No. HIPAA is not attested and ScopeMantle does not offer a BAA. Do not represent otherwise to a hospital or clinic customer.

Where does the data live?

US-region tenancy on default for healthcare customers. EU-region available for customers with EU operations or EU-based subsidiaries. Tenant data is fully isolated; sub-processor list is public.

Does this cover EHR integrations themselves?

ScopeMantle audits the EHR-adjacent OAuth surface — third-party apps connected via Google Workspace, Microsoft 365, or Okta. Direct EHR integrations (Epic App Orchard, Cerner Open) are visible through the same identity audit; integration with the EHR itself is on the public roadmap for Q3.

Partner vertical · healthcare MSSPs

Third-party governance for the EHR-adjacent SaaS surface.

Healthcare-specialist MSSPs add ScopeMantle as the OAuth-grant audit and DSAR substrate for their hospital, clinic, and digital-health customers. The audit covers EHR-adjacent SaaS (scheduling, billing, patient communication, telehealth, mental-health platforms) where shadow integrations routinely pull PHI out of the EHR's blast radius.

ScopeMantle can inventory EHR-adjacent OAuth grants. HIPAA is not attested, we do not offer a BAA, and we will not represent otherwise. Sub-processor list and a DPA template are on the site.

Apply to partner Full program terms

What gets in the way today

The shape of the problem.

PHI lives outside the EHR's blast radius

Patient-communication SaaS, telehealth platforms, and AI scribes pull PHI out of the EHR via OAuth. The compliance posture of the EHR doesn't extend to the third-party app — but the BAA usually does.

Vibe-coded healthcare SaaS is the new shadow IT

Clinicians sign up for AI-generated note-taking tools using their work email. The OAuth grant requests calendar + email + contact scopes. Procurement never saw the tool.

DSARs are now meaningful in healthcare

State-level patient privacy regulation (Washington My Health My Data, California CMIA, Texas HB 4 medical-data rules) treats SaaS-resident PHI as in-scope. DSAR fulfillment across the vendor list is no longer optional.

What the partnership delivers

Capabilities that map to the work.

EHR-aware vendor catalog

Tagged catalog of EHR-adjacent SaaS (Epic, Cerner, athenahealth, eClinicalWorks adjacencies) with known scope patterns and risk-tier defaults. Faster customer onboarding for healthcare-specialist MSSPs.

Honest healthcare posture

HIPAA is not attested and no BAA is available. EU-region or US-region tenants on customer choice. Sub-processor list and DPA template ship as part of partner enablement.

DSAR with healthcare-jurisdiction templates

GDPR, CCPA + CMIA, Washington MHMDA, Texas HB 4, and HIPAA right-of-access templates per vendor. Per-jurisdiction response-time benchmarks built into the workflow.

What you can do this week

A concrete starting point, not a roadmap.

Email partners@scopemantle.com — mention 'healthcare specialist' for fast-track.
Read the DPA template and sub-processor list before a sandbox tenant.
Pick one customer for a sandbox audit of the EHR-adjacent SaaS surface.
Co-brandable healthcare-flavour customer decks available day-one.

Frequently asked

Common questions.

Ready to add ScopeMantle to your managed-security bundle?

30-minute conversation within 5 business days. Two-page partner agreement. First customer demo in week 4.

Apply to partner Full partner program terms

About ScopeMantle

ScopeMantle is an OAuth-grant audit and DSAR-automation platform for mid-market SaaS companies, sold primarily through an open MSSP partner program (70/30 wholesale split, deal registration, no direct-sale conflict in partner territories) and secondarily direct. Built in 2026.

Explore the partner program →

70 / 30 wholesale · deal registration honoured · no direct-sale conflict