Case Study

Meridian Health Unifies PHI Controls Across Four Regulatory Regions

How a multinational health network collapsed four parallel regional compliance programmes into one control set that reports against every mandate it is subject to.

Jurisdictions Reported From One Control Set

68%

Reduction in Duplicated Control Work

18.4M

Patient Records Under Continuous Control

Zero

Region-Specific Programmes Remaining

Client Profile

Company: Meridian Health Network
Industry: Healthcare & Life Sciences
Company Size: 9,400+ Employees
Location: Toronto, Canada
Engine Deployed: Zelar Trust AI Engine V4

The Challenge

Four compliance programmes protecting the same patient data in four different vocabularies.

Meridian operated care networks across four regulatory regions, each with its own patient data mandate and its own compliance programme staffed to serve it. The four programmes were largely protecting the same systems with the same controls, but each expressed that work in its regulator's language and evidenced it on its regulator's schedule.

The duplication was expensive and, worse, it was invisible. Nobody could say whether a control tightened for one region had been applied in the other three, because there was no shared representation of what a control was — only four sets of documents that happened to describe overlapping work.

Cross-border data flows made this acute. A referral moving a record between regions had to satisfy both jurisdictions, and answering whether it did meant reconciling two programmes by hand, usually after the transfer had already happened.

The Solution

Zelar Trust replaced the four programmes with a single control set defined once against Meridian's actual systems, then mapped onto each region's mandate. A control is implemented and evidenced one time; the engine expresses that same evidence in the terms each regulator expects, including where one jurisdiction demands more than the shared baseline provides.

Regional divergence is handled as an explicit overlay rather than a fork. Where a mandate imposes a stricter requirement, that requirement is recorded as an addition to the shared control and reported as such — so the difference between regions is a visible, reviewable list instead of a discrepancy between four documents.

Compliance Programme Overhead by Region

Before Zelar (Four Parallel Regional Programmes)

With Zelar (One Control Set, Four Reports)

* Regional divergence is retained as an explicit overlay on the shared control set, so a stricter mandate is a visible addition rather than a fourth programme.

The Results

Duplicated control work fell by sixty-eight percent, and the four regional programmes were retired into one. Meridian's compliance staff no longer maintain parallel evidence for overlapping requirements; they maintain one control set and review the overlays where regions genuinely diverge.

The change reviewers noticed most is coverage visibility. Tightening a control now demonstrably applies everywhere it is mapped, and a cross-border referral is checked against both jurisdictions before the transfer rather than reconciled afterwards.

“We were not running four compliance programmes because the regulations are four different problems. We were running four because nobody had ever written the controls down once. Doing that, and letting the mapping handle the rest, gave us back most of a department.”

Priya Raghunathan

Chief Privacy Officer, Meridian Health Network

Implementation Timeline

Meridian consolidated four regional compliance programmes into one control set across five phases.

Phase 1
Cross-Region Control Inventory
Zelar Trust reads all four regional programmes and identifies where they are describing the same control over the same systems in different vocabularies.
Phase 2
Unified Control Set
A single control set is defined against Meridian's actual systems, with each control implemented and evidenced exactly once.
Phase 3
Mandate Mapping
Each regulator's requirements are mapped onto the shared set, so one body of evidence is expressed in four regulatory vocabularies.
Phase 4
Regional Overlays
Where a jurisdiction demands more than the shared baseline, the difference is recorded as an explicit overlay rather than a forked programme.
Phase 5
Continuous Regional Reporting
Every region reports from live state on its own schedule, and cross-border transfers are checked against both jurisdictions before the record moves.

Bring Continuous Audit Readiness to Your Organization

Understand where your governance, risk and compliance obligations stand today, and what continuous oversight would change. Our advisors will walk you through it.

Assess Your Cyber Governance Talk to a CISOaaS Advisor

Managed cyber governance for organizations that need continuous CISO leadership, Cyber GRC expertise and operational governance — without building the entire capability in-house.

CISO Governance Brief — practical insights on cyber governance, regulatory developments, risk, compliance and CISO leadership.