SOC 2 Compliance vs HIPAA Compliance: What Healthcare Organizations Need to Know

← Back to all articles

If you work in healthcare IT, you've probably had this conversation.

A new vendor is in the final stage of review. Someone asks, "Are they HIPAA compliant?" The vendor's answer arrives as a PDF: their SOC 2 report. Everyone relaxes a little. The box gets checked.

Here's the problem. SOC 2 and HIPAA answer different questions. A SOC 2 report can be excellent evidence that a vendor runs a disciplined security program. It is not proof that the vendor meets its HIPAA obligations to you, and it doesn't replace your own risk analysis.

This guide explains what each one is, where they overlap, where they don't, and how to use both in a vendor review that holds up.

Why This Question Keeps Coming Up

Healthcare runs on vendors. Billing, scheduling, telehealth, cloud hosting, transcription, analytics, IT support — each one may create, receive, store or transmit patient data on your behalf.

That dependence shows up in breach data.

When a vendor holds data for hundreds of healthcare organizations, one incident at that vendor reaches all of them. That's why how you evaluate vendors matters as much as how you secure your own environment.

What HIPAA Actually Requires

HIPAA is a federal law. Its Security Rule requires covered entities — providers, health plans and clearinghouses — and their business associates to protect electronic protected health information (ePHI) through administrative, physical and technical safeguards.

Three points matter for vendor reviews:

• It's a legal obligation, not a voluntary standard. A vendor that handles your ePHI is a business associate and must sign a business associate agreement (BAA).
• It's risk-based. HIPAA requires each organization to analyze its own risks and manage them. There's no single checklist that equals "compliant."
• There is no official HIPAA certification. HHS states that it does not endorse or recognize private organizations' "certifications" under the Security Rule, and that such certifications do not absolve an organization of its legal obligations.

That last point surprises people. Any vendor marketing itself as "HIPAA certified" is describing a private assessment, not a government credential.

What SOC 2 Actually Is

SOC 2 is an attestation framework from the AICPA. An independent CPA firm examines a service organization's controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Security is always in scope; the others are included based on the services offered.

There are two report types:

• Type 1 evaluates whether controls are suitably designed at a single point in time.
• Type 2 tests whether those controls operated effectively over a period, typically several months up to a year.

SOC 2 produces a report with an auditor's opinion, not a certificate. When a vendor says "SOC 2 certified," they usually mean they hold a SOC 2 report.

Where They Overlap — and Where They Don't

The overlap is real. Both care about access control, encryption, monitoring, incident response, change management and vendor oversight. A vendor with a clean SOC 2 Type 2 report has shown an auditor that a defined set of controls worked over time. That counts for a lot.

The gaps are just as real:

Analysis: The scope question is where most problems hide. A vendor's SOC 2 may cover its core platform but not the support tool where your staff upload files, or a newly acquired product. If the system holding your data isn't in scope, the report tells you little about it.

What's Changing: The Proposed HIPAA Security Rule

In January 2025, HHS published a proposed update to the HIPAA Security Rule. Among other changes, it would require business associates to provide covered entities with written verification, at least every 12 months, that they have deployed the Security Rule's required technical safeguards — backed by a written analysis by a subject matter expert.

The status matters: this rule is still proposed, not final. In July 2026 the federal regulatory agenda moved projected final action to July 2027. The current Security Rule remains fully in effect.

Our view: whatever the final text says, the direction is clear. Regulators expect vendor oversight to rest on evidence, not on a signed BAA alone. Organizations that build an evidence-based review process now won't have to scramble later.

Practical Recommendations

If you're a healthcare organization evaluating vendors

1. Ask for SOC 2 Type 2 where it exists. It tells you more than a Type 1. If a vendor only has a Type 1, ask when their Type 2 observation period ends.
2. Read the scope section first. Confirm the systems, locations and services that will hold your data are covered.
3. Read the exceptions. Auditor-noted exceptions are where the real story often sits. Ask how each was resolved.
4. Find your homework. Most SOC 2 reports list "complementary user entity controls" — controls the vendor assumes you'll run, such as managing your own users' access. Assign an owner for each.
5. Ask the HIPAA questions separately. BAA terms, breach notification timelines, encryption of ePHI at rest and in transit, use of subcontractors, and where data is stored.
6. Check the dates. A report covering a period that ended over a year ago is stale. Ask for a bridge letter covering the gap.
7. Feed it into your own risk analysis. Vendor evidence informs your HIPAA risk analysis; it doesn't replace it.

If you're a health-tech company selling to providers

• Treat SOC 2 as table stakes for enterprise sales, not as your HIPAA story.
• Keep a short, plain-language HIPAA summary ready: your BAA position, safeguards for ePHI, and how your SOC 2 scope maps to the systems that hold customer data.
• Expect the verification requests to grow if the proposed rule is finalized.

The IT Leadership Perspective

The hard part here isn't technical. It's ownership.

Vendor reviews often sit between procurement, compliance, legal and IT, and no single team reads the SOC 2 report end to end. The PDF gets filed, the BAA gets signed, and the scoping gaps go unnoticed until something happens.

IT leaders can fix that with a simple rule: every vendor that touches ePHI gets a named reviewer, a documented scope check, and a date for the next review. That's not a large program. It's a habit.

Where ITSN Fits

IT Security Now helps healthcare organizations simplify IT and reduce risk. As a vendor-neutral advisor, we help teams evaluate technology vendors — including working through security questionnaires, risk assessments and HIPAA alignment during procurement — and we conduct HIPAA Security Assessments that show where vendor risk fits within your wider environment.

The Bottom Line

SOC 2 and HIPAA aren't competitors. SOC 2 tells you how well a vendor's controls were designed and operated. HIPAA tells you what you and that vendor are legally obligated to do with patient data.

Use the SOC 2 report as strong evidence. Then ask the questions it doesn't answer.

Frequently Asked Questions