SOC 2 vs HIPAA: What Overlaps and What HIPAA Adds

SOC 2 and HIPAA test most of the same security controls, so a company that handles health data for healthcare customers can run one security program and produce both. An audit firm we work with estimates that about 70% of HIPAA evidence carries over from a SOC 2 program, and the remaining 30% or less covers HIPAA-specific items: the Security Rule risk analysis, business associate agreements, breach notification and six-year document retention (Truvo Cyber, 2026).

The difference is in what each one is. SOC 2 is a voluntary audit report that customers ask for. HIPAA is a US law that applies as soon as the company handles protected health information for a healthcare customer, and HHS recognizes no HIPAA certification.

<!--more-->

SOC 2 vs HIPAA Compared Side by Side

SOC 2 and HIPAA differ in who requires them, who checks them and what the company receives at the end.

How Much of HIPAA a SOC 2 Program Covers

A SOC 2 program covers most of the HIPAA Security Rule, because both test the same security capabilities: access control, logging, incident response, backup, vendor management, physical security and media disposal. The table maps the HIPAA safeguards that come up most often to the SOC 2 criteria that test the same control.

What HIPAA Adds on Top of a SOC 2 Program

HIPAA adds five requirements that a SOC 2 program does not produce on its own. These items make up most of the 30% of HIPAA work outside SOC 2 evidence.

• A risk analysis scoped to ePHI. 164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information. A SOC 2 risk assessment under CC3.2 covers the company's service commitments; extend it to list every system that stores or processes ePHI, including backups, logs and analytics copies.
• Business associate agreements. A signed BAA with each healthcare customer, and with each subcontractor that can reach ePHI: the cloud provider, the email or SMS vendor that sends patient messages, the support tool that receives screenshots. The same vendor list feeds SOC 2 CC9.2 vendor risk management. 164.314(a)(2)(i) requires the BAA to bind the vendor to the Security Rule, flow the same terms to its subcontractors and report security incidents.
• Breach notification to the customer. Under 164.410(b), a business associate notifies the covered entity without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. Most healthcare customers write a shorter deadline into the BAA. Put both the legal limit and the contract deadline in the incident response plan.
• A named security official. 164.308(a)(2) requires the company to identify the security official who is responsible for the development and implementation of the policies and procedures. SOC 2 CC1.3 asks for defined responsibilities; HIPAA asks for one named person.
• Six-year document retention. 164.316(b)(2)(i) requires policies, procedures and records of required actions to be kept for 6 years from the date of its creation or the date when it last was in effect, whichever is later. SOC 2 sets no retention period, so most programs need a longer retention rule for HIPAA records.

HIPAA also brings Privacy Rule obligations for a business associate: use and disclose PHI only as the BAA allows, and apply the minimum necessary standard. The SOC 2 Privacy category covers similar ground but is optional; HIPAA applies these limits whether or not Privacy is in the SOC 2 scope.

Can One Audit Firm Cover SOC 2 and HIPAA Together?

One audit firm can cover SOC 2 and HIPAA in the same engagement, using the same evidence. The two options a company can ask for:

• SOC 2 with HIPAA as additional criteria (often called SOC 2+ HIPAA). Paragraph .06 of the Trust Services Criteria says that when a service organization commits to a control framework, management and the practitioner are likely to consider the requirements of the process or control framework as additional points of focus. The CPA firm tests the HIPAA Security Rule requirements alongside the Trust Services Criteria and reports on both in one SOC 2 report.
• SOC 2 report plus a separate HIPAA attestation from the same firm. The auditor reuses the SOC 2 evidence and tests the HIPAA-specific items (risk analysis, BAAs, breach procedures) on top. Audit firms often price the bundle below the cost of two separate engagements.

SOC 2 and HIPAA Scoping Decisions for Systems That Handle ePHI

The scoping decisions that change the most work in a combined SOC 2 and HIPAA program are where ePHI flows and which Trust Services Criteria go in the SOC 2 report.

• Map ePHI before choosing scope. List the application database, file storage, backups, log pipelines, data warehouse, support tools and any AI or analytics service that receives patient data. Each system that touches ePHI is in HIPAA scope and needs a BAA if a vendor runs it.
• Keep ePHI out of systems that do not need it. Masking PHI in application logs and support tickets removes those tools from HIPAA scope and shortens the BAA list.
• Pick Trust Services Criteria to match customer questions. Security is mandatory. Confidentiality (encryption, data classification) and Availability (backups, recovery testing) overlap heavily with HIPAA safeguards and add little work. Privacy and Processing Integrity are larger additions; add them when customers ask.
• Handle cloud and colocation providers through their own reports. The auditor asks for the provider's SOC 2 report and tests only the controls the company operates itself. The guide to SOC 2, ISO 27001 and HIPAA for infrastructure providers covers the case where the company owns the hardware.

