Sketches of compliance and security symbols

SOC 2 vs. HIPAA: What Each One Requires and Which You Need

October 18, 2026

HIPAA is a federal law. SOC 2 is a voluntary audit report. That is the shortest honest answer, and everything else follows from it. If you handle protected health information (PHI) for a covered entity, HIPAA applies to you whether you like it or not. If a customer asks for proof that your controls work, SOC 2 is one way to give it. Many businesses end up needing both, and confusing the two is how small companies sign contracts they cannot honor.

We work with small and mid-sized businesses and healthcare practices across Central Texas, and this question reaches us constantly. Below is how the two differ, where they overlap, and how to decide what to do first.

tekrescue

Strengthen Your HIPAA Security

tekRESCUE helps healthcare providers protect sensitive data through cybersecurity, compliance expertise, and managed IT services.

Explore tekRESCUE services

Table of Contents

TL;DR

HIPAA is mandatory for covered entities and their business associates. SOC 2 is voluntary, usually requested by customers or partners.
Neither is a certificate. HHS does not certify HIPAA compliance, and a SOC 2 is an attestation report written by an independent CPA firm.
A SOC 2 report alone does not prove HIPAA compliance. It can support it, especially when the scope is mapped to HIPAA requirements.
If you touch PHI for a provider, you need a Business Associate Agreement (BAA) no matter what audit reports you hold.
Fix your policies and day-to-day practices first. Auditing a chaotic environment produces a bad report, and a bad report can hurt more than none.

The core difference: law versus assurance
SOC 2 vs. HIPAA side by side
Neither one is a certification
What HIPAA actually requires of you
What SOC 2 actually tests
Where they overlap
Where they do not overlap
The business associate trap
What if you are not covered by HIPAA?
Which one do you need?
Do the foundation before the audit
Our perspective
How tekRESCUE can help
FAQ
Sources

The core difference: law versus assurance

HIPAA is a regulatory mandate. It applies to covered entities and business associates: health plans, clearinghouses, and health care providers that transmit certain transactions electronically, plus the vendors that handle PHI on their behalf. The Department of Health and Human Services (HHS) enforces it, through its Office for Civil Rights.

SOC 2 is different in kind. It was created by the AICPA, and a SOC 2 examination is a report on a service organization’s controls relevant to security, availability, processing integrity, confidentiality or privacy. Nobody in government requires it. A customer, an enterprise procurement team or an insurer asks for it because they want a third party to vouch for how you operate.

Put simply:

HIPAA asks: are you meeting a legal duty to protect patient information?
SOC 2 asks: can an independent auditor confirm that the controls you say you have were actually operating?

One is a duty. The other is evidence.

SOC 2 vs. HIPAA side by side

	HIPAA	SOC 2
Nature	Federal law and regulation	Voluntary attestation report
Who sets it	Congress and HHS	AICPA
Who must comply	Covered entities and business associates	Nobody by law; requested by customers
Scope	Protected health information	Whatever systems and services you define in scope
Structure	Privacy, Security and Breach Notification Rules	Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy
Who checks	HHS Office for Civil Rights, after a complaint or breach	An independent CPA firm, on your schedule
Output	No certificate. Ongoing obligation	A report covering a point in time or a period
Flexibility	Prescriptive in places, flexible in how you scale	You choose which criteria are in scope

Neither one is a certification

This trips up buyers and sellers alike. HHS publishes the HIPAA Security Rule and enforces it, but it does not hand out a seal. Any vendor that says it is “HIPAA certified” is using marketing language. What they usually mean is that they completed a self-assessment, a training course or an audit against some framework.

SOC 2 has the opposite problem. It sounds like a certification, but it is an attestation. The auditor gives an opinion on your controls. That opinion can be clean, or it can be qualified, meaning the auditor found problems significant enough to note.

When a prospect says “send us your HIPAA certificate,” the right response is to explain what you can provide instead: your risk analysis, your policies, your signed BAAs, workforce training records and, if you have one, a SOC 2 report.

