SOC 2, ISO 27001 and HIPAA for Infrastructure Providers: One Program, Three Outputs

An infrastructure provider can meet SOC 2, ISO 27001 and HIPAA with one security program, because all three test the same capabilities: risk analysis, access control, logging, incident response, backup, physical security and media disposal. SOC 2 and ISO 27001 then produce an audit report and a certificate. HIPAA produces no certificate; it is a US law, and the provider shows compliance with a documented risk analysis, policies and a signed business associate agreement.

A typical request: a compute infrastructure startup selling GPU and bare-metal capacity needs a SOC 2 Type 2 report, ISO 27001 certification and a HIPAA self-attestation, because health-tech companies are in its pipeline. Run as three projects, that is three policy sets and three evidence calendars. Run as one program, it is one set of controls described three ways.

What Are SOC 2, ISO 27001 and HIPAA, and How Do They Differ?

SOC 2, ISO 27001 and HIPAA differ in who issues the result and whether it is optional. SOC 2 and ISO 27001 are voluntary frameworks customers ask for; HIPAA is a law once a company handles protected health information for a healthcare customer.

The AICPA describes SOC as a suite of service offerings CPAs may provide. ISO states that it does not perform certification or issue certificates; external certification bodies do, and accreditation bodies confirm their competence.

HIPAA has no equivalent. HHS's Security Rule FAQ says no standard requires certification, and that HHS does not endorse or otherwise recognize private organizations' certifications regarding the Security Rule. The rule instead requires a periodic evaluation under 164.308(a)(8), done internally or by an outside firm. A HIPAA self-attestation is the company's documented statement of compliance, backed by that evaluation. The SOC 2 vs ISO 27001 guide compares the two voluntary frameworks in depth.

When Is an Infrastructure Provider a HIPAA Business Associate?

An infrastructure provider is a HIPAA business associate when it creates, receives, maintains or transmits protected health information on behalf of a covered entity or another business associate. The definition at 45 CFR 160.103 includes a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate. A compute provider whose customer is a health-tech SaaS company is usually that subcontractor.

HHS's cloud computing guidance applies the definition to cloud service providers and closes the encryption argument: This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data. For these no-view services, the customer can take on some duties, such as user authentication, but the provider still has to control access to its own administrative tools.

HHS also states that a provider meeting the definition must comply with the applicable HIPAA Rules regardless of whether it has executed a BAA with the entity using its services.

What Must a HIPAA Business Associate Agreement Include for an Infrastructure Provider?

A HIPAA business associate agreement must require the provider to comply with the Security Rule, flow the same terms down to its own subcontractors, and report security incidents, including breaches of unsecured PHI. Those three terms come from 45 CFR 164.314(a)(2)(i). The Privacy Rule adds return or destruction of PHI when the agreement ends, where feasible.

Infrastructure provider BAAs tend to turn on four points:

• Incident reporting detail. HHS says the Security Rule does not prescribe the detail, frequency or format of incident reports, so the BAA can set them, including how unsuccessful scans are handled.
• Who controls what. HHS expects both parties to confirm in writing how each meets the Security Rule. A shared responsibility matrix attached to the BAA does this.
• Subcontractors. The provider's colocation facility, hardware maintainer or remote-hands vendor may need a BAA if it can reach ePHI.
• Audit rights. HIPAA does not require customer audits, but customers may ask for documentation or audits through the BAA. A current SOC 2 report and ISO 27001 certificate answer most of those requests.

The SOC 2 data center subservice guide covers the colocation provider's report and contract.

How One Security Program Maps to the HIPAA Security Rule, ISO 27001 and SOC 2

One security program maps to all three because each control answers a HIPAA safeguard, an ISO 27001 Annex A control and a SOC 2 criterion at the same time. The program is built around security capabilities, and the AICPA criteria expect outside requirements to feed it. Under CC3.1, the point of focus Complies With Externally Established Frameworks reads: Management establishes objectives consistent with laws and regulations or standards and frameworks of recognized external organizations.

The risk analysis is the anchor. HIPAA 164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate. SOC 2 CC3.2 asks that the entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. ISO 27001 clause 6.1.2 asks for the same. One risk register, with ePHI assets tagged, serves all three; the SOC 2 risk management guide for hybrid and on-prem covers building it for physical infrastructure. Retention lines up too: HIPAA 164.316(b)(2)(i) requires Security Rule documentation to be kept for six years, which also covers SOC 2 and ISO 27001 audit needs.

The ISO 27001 to SOC 2 control mapping lists all 93 Annex A controls against the Trust Services Criteria.

How to Sequence SOC 2, ISO 27001 and HIPAA for an Infrastructure Provider

An infrastructure provider gets all three fastest by building the program once, auditing SOC 2 and ISO 27001 together, and documenting HIPAA through the risk analysis and evaluation. HIPAA has no audit date, so it moves with the program from day one.

1. Map ePHI first. List every service, cluster and storage system that holds or could hold healthcare data, and decide which offerings get a BAA.
2. Run the capability assessment. Score each security capability, then write one risk analysis covering ePHI and the SOC 2 and ISO 27001 scope.
3. Write one policy set. Each policy cites the HIPAA section, Annex A control and TSC criterion it covers.
4. Operate the controls. One GRC platform, one evidence calendar, controls tagged to all three frameworks.
5. Audit SOC 2 and ISO 27001 together. A firm that is both a licensed CPA firm and an accredited certification body can test the same evidence once. The SOC 2 vs ISO 27001 guide covers audit order and SOC 2+ reports.
6. Complete the HIPAA evaluation. Perform the 164.308(a)(8) evaluation, record the results, and issue the self-attestation with the BAA template.