For a team of under 50 people, 30 to 40 people typically end up in SOC 2 scope: leadership plus anyone who touches production (Truvo Cyber, 2026). The same people are the workforce members HIPAA training and access controls apply to. The SOC 2 people scoping guide covers employees, contractors and vendors.

How to Sequence SOC 2 and HIPAA in One Program

A company gets SOC 2 and HIPAA fastest by building one program, documenting HIPAA from day one and auditing once. HIPAA has no audit date, so its requirements start with the program.

1. Map ePHI and sign BAAs. Inventory every system and vendor that touches PHI. Put a BAA template in place for customers and collect signed BAAs from subcontractors.
2. Write one risk analysis. Cover the SOC 2 scope and every ePHI system in the same document, scored once.
3. Write one policy set. Each policy names the HIPAA section and SOC 2 criterion it covers, including the named security official, the 60-day breach limit and the six-year retention rule.
4. Operate the controls through an observation period. A SOC 2 Type 2 audit typically needs 100 to 120 pieces of evidence over an observation period of 3 to 6 months (Truvo Cyber, 2026). Tag each evidence item to both frameworks in the GRC platform. The SOC 2 Type 1 vs Type 2 guide covers when a Type 1 report comes first.
5. Audit SOC 2 with HIPAA in the same engagement. Ask the audit firm for SOC 2+ HIPAA or a bundled HIPAA attestation.
6. Perform the HIPAA evaluation. Record the 164.308(a)(8) evaluation results and repeat the evaluation after major environment changes.

A company that already holds a SOC 2 report starts at step 1 and reuses the existing controls; the HIPAA-specific checklist above is the remaining work.

Why Healthcare Buyers Ask for SOC 2 and HIPAA Together

Healthcare buyers ask for SOC 2 and HIPAA in the same security review because each answers a different question. The SOC 2 report shows an independent auditor tested the controls. The BAA and risk analysis show the vendor accepts legal responsibility for PHI. A vendor that can hand over both on the first request shortens the security review and reaches contract sooner.

The work is the same program described two ways. Companies that build HIPAA into the SOC 2 program from the start avoid a second policy set, a second evidence calendar and a second audit.

Frequently Asked Questions About SOC 2 and HIPAA

Does SOC 2 make a company HIPAA compliant?

SOC 2 covers most HIPAA Security Rule controls; HIPAA compliance also needs an ePHI risk analysis, signed business associate agreements, breach notification procedures, a named security official and six-year document retention. An audit firm we work with estimates about 70% of HIPAA evidence carries over from SOC 2.

Is there a HIPAA certification?

HHS does not recognize any private HIPAA certification and states that no Security Rule standard requires one. Companies show HIPAA compliance with a risk analysis, policies, a periodic evaluation under 164.308(a)(8) and signed BAAs. An independent SOC 2 report with HIPAA criteria gives customers third-party assurance.

Can SOC 2 and HIPAA be audited at the same time?

One CPA firm can test SOC 2 and HIPAA in the same engagement, either as a SOC 2+ HIPAA report or as a SOC 2 report with a separate HIPAA attestation built on the same evidence. Audit firms often discount the bundle.

Which comes first, SOC 2 or HIPAA?

HIPAA applies from the day a company handles PHI for a healthcare customer, so the BAA and risk analysis come first. SOC 2 follows on the customer's timeline. In practice both are built in one program and audited together.

How long does a business associate have to report a breach?

Under 45 CFR 164.410(b), a business associate notifies the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. Many BAAs set a shorter deadline.

Sources

• HHS, FAQ: Are we required to certify our organization's compliance with the Security Rule?
• eCFR, 45 CFR 164.308 Administrative safeguards
• eCFR, 45 CFR 164.310 Physical safeguards
• eCFR, 45 CFR 164.312 Technical safeguards
• eCFR, 45 CFR 164.314 Organizational requirements
• eCFR, 45 CFR 164.316 Policies and procedures and documentation requirements
• eCFR, 45 CFR 164.410 Notification by a business associate
• AICPA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)