SOC 2 vs HIPAA Compliance

SOC 2 and HIPAA serve different purposes. SOC 2 provides an independent assessment of a service organization’s controls. HIPAA sets legal requirements for protecting health information that apply to covered entities and business associates.

A healthcare software company may face both obligations: HIPAA because it handles protected health information on behalf of a healthcare provider, and a customer contract requiring a SOC 2 report. That report does not replace HIPAA compliance. Software companies handling PHI for healthcare providers need to address the HIPAA compliance requirements for SaaS providers that apply to their services.

Shared controls can reduce duplicate work, but each set of requirements needs careful review. Learn how SOC 2 and HIPAA differ, when your business needs both, and where you can reuse controls and evidence.

Key Takeaways

• SOC 2 assesses service organization controls through an independent examination
• HIPAA sets legal requirements for covered entities and business associates
• A SOC 2 report does not prove or replace HIPAA compliance
• Healthcare technology providers may need both to meet legal and customer requirements
• Shared controls reduce duplicate work, but HIPAA-specific duties need separate attention

What Are the Key Differences Between SOC 2 and HIPAA?

SOC 2 provides independent assurance about a service organization’s controls. HIPAA creates legal obligations for covered entities and business associates. Their security controls can overlap, but the scope and purpose of each remain different.

The AICPA defines SOC 2 as an examination of service organization controls. HHS defines HIPAA’s protections and notification responsibilities separately. Completing one assessment does not establish that the other set of requirements has been met.

Is a SOC 2 Report HIPAA Compliant?

A SOC 2 report does not, by itself, demonstrate HIPAA compliance. It provides an independent opinion on controls within a defined scope. HIPAA compliance depends on meeting all requirements applicable to your organization.

The report may provide useful evidence of access controls, security monitoring, and other safeguards. Its scope may exclude systems containing PHI, and its tests may not address HIPAA-specific duties.

For example, a SOC 2 report may show that a vendor assesses its suppliers. That does not establish whether the vendor has every required business associate agreement in place.

A SOC 2 examination can include additional HIPAA-related criteria through a SOC 2+ engagement. Review exactly which requirements were assessed and what the auditor concluded. Even an expanded report does not create an HHS-recognized HIPAA certification or remove the organization’s ongoing legal responsibilities.

Who Must Comply with HIPAA?

HIPAA applies to covered entities and business associates. Your organization’s activities and relationships determine its responsibilities. The two categories below explain how healthcare providers and their vendors fall within scope.

1. Covered Entities

Covered entities include:

• Health plans: Health insurers, HMOs, and qualifying employer-sponsored health plans
• Healthcare clearinghouses: Organizations that convert health information between standard and nonstandard transaction formats
• Qualifying healthcare providers: Providers that transmit health information electronically in connection with transactions covered by HIPAA standards

Hospitals, clinics, and pharmacies can qualify as covered entities. For providers, using electronic records alone does not determine status. The electronic transaction requirement matters.

For example, a dental practice that submits standard electronic insurance claims qualifies as a covered entity.

2. Business Associates and Their Subcontractors

Business associates perform certain functions or services involving PHI on behalf of covered entities. Examples include medical billing companies and cloud providers that store patient records. Business associates experienced 35.8% of large healthcare data breaches in 2025, so more than one in three incidents began outside a covered entity’s own systems.

A subcontractor becomes a business associate when it handles PHI on behalf of another business associate. A provider storing encrypted electronic PHI can fall within scope even when it cannot decrypt the information.

For example, a hospital hires a software company to manage patient records. The software company is a business associate. A separate cloud provider storing those records for the software company is a business associate subcontractor.

Simply selling a product to a hospital does not automatically make a vendor a business associate. Its role and involvement with PHI determine that status.

Who Benefits from a SOC 2 Report?

SOC 2 serves organizations that provide systems or services to customers. It applies across industries and can cover cloud or on-premises environments.

Organizations that commonly pursue a report include:

• SaaS companies handling customer information
• Cloud hosting and data storage providers
• Managed IT and security service providers
• Healthcare technology companies
• Outsourced service providers processing sensitive business information

The decision often starts with a customer requirement. A prospective buyer may request independent assurance before entrusting a provider with sensitive data or an important business process.

73% of organizations in Secureframe’s 2026 survey shared third-party audit reports, including SOC 2 reports, to show customers how they protect information.

Confirm what that customer expects before setting the examination scope. A report covering one product may not address the service the customer plans to use. The choice between SOC 2 Type 1 and Type 2 affects the evidence your customer receives. Type 1 addresses a specified date. Type 2 examines controls over a period.

