generated: '2026-07-20'
method: searched
source: https://www.medallion.co/compliance
standards:
  - id: soc2
    conforms: true
    evidence: "Medallion states it is SOC 2 compliant, demonstrating systems and operational controls meet third-party standards for security, availability, and data protection (medallion.co/compliance)."
  - id: ncqa-credentialing
    conforms: true
    evidence: "Medallion is NCQA Certified for Credentialing, demonstrating credentialing processes meet standards for documentation, verification, and quality oversight (medallion.co/compliance)."
  - id: hipaa
    conforms: false
    evidence: "Not explicitly claimed on the public compliance page as of 2026-07-20 (handles healthcare provider data; treats PHI under enterprise controls but no published HIPAA attestation found)."
  - id: iso-27001
    conforms: false
    evidence: "No ISO 27001 certification published on the public compliance page as of 2026-07-20."