SOC 2 + HIPAA Attestation
A SOC 2 examination that also addresses the HIPAA Security Rule safeguards as additional criteria, issued by a licensed CPA firm, so a healthcare customer can read one report that covers both.
- Criteria
- Public HIPAA Security Rule text
- Report
- SOC 2 Type I or II with HIPAA section
- Engagement
- Additional criteria in your SOC 2 examination
Timeline: Same period as your SOC 2 when the added controls have operated for that period; otherwise we tell you on the scope call.
Who needs SOC 2 + HIPAA?
Healthtech SaaS
You store or process protected health information for providers, payers, or digital health apps.
Business associates
You have signed a BAA and your customer's compliance team wants evidence behind it.
Vendors to hospital systems
Procurement asks "are you HIPAA compliant?" and a SOC 2 alone does not answer it.
What is in the report
- Your full SOC 2 opinion on the Trust Services Criteria you select
- An additional section addressing your controls against the HIPAA Security Rule administrative, physical and technical safeguards, based on the mapping management prepares
- Test results for the HIPAA-specific controls, including your risk analysis, workforce training, and breach notification procedures
- Optionally, a SOC 3 general-use report you can share with prospects before an NDA is signed
What it is not
HHS does not certify anyone as HIPAA compliant and does not recognize private "HIPAA certifications." This is not a HITRUST report. It is an independent CPA attestation that addresses the Security Rule safeguards as additional criteria in your SOC 2 examination.
We do not design, implement, or operate the controls we examine.
How it works
The framework is addressed as additional criteria in the same SOC 2 examination: one report, one fieldwork window.
- 1
Scope call
Confirm PHI systems in scope and which TSC categories apply.
- 2
Mapping
You map your controls to the HIPAA Security Rule safeguards. We evaluate the mapping and can share a template crosswalk, but the mapping is management’s.
- 3
Examination
HIPAA-mapped controls are tested in the same fieldwork as your SOC 2.
- 4
One report
Signed SOC 2+ report with the HIPAA section.
Scope, timing and fees
The add-on is scoped together with your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
Selling into healthcare?
Schedule a free 30-minute preliminary scope discussion. We will tell you whether SOC 2 + HIPAA answers your customer's question or whether they are asking for something else.