HIPAA and SOC 2
Using one SOC 2 effort to carry HIPAA work.
Healthtech buyers often ask for a SOC 2 report and a HIPAA answer in the same review. The two overlap a great deal on security, and part ways on privacy and contracts. This page shows which Security Rule safeguards a SOC 2 can evidence, what stays HIPAA-only, and how to build one control set that serves both.
Back to HIPAA services01 · Two different things
A law and an attestation
One sets duties; the other reports on controls.
HIPAA
A US law
- Rules in 45 CFR Parts 160 and 164
- Enforced by HHS OCR
- Covers privacy, security and breach notice
- No certificate and no report
SOC 2
An attestation report
- Examined against the AICPA Trust Services Criteria
- Issued only by a licensed CPA firm
- Covers the controls in a defined system
- Says nothing about legal compliance on its own
A SOC 2 report can be strong evidence that security safeguards exist and work. It is not a finding that you comply with HIPAA.
02 · The mapping
Security Rule safeguards against the Trust Services Criteria
A practical mapping, plus the work only HIPAA asks for.
| Security Rule area | SOC 2 category or criteria family | Extra HIPAA-only work |
|---|---|---|
| Risk analysis and risk management | Security: CC3 risk assessment | Analysis scoped to all ePHI, documented as the rule expects |
| Assigned security responsibility | Security: CC1 control environment | A named security official |
| Workforce security and access management | Security: CC6.1 to CC6.3 logical access | Workforce clearance and termination procedures for ePHI access |
| Security awareness and training | Security: CC1.4, CC2.2 | Training topics the rule lists; sanction policy |
| Security incident procedures | Security: CC7.3 to CC7.5 | Breach risk assessment and notification decisions |
| Contingency plan | Availability: A1.2, A1.3; Security: CC9.1 | Emergency mode operation; data criticality analysis |
| Evaluation | Security: CC4 monitoring activities | Periodic evaluation against the HIPAA rules themselves |
| Business associate contracts | Security: CC9.2 vendor risk | Signed BAAs with the required terms, both directions |
| Facility, workstation, device and media controls | Security: CC6.4, CC6.5 | Media re-use and disposal records for ePHI |
| Access, audit, integrity, authentication and transmission | Security: CC6.1, CC6.6, CC6.7, CC7.2, CC8.1 | Emergency access procedure; addressable decisions recorded |
Mappings are a judgement, not an official crosswalk. Write down why each SOC 2 control satisfies the HIPAA area it is mapped to, so the reasoning survives a change of staff.
03 · HIPAA-mapped reports
SOC 2 reports with HIPAA added
Some CPA firms report on extra criteria in the same examination.
AICPA guidance allows a SOC 2 examination to report on additional criteria alongside the Trust Services Criteria. Some CPA firms use this to add the HIPAA Security Rule requirements, producing what is often called a SOC 2+ or HIPAA-mapped report.
- Only a licensed CPA firm can issue it, like any SOC 2 report.
- It tells readers whether controls met the added criteria in scope; it is still not a HIPAA certification.
- HHS does not recognise or endorse any such report.
- It costs more fieldwork than a plain SOC 2, so check that your buyers actually value it before asking for one.
04 · Where SOC 2 stops
Where a SOC 2 stops covering HIPAA
Privacy, contracts and patient rights sit outside it.
- The Privacy Rule. Permitted uses and disclosures, minimum necessary and authorisations are not tested by the Security criteria.
- Patient rights. Access, amendment and accounting of disclosures run on their own clocks, which a SOC 2 does not test.
- BAAs. A SOC 2 may test vendor oversight. Whether each agreement exists and has the required terms is your work.
- Breach notification. Incident response may be tested. The HIPAA breach assessment and notices are not.
- Six-year retention. HIPAA's documentation period is a specific legal duty a SOC 2 does not look for.
The SOC 2 Privacy category does not fill these gaps. Its criteria are written for personal information in general, not for the specific rules HIPAA sets about health information.
05 · One control set
Running one control set for both
Build once, tag twice, evidence once.
- Scope the SOC 2 system to include every system that holds ePHI, so the report covers what HIPAA cares about.
- Keep one risk register and tag each risk that touches ePHI, so the same register serves CC3 and the HIPAA analysis.
- Build one control matrix with a column for the Trust Services Criteria and one for the Security Rule section.
- Collect evidence once and file it against both references.
- Add a HIPAA-only layer for officers, BAAs, breach assessment, Privacy Rule duties and retention.
- Align the calendar so the yearly HIPAA evaluation and risk review land inside the SOC 2 period.
Sources: 45 CFR 164.308 to 164.316 (Security Rule); 45 CFR 164.500 to 164.534 (Privacy Rule); 45 CFR 164.400 to 164.414 (Breach Notification Rule); AICPA Trust Services Criteria (TSP section 100) and AICPA SOC 2 guidance; NIST SP 800-66 Rev. 2.
HIPAA and SOC 2 questions
Does a SOC 2 report make us HIPAA compliant?
No. It evidences security controls, not legal compliance.
A SOC 2 can show that many Security Rule safeguards are designed and, in a Type 2, operating. It does not cover the Privacy Rule, your BAAs or breach notification, and it is not a legal finding.
Which should we do first?
If you handle PHI, the HIPAA risk analysis first.
HIPAA duties apply as soon as you handle PHI; a SOC 2 is a choice driven by buyers. Start with the risk analysis, then scope the SOC 2 so it covers the same systems and reuses the work.
Do buyers accept a SOC 2 in place of a HIPAA questionnaire?
Often in part. Expect HIPAA-specific follow-up questions.
A SOC 2 commonly answers the security half of a healthcare vendor review. Buyers usually still ask about BAAs, breach reporting and how you handle PHI under the Privacy Rule.
Should we include the Privacy category in our SOC 2 for HIPAA?
Only if buyers ask; it does not replace HIPAA privacy work.
The Privacy category tests general privacy practices. It may help some buyers, but it does not test the Privacy Rule's specific requirements, so the HIPAA-only work remains either way.
Map your controls once, for both.
A HIPAA risk assessment can be scoped to line up with your SOC 2 system, so one set of controls and evidence serves both.