What HIPAA actually requires of you

The Security Rule sets national standards for protecting electronic PHI that a covered entity or business associate creates, receives, uses or maintains. It organizes safeguards into administrative, physical and technical categories. In practice that means:

A documented risk analysis and a plan to reduce the risks it finds
Access controls, so people see only the PHI their job requires
Audit logging and review of system activity
Encryption and transmission security, covered in our guide to PHI encryption for small practices
Workforce training and sanction policies
Contingency planning, including backups and recovery
Breach notification procedures

The rule is built to scale. A three-person clinic and a hospital system do not implement it identically, but both must be able to show their reasoning.

If you want a plain-language walk through the safeguards, see our page on HIPAA compliance and the breakdown of the HIPAA Security Rule and OCR penalties.

What SOC 2 actually tests

SOC 2 is organized around five Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Security is the baseline. The others are optional, and you pick the ones that match what you promise customers. A managed hosting provider will probably include availability. A billing processor will care about processing integrity.

Two features matter for small businesses.

It tests operation, not intention. A SOC 2 auditor does not just read your policies. They look for evidence that the controls ran as described. A policy that says you review access quarterly means nothing if nobody can show the quarterly reviews.

It is a window, not a guarantee. A report reflects the controls you described in your system description and how they performed during the audit period. If you change your environment right after the audit, the report may no longer describe your real risk. A SOC 2 report does not mean “secure forever.”

There are two common report types. A Type 1 looks at whether controls are designed appropriately at one point in time. A Type 2 looks at whether they operated effectively over a period. Buyers usually prefer Type 2 because it shows sustained behavior.

What SOC 2 actually tests — overview diagram

Where they overlap

The two share a lot of DNA. Both expect you to:

Assess risk and act on what you find
Restrict access and review it
Encrypt sensitive data in storage and transit
Log and monitor system activity
Train staff and enforce policy
Plan for incidents and recovery
Manage vendors that touch your data

Because of that, many organizations use the SOC 2 framework to map and test the controls they need for HIPAA. The work you do for one carries over to the other. A solid risk assessment feeds both. Good encryption and backups feed both, as we explain in our post on encrypting data and backups in a managed IT plan.

Where they do not overlap

This is the part that causes expensive mistakes.

HIPAA has requirements SOC 2 does not. The Privacy Rule gives patients rights over their records. Breach notification has its own legal rules and deadlines. A BAA is a specific legal contract. A standard SOC 2 report does not cover these by default, which is why a SOC 2 report alone typically does not show compliance with every HIPAA requirement.

HIPAA and SOC 2 differences across three dimensions

SOC 2 has no legal force. Passing it does not protect you from an HHS investigation, and failing it does not trigger a federal penalty. It only affects whether customers trust you.

Scope is yours to define in SOC 2. Under HIPAA, PHI is PHI wherever it sits. In SOC 2, you decide which systems and criteria are in scope. If PHI lives outside that boundary, the report says nothing about it.

The business associate trap

If you are a tech provider, billing company, cloud host, consultant or any other vendor that handles PHI for a provider, you are a business associate. HHS spells out the obligations in its business associate guidance, and a signed BAA is a core piece of it. A general service agreement is not a substitute.

Two common misunderstandings:

“We have SOC 2, so we don’t need a BAA.” Wrong. A SOC 2 report does not replace the contract.
“Our cloud platform is HIPAA compliant, so we are too.” A platform may offer compliant infrastructure, but configuring it securely and maintaining the BAA is your responsibility. Buying space on a big cloud does not transfer your duties.

Our article on what a Business Associate Agreement must cover goes through the clauses in detail.

What if you are not covered by HIPAA?

Some businesses handle health data without being covered entities or business associates, such as certain health apps and connected devices. The FTC has its own rules for them. Its Health Breach Notification Rule guidance explains that companies outside HIPAA may still have to notify customers and the FTC after a breach. The FTC also lays out how HIPAA, the FTC Act and the Health Breach Notification Rule fit together for consumer health information.

In that situation, SOC 2 may be the more natural way to show customers you take security seriously, while the FTC rules set the legal floor.

Which one do you need?

