Census CRM Completes SOC 2 Type II Audit
Census CRM has completed a SOC 2 Type II audit, attested by Sensiba LLP — an independent, third-party confirmation of the security controls protecting admissions data.
On this page
NEW YORK — September 22, 2026 — Census CRM, the admissions platform purpose-built for behavioral health and addiction treatment centers, today announced it has successfully completed a SOC 2 Type II audit, attested by Sensiba LLP, one of the largest independent accounting and advisory firms in the United States.
Key takeaways
- Census CRM has completed a SOC 2 Type II audit, attested by Sensiba LLP.
- The audit is an independent evaluation of whether security controls operate effectively over a sustained period, not just whether they exist on paper.
- Controls examined include encryption, access management, continuous monitoring, and incident response across the full admissions workflow.
- SOC 2 Type II sits alongside, and does not replace, Census CRM's HIPAA business associate agreements and 42 CFR Part 2 compliance work.
- Treatment centers can request a copy of the report under a mutual NDA.
What the SOC 2 Type II audit covers
The SOC 2 Type II report is one of the most rigorous independent evaluations available to software providers, examining not just whether the right security controls exist, but whether they operate effectively over a sustained period of real-world use. Census CRM's audit covered the controls that protect protected health information (PHI) throughout the admissions journey — encryption, access management, continuous monitoring, and incident response — from a patient's very first inquiry call through the secure handoff to a treatment center's clinical record system.
"Treatment centers trust us with some of the most sensitive moments a family will ever go through, and that trust has to be earned at every level of the platform, not just the parts people see," said Dean Scaduto, co-founder of Census CRM. "Completing SOC 2 Type II is an independent, third-party confirmation of what we've built our engineering culture around from day one: that security isn't a feature we bolt on, it's the foundation everything else sits on top of. For the operators and compliance teams evaluating us, that's not a claim anymore — it's verified."
"This audit reflects a level of operational maturity you don't often see in a company built by people who came from running admissions floors themselves," added Jay Ong, co-founder of Census CRM. "We didn't set out to build software first and figure out security later. We built the system knowing exactly what's at stake for the patients and families on the other end of every call, and this attestation is proof that discipline holds up under real, independent scrutiny."
Why this matters for a treatment center evaluating vendors
Census CRM was built to replace the patchwork of spreadsheets, general-purpose sales CRMs, and manual processes many behavioral health and addiction treatment centers still rely on to manage admissions. The platform brings guided intake, real-time insurance verification, ASAM-based level-of-care screening, and bed matching into a single, purpose-built system — one that treatment center leaders can now evaluate not just on functionality, but on independently verified security discipline. It's the same standard raised in what to verify in a HIPAA-compliant CRM: don't take a vendor's word for it, check what's actually been verified.
Completing a SOC 2 Type II audit is a rigorous, voluntary process that goes beyond baseline regulatory requirements. It stands alongside — and does not replace — the Business Associate Agreements Census CRM maintains with its customers under HIPAA, and its compliance work under 42 CFR Part 2 for substance use disorder records.
Treatment centers and behavioral health organizations can request a copy of Census CRM's SOC 2 Type II report, subject to a mutual NDA, by booking time with the team.
About Census CRM
Census CRM is the admissions CRM built for behavioral health and addiction treatment centers, combining guided intake, real-time insurance verification, ASAM-based level-of-care screening, and bed matching in a single platform.
About Sensiba LLP
Sensiba LLP is an independent accounting and advisory firm providing assurance, tax, and consulting services, including SOC 2 readiness and attestation engagements.
Census CRM SOC 2 Type II FAQs
What is a SOC 2 Type II audit?
A SOC 2 Type II audit is an independent evaluation of an organization's security controls, examining not just whether the right controls exist but whether they operate effectively over a sustained period of real-world use — typically several months to a year. It is one of the most rigorous third-party assurance frameworks available to software providers.
Is Census CRM SOC 2 certified?
Census CRM has completed a SOC 2 Type II audit, attested by Sensiba LLP. There is no official SOC 2 "certification" — SOC 2 is an attestation issued by an independent auditor, not a certificate awarded by an accrediting body, so "attested" or "completed the audit" is the accurate description rather than "certified."
Does completing SOC 2 Type II replace the need for a BAA?
No. A completed SOC 2 Type II audit and a signed Business Associate Agreement (BAA) are separate compliance mechanisms, and a treatment center still needs both. The SOC 2 report verifies the security controls in place; the BAA is the legal agreement governing how protected health information is handled between the facility and Census CRM.
How can a treatment center request Census CRM's SOC 2 Type II report?
Treatment centers and behavioral health organizations can request a copy of Census CRM's SOC 2 Type II report, subject to a mutual NDA, by contacting Census CRM directly.
Keep reading
HIPAA-Compliant CRM Communications: What to Verify
“HIPAA compliant” is a slide claim, not a certificate. A concrete checklist — the BAA plus the technical and operational safeguards — to verify before you trust a vendor with PHI.
Questions to Ask an Admissions CRM Vendor
The admissions CRM vendor questions a salesperson cannot answer with a slide: watch a live call, get the BAA, name the EMRs, get the year-one cost, and ask what it cannot do.
HIPAA, 42 CFR Part 2, and TCPA: Which Rule Applies to Which Channel
Three different rules govern a single admissions call — HIPAA covers the record, 42 CFR Part 2 covers the fact of contact, and TCPA covers the outreach itself. Which applies where, in one reference.
VOB and Bed Matching for Detox Admissions: Why the Clock Is Different
A detox admission and a residential admission run through the same VOB and bed-matching mechanics, but on a different clock — what actually changes for detox specifically.
VOB and Bed Matching for MAT Admissions: The Program-Capability Check
Medication-assisted treatment adds a question VOB and bed matching don't ask elsewhere: can this specific program actually administer this specific medication.
VOB and Bed Matching for Mental Health Admissions: The Safety-First Read
A mental health admission runs the same VOB and bed-matching mechanics as substance use placement, but psychiatric safety screening and benefit-structure quirks change what actually matters.
VOB and Bed Matching for Outpatient, IOP, and PHP: The Capacity Question
There's no bed to match at outpatient, IOP, or PHP — the equivalent question is group or session capacity, and VOB shifts from per-diem to session-based coverage.
VOB and Bed Matching for Residential Admissions: What Actually Changes
A residential admission still runs VOB and bed matching, but length-of-stay coverage and exclusion checks carry more weight than the speed that dominates detox.
What Is a Bed-Matching Algorithm? A Plain-English Definition
A bed-matching algorithm checks a patient against level of care, insurance, exclusions, and specialty needs before a bed is offered — not just whether one is empty.
What Is a Guided Talk-Track? A Plain-English Definition
A guided talk-track is software, not a script — a step-by-step flow embedded in the CRM that adapts to what the caller says as the call happens.
What Is the ASAM Criteria? The 6 Dimensions Explained
The ASAM Criteria is the standard framework addiction treatment uses to decide level of care, assessed across six dimensions from withdrawal risk to recovery environment.
How to Avoid Switching CRM Platforms Later
Most CRM switches are self-inflicted at selection. How to avoid switching CRM platforms later by choosing and setting up the right system now — with room to grow into.