs, doctors' laptops and staff phones. Each one can leak electronic protected health information (ePHI) if it is lost, left unlocked or out of date. trio.so puts the Security Rule's device safeguards on each one and shows you which devices fall short.

  • Phones carry patient data tooMessages, schedules and photos on a lost phone are still ePHI.
  • Screens stay openA workstation left unlocked at reception shows records to anyone passing. The Security Rule names automatic logoff for this.
  • Laptops go missingEncryption is what separates a lost laptop from a possible breach report.
  • Policies aren't proofAuditors and investigators ask to see the safeguard on each device, not only the written policy.
Devices passing an access check

How it works

How HIPAA device checks work in trio.so

The device part of the Security Rule doesn't need its own tool. trio.so enrolls each device, applies the safeguards as configuration policies, and checks them on the schedule you set.

  1. Enroll every deviceWindows, macOS, Linux, iOS/iPadOS and Android join one console, company owned or personal.
  2. Apply the safeguardsAuto-lock and passcode, disk encryption, firewall, OS updates and USB storage blocking, set once as policies.
  3. Check and trackScheduled checks show which devices fall short. trio.so tracks each fix and marks it verified on the next check.
Start free trialBook a demo

Safeguards

HIPAA safeguards trio.so helps you meet

The Security Rule mixes required and addressable specifications. Here is how trio.so helps with the ones that live on devices, and where the record lives.

Security Rule safeguardHow trio.so helpsEvidence in trio.so
164.312(a)(2)(iii)Automatic logoff

Passcode policies set the auto-lock time on computers, phones and tablets. A check confirms screen lock is on.

Screen lock results for each device.

164.312(a)(2)(iv)Encryption and decryption

Turns on BitLocker on Windows and FileVault on macOS, checks disk encryption on Linux, and requires encryption on phones and tablets.

Encryption status for each device.

164.312(a)(2)(i) · 164.312(d)Unique user IDs and authentication

Brings staff accounts in from Microsoft Entra ID, Google Workspace or Okta, so each person has their own sign-in. Passcode policies set length and lockout.

The owner on every device record, and passcode policy status.

164.312(b)Audit controls

Keeps an audit trail of policy changes, checks and resolved findings in the console, and can stream events to Splunk.

Audit trail with who, when and what changed.

164.308(a)(5)(ii)(B)Protection from malicious software

Checks that anti-malware is active on each computer, and shows Microsoft Defender for Endpoint alerts per device.

Anti-malware results, with Defender alerts beside them.

164.310(d)(1)Device and media controls

Keeps an inventory of each device with its owner, serial number and OS, blocks USB storage on Windows and Linux, and can lock or wipe a lost device remotely.

A device list you can export as CSV.

Citations from 45 CFR Part 164, Subpart C, the HIPAA Security Rule.

Controls

Enforce HIPAA safeguards on every device

A safeguard set once can be switched off later. trio.so sends each safeguard to devices as a configuration policy and reports back: applied, failed or pending, device by device.

  • Auto-lockScreens lock after the minutes you set, with a minimum passcode length and lockout after failed attempts.
  • EncryptionBitLocker, FileVault and Linux disk encryption, plus encryption on phones and tablets.
  • Updates and firewallOS updates scheduled and kept current, with the firewall on.
  • USB storageBlocked on Windows and Linux, so records don't leave on a memory stick.

Phones

HIPAA and the phones your staff carry

Most HIPAA questions start with a phone: can staff read records on their own device, and what happens when one is lost? trio.so manages iPhones, iPads and Android devices in the same console as your computers.

  • Passcode and encryptionRequired on every managed phone and tablet, with status for each one.
  • Personal phonesAn Android work profile keeps work apps and data apart from personal ones.
  • Lost or stolenLock the device remotely, or wipe it when it won't come back.
  • Approved appsPush work apps to Android and iOS/iPadOS, using an Apple VPP token for Apple devices.
A lost device locked and wiped remotely

See your device safeguards in a free trial

Start a free trial, enroll a few laptops and phones, and see which ones miss a safeguard.

