How Mindbank passed a hospital network’s security review

The network’s IT security team sent back its vendor review with 37 open findings. Clinicians shared admin logins, there was no single sign-on, nobody could show who had opened a client’s profile, therapy notes turned up in error logs, and client language went to the AI model with nothing stripped out first.

Mindbank’s small team was busy building the features the network had asked for. Three months in, the contract was still unsigned, and the review was the only thing in the way.

We started by reading the review the way the network’s security team would. Every finding was mapped to a fix and ranked by what would block the signature, so Mindbank knew on day five exactly what stood between them and the contract.

Then we built the fixes as four milestones, each on a staging link Mindbank could check before signing off. Their team kept shipping product; ours worked alongside it in the same codebase.

The network’s security team closed the review in week six, and the contract was signed the same month. The first clinicians went live on single sign-on with their existing hospital logins.

The work now sells for Mindbank too: single sign-on and the audit log are on its sales checklist, and the evidence goes out with every enterprise questionnaire.