SOC 2 vs HIPAA compares an audit report with a law. HIPAA is the federal rule set a vendor handling PHI must follow. SOC 2 is a CPA's report on a service organization's controls, tested over a period in Type 2. Ask a healthcare vendor for a signed BAA first, then for any SOC 2 report as evidence.
SOC 2 vs HIPAA in one comparison table
SOC 2 and HIPAA answer different questions. HIPAA is law: its Privacy and Security Rules set duties for covered entities and their business associates, and nobody issues a pass. SOC 2 is an attestation: an independent CPA examines a service organization's controls and writes a report. HITRUST is a separate framework with its own certified assessments.
The table below sets the four side by side. Read it as a map of what each one is, not a ranking.
| HIPAA | SOC 2 Type 1 | SOC 2 Type 2 | HITRUST | |
|---|---|---|---|---|
| What it is | Federal regulations in 45 CFR Parts 160 and 164 | A CPA's examination report on a service organization's controls | The same examination, with tests of how controls operated | A control framework with assessments and certification |
| Who issues it | Nobody issues it; HHS writes and enforces the rules | An independent service auditor | An independent service auditor | HITRUST, through its assessment process |
| What it covers | Uses and disclosures of PHI, safeguards for electronic PHI, BAAs | Controls relevant to security, availability, processing integrity, confidentiality or privacy | The same categories as Type 1 | The HITRUST CSF control library |
| Timing | Continuous duty, with periodic evaluation | Controls as of a specific date | Controls over a period | e1 and i1 valid 1 year, r2 valid 2 years |
| What it proves | Nothing by itself; compliance is shown by what an organization does | That controls were described and designed as stated on a date | That controls were tested over a period, with results | That an assessment against the HITRUST control set was completed |
The sources for each column are below.
- HIPAA. The Security Rule's administrative safeguards are in 45 CFR 164.308 on the eCFR, and its paragraph (a)(8) requires a periodic technical and nontechnical evaluation.
- SOC 2. The AICPA describes the SOC suite of services on its own page as "a suite of service offerings CPAs may provide". The title of its SOC 2 guide names the scope: controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy.
- Type 1 and Type 2. In an AICPA panel on maintaining high standards for SOC engagements, a speaker explains that "for a type 1, the service auditor is evaluating controls as of a specific date", and the panel notes that a type 2 report adds the operating effectiveness of the controls.
- HITRUST. The HITRUST Alliance home page describes the HITRUST CSF as "a comprehensive, threat-adaptive control library" and lists its e1 and i1 assessments as valid for one year and r2 for two years.
Why is there no HIPAA certification?
There is no HIPAA certification because HHS chose not to create one. When it finalized the Security Rule in 2003, it replaced a proposed certification standard with a requirement that each organization evaluate itself. Any "HIPAA certified" badge is issued by a private party, and it does not carry the government's approval.
The record is in the 2003 HIPAA Security Rule final rule in the Federal Register. HHS wrote that it had proposed that certification would be required, then moved the proposed "Certification" standard to 164.308(a)(8), modified it to cover technical and nontechnical evaluation and "renamed 'Evaluation'". In response to comments, it said it did "not intend to create certification criteria" and would "not assume the task of certifying software and off-the-shelf products".
The same document left the choice of evaluator to each organization. It says a covered entity may meet the evaluation standard "either by using its own workforce or an external accreditation agency". That is why outside firms offer HIPAA assessments, and why their reports can be useful evidence. What those reports cannot be is a government certification, because there is none.
What a "HIPAA certified" badge means
A badge on a vendor's website can mean several things: the vendor paid a firm to assess it against the HIPAA rules, its staff completed a HIPAA training course, or the vendor made the badge itself. Ask which one. The first can be worth reading. The second says something about training, not about the service. The third says nothing.
The question to ask instead is "will you sign a BAA, and what evidence can you show for each safeguard?" That moves the conversation from labels to facts. The guide to HIPAA compliant OCR applies the same test to document software.
Where HITRUST fits next to SOC 2 and HIPAA
HITRUST fits next to SOC 2 and HIPAA as a third kind of evidence. It is a control framework, the HITRUST CSF, with its own assessments that end in a HITRUST certification. Its control library maps to many standards, HIPAA among them, so a HITRUST report can speak to HIPAA safeguards in a way a SOC 2 report does not.