A SOC 2 report can also carry HIPAA. Paragraph .06 of the Trust Services Criteria says that when a service organization commits to a control framework, management and the practitioner are likely to consider the requirements of the process or control framework as additional points of focus. The result is third-party assurance on HIPAA controls, not a HIPAA certification.

The proposed update to the HIPAA Security Rule is still a proposal. As of October 2026 the Federal Register shows the January 2025 proposed rule (RIN 0945-AA22) and no final rule, so the current text of 45 CFR Part 164 Subpart C is what applies.

What Changes for HIPAA, ISO 27001 and SOC 2 in Colocation and On-Prem Environments

Colocation and on-prem environments put the physical safeguards back on the provider's own control list. HIPAA 164.310(a)(1) requires policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed. SOC 2 CC6.4 says The entity restricts physical access to facilities and protected information assets (for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel to meet the entity's objectives. ISO 27001 covers the same ground in A.7.1 and A.7.2.

In a colocation facility, those controls split. The facility operates the perimeter, guards and badge system, covered by its own SOC 2 report as a subservice organization. The provider controls the facility access list, cage keys or codes, and remote-hands approvals, and keeps the access reviews and visitor logs as evidence.

Device and media controls carry the most specific HIPAA language for hardware owners. 164.310(d)(1) requires policies covering the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility. Disposal and media re-use are both Required. SOC 2 CC6.5 adds that The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity's objectives.

For a GPU or bare-metal fleet, that means:

• Warranty drive returns. A failed NVMe drive shipped back to the vendor leaves with data on it unless the policy requires sanitization or keeping the drive.
• Server re-use between customers. Reprovisioning a bare-metal node for a new tenant is media re-use under 164.310(d)(2)(ii); the wipe needs a record.
• Decommissioning. Sanitization or destruction certificates per serial number, using a method such as NIST SP 800-88 Rev. 2.
• Movement records. An asset log of who moved which hardware and when meets 164.310(d)(2)(iii) and ISO 27001 A.7.10 together.

The SOC 2 data protection guide for on-prem datastores and physical media covers disposal evidence, and the SOC 2 on a neocloud guide covers which controls move when a neocloud owns the hardware.

Why One Program Is the Faster Path to Healthcare Deals for Infrastructure Providers

Healthcare buyers ask for SOC 2, ISO 27001 and HIPAA in the same security review, so an infrastructure provider that hands over a report, a certificate and a signed BAA together reaches contract sooner. The work is in the risk analysis, the physical and media controls, and a year-round evidence calendar. The SOC 2 for bare metal and on-prem infrastructure page and the HIPAA readiness program describe how the pieces fit, and providers scoping all three can contact Truvo about the system boundary.

Related Guides

• What Is a Neocloud? Definition, Examples, and What It Means for Compliance
• SOC 2 for Chip Startups: Design IP, EDA Environments, Foundries and Compute Services
• On-Prem SOC 2 Cost and Timeline: What Changes When You Run Your Own Hardware

Frequently Asked Questions

Is there a HIPAA certification for cloud or infrastructure providers?

No. HHS states that no Security Rule standard requires certification and that it does not recognize private HIPAA certifications, and OCR does not certify cloud products. Providers show HIPAA compliance with a risk analysis, policies, a periodic evaluation under 164.308(a)(8) and signed BAAs.

Can a SOC 2 audit cover HIPAA?

A SOC 2 examination can include HIPAA requirements as additional points of focus when the service organization commits to them. The report gives customers third-party assurance on HIPAA-related controls. HIPAA compliance itself still depends on the risk analysis, policies and business associate agreements.

Is a GPU or bare-metal provider a HIPAA business associate if customer data is encrypted?

Yes, if the provider stores or processes ePHI for a covered entity or business associate. HHS cloud guidance says a provider holding only encrypted ePHI without the key is still a business associate. The conduit exception covers only transmission services.

Should SOC 2 and ISO 27001 be audited at the same time?

Running SOC 2 and ISO 27001 audits together saves effort because both test the same controls and evidence. A firm that is both a licensed CPA firm and an accredited certification body can coordinate fieldwork. Build the program and the Statement of Applicability first, then schedule both audits.

Does a colocation provider need to sign a BAA?

It depends on access. HHS guidance does not address colocation directly. A facility providing only space, power and cooling differs from one whose remote-hands staff can reach drives or consoles. Confirm the position with counsel and record it in the vendor risk assessment.

Sources

• HHS Office for Civil Rights, Guidance on HIPAA and Cloud Computing
• HHS, FAQ: Are we required to certify our organization's compliance with the Security Rule?
• eCFR, 45 CFR 160.103 Definitions (business associate)
• eCFR, 45 CFR 164.308 Administrative safeguards
• eCFR, 45 CFR 164.310 Physical safeguards
• eCFR, 45 CFR 164.312 Technical safeguards
• eCFR, 45 CFR 164.314 Organizational requirements
• eCFR, 45 CFR 164.316 Policies and procedures and documentation requirements
• Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of ePHI (proposed rule, RIN 0945-AA22)
• AICPA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
• AICPA and CIMA, System and Organization Controls: SOC Suite of Services
• ISO, ISO/IEC 27001:2022 Information security management systems
• ISO, Certification
• NIST, SP 800-88 Rev. 2 Guidelines for Media Sanitization