Start free trialBook a demo
5
platforms, Linux included
$5
Plans start at $5 per device.
14 days
free trial, no credit card
24/5
support from our team
Monday to Friday

Every OS

Device safeguards on every platform

A front desk PC, a doctor's MacBook and a nurse's phone report different things. Here is what trio.so checks on each.

  • Windows
  • macOS

Windows and macOS

Screen lock, BitLocker or FileVault, firewall, Secure Boot, OS updates and anti-malware, plus the status of every policy.

  • Linux

Linux

Disk encryption, firewall and OS updates, plus the status of core policies.

  • iOS/iPadOS
  • Android

iOS/iPadOS and Android

Whether passcode, encryption and other policies are applied on each phone and tablet, including Android work profiles.

Evidence

Evidence for HIPAA audits and risk reviews

The Security Rule asks you to review risks and keep records of your safeguards. trio.so keeps the device part of that record as it works, so a risk review doesn't start from screenshots.

  • Safeguard status per deviceWhich laptops and phones meet each safeguard today.
  • Tracked fixesEach failing check, when it was fixed, and the check that verified it.
  • Exceptions with an end dateAn exception covers one check on one device, then expires.
  • Device inventoryOwner, serial number, OS and installed apps, exportable as CSV.
  • Audit trailWho changed what in the console, and when.
  • ExportsEvidence records for your risk analysis and audit files.

Why trio.so

Safeguards, inventory and patching in one console

Small practices rarely have a security team. trio.so keeps the device safeguards next to the tools that manage the devices, so one person or one IT provider can run it.

  • Small teams and MSPs

    Built for small teams and their IT providers. MSPs manage every client practice from one console, each kept separate.

  • Pricing you can read

    Plans start at $5 per device. Endpoint compliance is in the Secure plan and above.

  • Rated 4.8 on G2

    Support from real people 24 hours a day, Monday to Friday.

Related

Related compliance features

Pair HIPAA device safeguards with these trio.so features.

Integrations

Works with the tools you already use

Bring staff accounts in from Microsoft Entra ID or Okta, see Microsoft Defender for Endpoint alerts per device, send device compliance to Vanta, stream events to Splunk, and send alerts to Slack or Microsoft Teams.

  • Vanta
  • Microsoft Defender
  • Splunk
  • Slack
  • Microsoft Teams
  • Microsoft Entra ID
  • Okta

HIPAA FAQ

No tool can. HIPAA also covers your risk analysis, policies, training, business associate agreements and how staff handle patient data. trio.so helps with the device safeguards in the Security Rule: it sets them, checks them and keeps the record. Our HIPAA compliance checklist covers the rest.

Yes, if the phone meets your safeguards. trio.so can manage personal Android phones through a work profile, which keeps work apps and data separate from personal ones. Read HIPAA compliance and cell phones.

Mostly the technical and physical safeguards: automatic logoff, encryption, unique user IDs, protection from malware, audit controls, and control over devices and media. Some are required and some are addressable. Our guide to HIPAA technical safeguards goes through each one.

Encryption is an addressable specification. You implement it, or document why an equivalent measure is reasonable for you. Most practices encrypt every laptop and phone, because it is the simplest way to protect a lost device.

Start with a risk analysis, then put the basics on every device: auto-lock, encryption, updates and anti-malware. See HIPAA for small businesses and our risk assessment worksheet.

Yes. MSPs use trio.so's multi-client console to manage each practice's devices, users and policies separately.

Lock it remotely, or wipe it if it won't come back. If it was encrypted, the data on it is far harder to reach. Our guide to HIPAA fines and penalties explains why this matters.

That standard is about who sees which patient data, set in your applications and policies. trio.so's part is the device: who signs in, and whether it locks and encrypts. Read our guide to the minimum necessary standard.