A CAR T dose starts as a patient's own cells. Every hand that touches the record has to be on file.

We handle the access side. That means unique accounts, role design that separates operators from reviewers, removal of shared logins, and reports that show each access change with a timestamp. Computer system validation and the final quality sign-off stay with your QA team, and we give them the test evidence they ask for.

Not yet. The House passed HB 78 on 1 October 2025 and sent it to the Senate, and as drafted it would take effect a year after passage. Until something is signed, the breach notification act and sector rules such as HIPAA and the insurance data security act are what apply.

Evidence that your access controls match your written program. In practice that is MFA coverage, privileged account lists, review records and a vendor access inventory. The Commissioner gets the certification. We build the reports behind it, and your officers decide what to certify.

Only if nothing separates the roles. We keep one person record but split clinical, research and teaching entitlements, each with its own owner and end date. That way a resident who leaves a lab keeps clinical access without dragging old study data along.

A Cohash team led from Frisco, Texas, with engineering support from our other offices as the work needs. We travel to Philadelphia for the sessions that go better in a room, such as role design workshops and cutover.