SOC 2 and HIPAA are not interchangeable: HIPAA is a federal law whose Security Rule applies to covered entities and their business associates, while SOC 2 is a voluntary attestation report issued by a CPA firm. A SOC 2 report cannot make a company “HIPAA compliant,” but it can provide independent evidence that supports many of the safeguards HIPAA expects.
Is SOC 2 the same as HIPAA compliance?
No. SOC 2 is not HIPAA compliance. HIPAA’s Security Rule sets legal requirements for protecting electronic protected health information (ePHI), while SOC 2 is an auditor’s opinion on controls you chose to be examined against the Trust Services Criteria.
| Aspect | HIPAA Security Rule | SOC 2 |
|---|---|---|
| Nature | Federal regulation | Voluntary attestation report |
| Applies to | Covered entities and business associates | Any service organization that chooses it |
| Protects | Electronic protected health information | Whatever the selected criteria cover |
| Who evaluates | HHS Office for Civil Rights enforces; no certifier | Licensed CPA firm issues the report |
| Result | Compliance or violation | Opinion; no pass or fail |
HHS states that its Office for Civil Rights does not endorse, certify or recommend specific technology or products. That is why claims of “HIPAA certified” describe a vendor’s own assessment or a third-party review, not an HHS certification.
Does a SaaS company need a business associate agreement?
Yes, if you create, receive, maintain or transmit ePHI on behalf of a covered entity, you are generally a business associate and need a BAA with each covered-entity customer. HHS says a covered entity may use a cloud service for ePHI only if it enters into a HIPAA-compliant BAA with the provider.
Encryption does not remove the obligation. HHS guidance states that a cloud provider holding encrypted ePHI without the decryption key is still a business associate. Using a provider without a BAA puts the covered entity in violation of the HIPAA Rules. If you build on a cloud provider yourself, you need a BAA with that provider too.
What does the HIPAA Security Rule require?
The Security Rule requires covered entities and business associates to protect the confidentiality, integrity and availability of ePHI through administrative, physical and technical safeguards. It is scalable and technology neutral, so it does not dictate specific security measures.
- Risk analysis and management: assess risks and vulnerabilities to ePHI and reduce them to a reasonable level.
- Administrative safeguards: security management, a designated security official, workforce access, training, incident response, contingency planning and periodic evaluation.
- Physical safeguards: facility access, workstation security and control of hardware and media.
- Technical safeguards: access controls, audit logging, integrity protection, authentication and transmission security.
- Documentation: written policies, kept for six years.
Some specifications are “addressable,” which HHS says does not mean optional: the entity must implement them if reasonable and appropriate, or document why not and use an alternative.
How does SOC 2 support HIPAA?
SOC 2 supports HIPAA by giving customers independent evidence that overlapping controls exist and operate. Access control, logging, risk assessment, change management and incident response appear in both.
| HIPAA expectation | Related SOC 2 evidence |
|---|---|
| Risk analysis | Risk assessment controls (Common Criteria) |
| Access and authentication controls | Logical access controls, MFA, access reviews |
| Audit logging | Logging and monitoring controls |
| Incident response | Incident detection and response controls |
| Contingency planning | Availability criteria, backup and recovery |
| Transmission security | Encryption in transit |
This is our approximate mapping, not an official crosswalk. A SOC 2 does not test HIPAA-specific items such as BAAs or the minimum necessary standard unless you ask the auditor to report on additional criteria, an option some firms offer as a “SOC 2+” report. See our SOC 2 audit guide and the Trust Services Criteria.
Which SOC 2 categories matter most for healthcare?
Security is mandatory, and for healthcare SaaS the most relevant additions are usually Availability and Confidentiality, with Privacy added when you handle personal information at scale. Choose by what your customers’ security reviews ask for.
- Availability: clinical and operational workflows depend on uptime commitments.
- Confidentiality: information designated confidential is protected and disposed of securely.
- Privacy: collection, use, retention and disposal of personal information.
What is changing in HIPAA?
HHS proposed a major update to the Security Rule on January 6, 2025, aimed at strengthening the cybersecurity of ePHI. The latest coverage we found, from June 2026, reported that it had not been finalized, so the current rule still applies.
Check HHS’s official page for the proposal’s status before relying on it. Build your program on the current rule and on sound controls, since evidence of those will carry over to any stricter requirements.
Next Assurance helps healthcare SaaS teams choose the right Trust Services Criteria and prepare evidence customers' security reviews expect. See our SOC 2 audit service.
Frequently asked questions about SOC 2 and HIPAA
Is a SOC 2 report the same as HIPAA compliance?
No. HIPAA is a federal law that sets legal requirements for protecting ePHI, and violations are enforced by HHS. SOC 2 is a voluntary report where a CPA firm gives an opinion on controls against the Trust Services Criteria. A SOC 2 can support HIPAA compliance, but it does not replace a HIPAA risk analysis or BAAs.
Does HHS offer a HIPAA certification?
No. HHS states that the Office for Civil Rights does not endorse, certify or recommend specific technology or products, and it does not identify which cloud providers are HIPAA compliant. Claims of being “HIPAA certified” refer to a vendor’s own assessment or a third-party review, which can be useful but is not a government certification.
Do I need a BAA if my SaaS stores encrypted data?
Generally yes. HHS guidance says a cloud service provider that holds encrypted ePHI without the decryption key is still a business associate, because lacking the key does not exempt it from business associate obligations. The rules are scaled for such a no-view arrangement, but the BAA and Security Rule duties still apply.
Which SOC 2 criteria are best for healthcare SaaS?
Security is mandatory in every SOC 2 report. Healthcare SaaS companies commonly add Availability because workflows depend on uptime, and Confidentiality or Privacy when handling sensitive or personal information. Pick the categories your customers’ security questionnaires actually request, since each added category adds controls to design, operate and evidence.
Can a SOC 2 report cover HIPAA requirements?
A standard SOC 2 tests the Trust Services Criteria, not HIPAA itself. Overlapping controls such as access, logging and incident response provide useful evidence. If customers want HIPAA-specific items reported, some audit firms can report on additional criteria alongside SOC 2. Discuss scope with your CPA firm and your counsel before promising coverage.
Is the HIPAA Security Rule changing?
HHS published a proposed update on January 6, 2025 to strengthen the cybersecurity of ePHI. The most recent coverage found, dated June 2026, said it had not been finalized, so the existing rule remains in effect. Verify the current status on HHS’s website, and treat this page as general information, not legal advice.
Sources
Facts checked against primary sources on October 7, 2026. This page is general information, not legal advice.
- HHS – Guidance on HIPAA and Cloud Computing: BAA required with cloud providers; OCR does not endorse or certify products; encrypted-data providers remain business associates.
- HHS – Summary of the HIPAA Security Rule: scope, safeguards, addressable specifications and documentation requirements.
- Federal Register – HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, January 6, 2025).
- AICPA & CIMA – System and Organization Controls: SOC Suite of Services: the AICPA’s overview of SOC 1, SOC 2 and SOC 3 reports.