For example, a healthcare scheduling platform may need HIPAA compliance because it handles PHI for clinics. An enterprise customer may separately require a SOC 2 Type 2 report as part of vendor approval.

Do You Need Both SOC 2 and HIPAA Compliance?

Your business may need both when it has HIPAA obligations and customers require a SOC 2 report. Healthcare technology providers that face both requirements include:

• Cloud providers storing patient records for hospitals
• EHR and telehealth platforms handling PHI for healthcare providers
• Billing companies processing claims on behalf of covered entities

For example, a telehealth platform handles patient information for a clinic and operates as a business associate. A hospital considering the platform may separately require a SOC 2 Type 2 report before signing a contract.

Managing both programs together can reduce duplicate work. A completed access review may support both when it covers the relevant systems and requirements. HIPAA-specific duties, including business associate agreements and permitted uses of PHI, still need explicit coverage.

Confirm customer demand and assess the additional work before setting your SOC 2 timeline. Build on existing controls while giving applicable HIPAA obligations priority.

20% of Drata customer accounts using SOC 2 had HIPAA enabled as an additional framework in its 2026 analysis. This shows that teams manage both within the same platform; it does not prove those accounts meet every requirement.

How Do SOC 2 and HIPAA Compliance Overlap?

SOC 2 and HIPAA share security objectives, including protecting information from unauthorized access. Organizations pursuing both can reuse SOC 2 security controls and supporting evidence where they address applicable HIPAA requirements.

The overlap is strongest between SOC 2’s security criteria and HIPAA’s Security Rule safeguards. These common areas provide a practical starting point for mapping your controls.

Shared evidence needs to cover the systems and activities relevant to each requirement. A SOC 2 report covering one application may leave other systems containing electronic PHI outside its scope.

For example, a company reviews employee access to its patient records platform. The completed review can support both programs when it covers the relevant accounts and permissions. The team can retain one record and reference it against each applicable requirement.

HIPAA-specific duties still need explicit coverage. A vendor security review does not replace a required business associate agreement. An incident response plan needs procedures for applicable breach notifications, and general security training may need additional instruction on handling PHI.

Build the mapping around what each control actually does. Record whether it fully or partially addresses a requirement, then track the remaining work. This reduces duplication while keeping gaps visible.

Which Framework Do You Pursue First?

Prioritize HIPAA when your organization is a covered entity or business associate. Its applicable requirements are legal obligations that cannot wait for a SOC 2 examination. Plan SOC 2 around customer commitments and the readiness of your controls.

The three situations below help determine the order of work:

1. HIPAA Applies to Your Current or Planned Services

Address HIPAA requirements before beginning activities that bring your business within scope. Use a HIPAA compliance checklist to review your responsibilities, assess risks to electronic PHI, and track corrective actions. Put the necessary safeguards and business associate agreements in place.

For example, a startup preparing to store patient records for clinics needs to address its business associate obligations before receiving that information. A future SOC 2 report does not replace this work.

An organization already handling PHI needs to address compliance gaps promptly. In June 2026, a health plan paid $450,000 to settle an OCR investigation that cited its failure to conduct an accurate and thorough risk analysis before a ransomware attack. The case marked the 14th enforcement action under OCR’s Risk Analysis Initiative, which focuses on that single Security Rule requirement.

2. Customers Request SOC 2 and HIPAA Does Not Apply

Prioritize SOC 2 when customers require independent assurance about your service and your activities do not create HIPAA obligations.

Confirm whether the customer requires Type 1 or Type 2 before setting the timeline. A Type 1 report is not a mandatory prerequisite to Type 2. The choice depends on the assurance requested and your readiness.

For example, a project management platform serving retail companies may pursue SOC 2 to meet enterprise procurement requirements. It has no reason to build a HIPAA program solely because it stores sensitive business information.

3. Both Requirements Are Immediate

Run a coordinated program when HIPAA applies and a customer requires SOC 2. Give legal compliance gaps priority while preparing shared controls for examination.

Use one control inventory to track access management and other overlapping activities. Map each control to the applicable requirements, then track any remaining gaps separately.

Agree on the SOC 2 scope and evidence period early. This lets your team retain useful records as controls begin operating, while keeping HIPAA-specific work on schedule.

Manage SOC 2 and HIPAA Together with Bright Defense

SOC 2 and HIPAA can share security controls, but each requires its own review of coverage. Start with your HIPAA obligations, then define the SOC 2 scope your customers need. Map existing controls to both and track the remaining gaps.

Bright Defense’s continuous compliance services bring gap assessments and remediation support into one program. Our team develops practical policies and organizes evidence for review. Managed automation supports ongoing control monitoring, while expert guidance keeps framework-specific requirements visible.

