HIPAA vs SOC 2
What HIPAA and SOC 2 each are, where they overlap, what only HIPAA covers, and which a health tech company needs first.
On this page
HIPAA vs SOC 2 at a glance
HIPAA is a federal law that applies to covered entities and business associates handling PHI; SOC 2 is a voluntary audit report, based on AICPA criteria, that a CPA firm issues about a service organization's controls. A SOC 2 report does not make a company HIPAA compliant and HIPAA does not require SOC 2. They overlap heavily on security controls, which is why healthcare SaaS companies often pursue both: HIPAA because the law applies, SOC 2 because customers ask for it.
| HIPAA | Federal law; mandatory for covered entities and business associates |
|---|---|
| SOC 2 | Voluntary CPA attestation against AICPA Trust Services Criteria |
| Certificate? | Neither — HIPAA has no certification; SOC 2 is a report, not a certificate |
| HIPAA specifically requires | BAAs, breach notification, Privacy Rule duties |
| SOC 2 Type II | Tests that controls operated over a period (often 3–12 months) |
Side by side
| HIPAA | SOC 2 | |
|---|---|---|
| What it is | Federal law and regulations (45 CFR Parts 160 and 164) | An attestation report under AICPA standards |
| Who it applies to | Covered entities and business associates | Any service organization that chooses to be audited |
| Mandatory? | Yes, if you are in scope | No — customers request it |
| Who checks | HHS OCR (complaints, investigations, audits) | An independent CPA firm |
| Scope | PHI: privacy, security, breach notification | Controls relevant to the Trust Services Criteria you choose — security, plus optionally availability, processing integrity, confidentiality, privacy |
| Result | No certificate; you document compliance | A report (Type I: design at a point in time; Type II: operation over a period) |
Where they overlap
Most Security Rule safeguards — risk assessment, access control, logging, encryption, incident response, vendor management, training — have SOC 2 counterparts. Teams that build one set of controls and map it to both avoid doing the work twice; compliance platforms are designed for that.
What HIPAA specifically requires
A SOC 2 report won’t, by default, show that you:
- signed BAAs with customers and subcontractors;
- can notify customers of a breach of unsecured PHI within the HIPAA deadline;
- use and disclose PHI only as your BAAs and the Privacy Rule allow;
- did the risk analysis the Security Rule requires, in its terms.
Some auditors offer a “SOC 2 + HIPAA” report that adds HIPAA criteria. It is still an auditor’s opinion, not an HHS certification.
Does SOC 2 help with OCR?
Since 2021, HHS must consider whether an organization had recognized security practices in place for the previous 12 months when deciding penalties and audit outcomes (Public Law 116-321). The law points to NIST frameworks, the HHS 405(d) practices and similar programs. Mature controls help; a SOC 2 report is one way to evidence them, but it isn’t named in the law.
Next steps
- HIPAA for SaaS companies that are business associates →Scenario
- HIPAA for health app startups →Scenario
- HIPAA compliance software →Tool
- Business associate →Requirement
- Security risk analysis →Requirement
- Business associate agreements (BAAs) →Requirement
- Notifying patients of a breach →Requirement
Frequently asked questions
Does SOC 2 mean HIPAA compliant?
No. SOC 2 shows an auditor tested your controls against AICPA criteria. HIPAA has its own requirements — risk analysis, BAAs, breach notification — that a SOC 2 report does not cover by default.
Do we need SOC 2 if we are HIPAA compliant?
HIPAA doesn't require it, but many healthcare and enterprise customers ask for a SOC 2 report in security reviews. It's a sales requirement, not a legal one.
Which should a health startup do first?
If you handle PHI, HIPAA applies from the first customer, so start with the HIPAA basics. SOC 2 typically follows when customers ask for an independent report.