Use this as a decision path.

Are you a covered entity or business associate? If yes, HIPAA applies now. Start there.
Do customers or partners ask for a SOC 2 report in security questionnaires or contracts? If yes, plan for it, but only after your basics are in place.
Do you handle health data but fall outside HIPAA? Look at the FTC rules, and treat SOC 2 as optional proof of good practice.
Are you a small provider with no vendor customers? You probably need HIPAA compliance and nothing else. A SOC 2 report would add cost without answering any question your patients or regulators are asking.

A CPA firm that needs to secure client financial data has a similar pattern with a different regulator. The principle holds: law first, then the evidence customers request.

Do the foundation before the audit

The fastest way to hurt yourself is to chase a SOC 2 report while your internal processes are undocumented or inconsistent. Auditors test how you actually operate. If you cannot show that access reviews, backups, patching and onboarding happen as written, you can end up with a qualified report. That is the audit equivalent of a failing grade, and it can damage your reputation more than having no report.

A sensible order of work:

Inventory where PHI and sensitive data live. Servers, laptops, email, cloud apps, backups, vendors.
Run a risk assessment and write down what you find.
Close the obvious gaps. Multifactor authentication, encryption, patching, endpoint protection, tested backups.
Write policies that match reality, not aspiration.
Sign BAAs with every vendor and client relationship that requires one.
Train your staff and keep records.
Only then, if customers demand it, scope a SOC 2 readiness effort and choose Type 1 or Type 2.

Email is a frequent weak spot for small practices, so see HIPAA compliant email before you assume your current setup is fine. For a Texas angle on incident duties, read our summary of the Texas data breach law for businesses.

Our perspective

We see the same pattern again and again. A small business gets a questionnaire from a larger customer, panics, and starts shopping for a SOC 2 report. Meanwhile, nobody has run a risk assessment, the backups have never been test-restored, and former employees still have active accounts.

Our view is blunt: compliance is an operational discipline, not a purchase. HIPAA compliance is not a product, and a report does not fix a weak environment. The threats are getting faster, and attackers do not care which framework you picked. Auditors will not stop a ransomware crew, but good controls, monitored and maintained, can.

So we start with the work underneath both frameworks: risk assessment, security controls, managed monitoring, documented policies and a response plan. Once that is real, mapping it to HIPAA, the NIST approach or a SOC 2 audit is a matter of paperwork and evidence rather than a scramble. If you can show consistent practice, you will answer questionnaires faster and sleep better.

Do not buy the audit before you have built the thing the audit examines.

— Randy Bryan

How tekRESCUE can help

If you are a healthcare practice, a CPA firm or another small business facing HIPAA duties or customer security demands in the Austin and San Marcos area, we can help you get the foundation in place. Our cybersecurity services include risk assessment, and our managed IT services cover the day-to-day security operations that compliance depends on. For HIPAA specifically, start with our HIPAA compliance page. If something has already gone wrong, our incident response team is the place to call.

FAQ

Does SOC 2 mean you are HIPAA compliant?

No. A SOC 2 report shows that an auditor examined your controls against criteria you chose. It does not cover every HIPAA requirement, such as patient rights, breach notification procedures or BAAs. It can be a useful part of your evidence if the scope is mapped to HIPAA safeguards.

Is SOC 2 legally required?

No. SOC 2 is a voluntary AICPA framework. In practice, customers and partners often make it a condition of doing business, so it can be required by contract even though it is not required by law.

Is there an official HIPAA certification?

No. HHS enforces the rules but does not certify organizations. Be skeptical of any vendor that claims to be “HIPAA certified.” Ask for the underlying evidence instead: risk analysis, policies, training records and signed BAAs.

What are the five SOC 2 criteria?

The Trust Services Criteria are security, availability, processing integrity, confidentiality and privacy. Security is the baseline, and you add the others based on what you promise your customers.

Should a small medical practice get a SOC 2 report?

Usually not first. A small practice’s legal duty is HIPAA, so the priority is a risk analysis, working safeguards, training and BAAs. Consider SOC 2 only if customers or partners ask for it.