Talk to Bright Defense about your healthcare services and customer requirements. We can help you build a coordinated plan for HIPAA compliance and SOC 2 readiness.

Frequently Asked Questions

1. Does Storing PHI Outside the U.S. Change Our HIPAA Responsibilities?

No. Moving PHI outside the United States does not automatically remove HIPAA obligations. A regulated organization using an overseas cloud provider still needs to meet applicable requirements.

HHS permits overseas cloud storage when the arrangement complies with HIPAA. Consider location-related risks in your risk analysis and risk management. Other countries’ laws may create additional obligations.

2. We’re a SaaS Startup with One Healthcare Client. Do We Need HIPAA Compliance?

You may. Business associate status depends on what your service does with PHI. A single healthcare client can bring your company within scope.

A platform storing patient records for one clinic can qualify as a business associate. A vendor supplying that clinic with software that does not involve PHI may not. Storing encrypted electronic PHI can create business associate obligations even when your company cannot decrypt it.

3. Can I Get HIPAA Certified the Same Way I Get a SOC 2 Report?

No. A SOC 2 report is an independent CPA attestation. HHS does not require or recognize private HIPAA certifications as proof of compliance.

A third-party HIPAA assessment can expose gaps and provide useful evidence. Its value depends on the requirements examined and the quality of the work. A certificate from a vendor does not remove your legal responsibilities or prevent an HHS investigation. 

4. Does a Consumer Health App Fall Under HIPAA?

It depends on the app’s activities and relationships. An app handling PHI on behalf of a covered entity may operate as a business associate. A consumer app that people use independently to track their health may fall outside HIPAA.

For example, a fitness tracker offered directly to consumers may have different obligations from an app managing patient records for a clinic. Apps outside HIPAA can still face other privacy and breach notification requirements, including the FTC Health Breach Notification Rule where applicable.

5. Can One Auditor Handle Our SOC 2 and HIPAA Work at the Same Time?

Yes, a qualified firm can coordinate both engagements when it has the necessary expertise and maintains independence. The SOC 2 examination must be performed by an independent licensed CPA firm.

Agree on the HIPAA assessment’s exact scope before signing. An assessment limited to the Security Rule does not cover every applicable Privacy Rule or Breach Notification Rule obligation. Shared evidence can reduce repeated requests, but each engagement needs its own assessment criteria and clear conclusions.

6. What Happens If We Have a PHI Breach Without a HIPAA Program?

A breach can trigger an OCR investigation into both the incident and your existing safeguards. Missing required risk analysis or other controls can create violations separate from the breach itself. Consequences can include corrective action, financial penalties, and contractual disputes.

For a breach of unsecured PHI, a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. A BAA may require faster notice. Begin the notification process promptly after discovery.

7. Do I Need to Sign a BAA with Every Vendor That Touches Our Data?

No. A BAA generally applies when a vendor performs a business associate function involving PHI. Access to ordinary company information does not create that requirement.

For example, a cloud provider storing patient records generally needs a BAA. A tool used only for marketing content does not need one solely because your company serves healthcare clients.

Review what data the vendor receives and what it does with that data. A vendor’s SOC 2 report cannot replace a required BAA.

8. Which SOC 2 Trust Services Criteria Can Cover More of Our HIPAA Needs?

Security provides the foundation. Confidentiality and Availability may offer useful additional coverage for protecting PHI and maintaining access to essential systems. Privacy may be relevant when the service makes commitments about personal information handling.

Choose categories based on your service commitments and customer needs. Even including all five categories does not establish HIPAA compliance. Compare the actual controls against HIPAA requirements, including obligations that the SOC 2 examination does not address.

9. How Much Extra Work Does HIPAA Add Once We Have SOC 2?

There is no reliable universal percentage or timeline. The additional work depends on your SOC 2 scope and the HIPAA obligations applicable to your role.

Existing access controls and monitoring may be reusable. Additional work can include an ePHI-focused risk analysis, BAA management, and HIPAA-specific procedures.

Retention is one concrete difference to check: required Security Rule documentation must be kept for six years from creation or the date it was last in effect, whichever is later. That is not a blanket six-year requirement for every log or medical record.

10. Will Hospitals Still Ask for Our SOC 2 Report If We’re HIPAA Compliant?

They may. A hospital can require a SOC 2 report through its procurement process or contract, alongside evidence of HIPAA compliance.

A Type 2 report gives the buyer information about control operation during the examination period. The hospital may still request a BAA and answers to its security questionnaire.

Ask which report type and service scope the buyer expects. HIPAA compliance does not automatically satisfy every customer’s vendor approval requirements.