The HITRUST Alliance home page says the CSF harmonizes "60+ frameworks and standards" and that HITRUST "translates and reports HITRUST results into HIPAA" and other frameworks. It offers three assessment levels. The page describes e1 as "foundational cybersecurity assurance with 43 core controls", i1 as "threat-adaptive assurance with 182 control requirements" and r2 as "tailored assurance with the highest level of control requirements".
HITRUST vs SOC 2
The difference that matters to a buyer is who sets the controls. In a SOC 2 examination, the service organization describes its own system and controls, and the auditor tests them against the trust services criteria. In a HITRUST assessment, the control requirements come from the HITRUST library. Two SOC 2 reports from two vendors can cover quite different sets of controls, while two HITRUST assessments start from the same library, even though the page calls r2 "tailored" to each organization.
When buyers ask for it
Some buyers name HITRUST in their vendor requirements. Where no contract or policy names it, a buyer can still work from a BAA, a security questionnaire and whatever audit report the vendor has. If a contract names HITRUST, read which assessment level it asks for, because e1, i1 and r2 are not interchangeable.
What does a SOC 2 Type II report tell a healthcare buyer?
A SOC 2 Type II report tells a healthcare buyer which controls a vendor described, how an independent auditor tested them over a period, and what the tests found. Read the system description to see what is in scope, the auditor's opinion, and the test results, looking for any control that did not operate as described.
The AICPA's illustrative SOC 2 Type 2 report lists the parts such a report includes: management's assertion, the description of the system, the service auditor's report, and tests of controls and results thereof. Each part answers a different buyer question.
Management's assertion
This is the vendor's own statement that its description is fair and its controls were suitably designed and operated. It is the claim the auditor tests. Read it to see exactly what the vendor is standing behind.
The system description
The description defines the scope. Check that the service you are buying is in it, by name. A report that covers a vendor's hosting platform but not the document processing product you will use tells you little about that product. Check which of the five categories are covered too: a report may cover security alone, without confidentiality or privacy.
The service auditor's report
This is the auditor's opinion. Read the dates first, to confirm the period covered and how long ago it ended. Then read the opinion itself. If it carries any qualification, ask the vendor what caused it and what has changed since.
Tests of controls and results
This section lists each control, how the auditor tested it and what the test found. Look for any result that reports a deviation, such as an access review that was missed or a terminated employee whose access stayed open. One deviation is not a disaster. A pattern in the controls that protect PHI, such as access and logging, is worth a direct question.
SOC 2 and SOC 3
The AICPA's page on SOC 3 reports says SOC 3 addresses the same categories as SOC 2 but does "not provide the same level of detail", which is why SOC 3 reports "can be freely distributed". A SOC 3 can show that an examination happened. It cannot show you the test results, so ask for the SOC 2.
Mistaking a SOC 2 report for HIPAA compliance
Mistaking a SOC 2 report for HIPAA compliance is an easy error to make. A clean SOC 2 report shows that a vendor's chosen controls were tested. It does not replace the BAA that HIPAA requires before a vendor handles PHI, and it does not replace your own risk analysis of how that vendor fits your systems.
A report is not a contract
HIPAA requires a written contract with each business associate. 45 CFR 164.504(e) on the eCFR lists what it must contain, from the permitted uses of PHI to subcontractor terms and the return or destruction of data at termination. A SOC 2 report contains none of those commitments. A vendor with a clean report and no BAA still cannot receive PHI from you.
A report is not your risk analysis
Paragraph (a)(1)(ii)(A) of 45 CFR 164.308 requires each covered entity and business associate to assess the risks to the electronic PHI it holds. A vendor's SOC 2 report is an input to that analysis. It does not tell you how much of your PHI the vendor will hold, how it connects to your systems or what you will do if it fails. The full set of questions for that analysis is in what a healthcare vendor security questionnaire covers.
A report covers the controls the vendor chose
Because the vendor describes its own system, a SOC 2 report can be clean and still leave out controls that matter for PHI. Compare the controls in the report with the HIPAA safeguards you care about, such as audit controls and access control in 45 CFR 164.312 on the eCFR. Anything missing becomes a questionnaire item.
Putting the pieces together
For a vendor that will read your EOBs, claims or intake forms, the evidence set is a signed BAA, answers to a security questionnaire, and whatever audit report the vendor actually has. Schema Care does not claim a SOC 2 report or a HIPAA certification; what it offers today is a BAA on every paid plan, and its compliance section sets out where it stands. A step-by-step list for the whole review is in the HIPAA compliant document processing checklist, and background on how document software reads pages is in the medical OCR basics category.