SOC 2 readiness for a healthcare vendor is the work of getting a software, data or service company ready for a CPA firm to examine its controls over a customer's data: scoping the system, writing the policies, closing gaps and organizing evidence. Integral Healthcare Solutions (IHS) drafts the readiness documents and evidence map with your team. IHS is not a CPA firm and issues no SOC 2 report, opinion or attestation; a CPA firm you engage does that.
Last updated: November 2026
What is a SOC 2 examination, and who performs it?
A SOC 2 examination is performed by a CPA firm, not by a consultant, and it produces a report for the vendor's customers. In its February 2026 coverage, the Journal of Accountancy reports that CPAs perform SOC examinations under the AICPA's attestation standards (Journal of Accountancy, February 1, 2026, page opened November 5, 2026). The AICPA's own SOC page presents SOC as a family of CPA reporting services meant to inform a vendor's customers about outsourcing risk (AICPA SOC suite, page opened November 5, 2026).
The criteria are the AICPA 2017 Trust Services Criteria with Revised Points of Focus (2022). They cover security, availability, processing integrity, confidentiality and privacy (AICPA criteria download page, page opened November 5, 2026; the file itself requires a free AICPA account and we did not read it). The AICPA SOC page also lists exposure drafts of proposed 2027 SOC 2 criteria dated October 26, 2026; we did not read them.
Why do healthcare vendors need SOC 2 if HIPAA already applies?
They often need both, because they answer different questions. HIPAA is a federal rule set that binds covered entities and business associates. A SOC 2 report is an independent CPA examination that a customer asks for in procurement. The table separates them.
| Item | HIPAA Security Rule | SOC 2 examination |
|---|---|---|
| What it is | Federal regulation, 45 CFR Part 164, Subpart C | CPA examination against AICPA criteria |
| Who requires it | The law, for covered entities and business associates | A customer or a contract |
| Who judges it | HHS Office for Civil Rights, on complaint or review | The CPA firm, then each report reader |
| Certification | HHS states that no standard requires a covered entity to certify compliance | A report from a CPA firm, not a certificate |
HHS states: "No, there is no standard or implementation specification that requires a covered entity to “certify” compliance." It also states that "HHS does not endorse or otherwise recognize private organizations’ “certifications” regarding the Security Rule, and such certifications do not absolve covered entities of their legal obligations under the Security Rule." (HHS FAQ on certification, content last reviewed July 26, 2013, page opened November 5, 2026.) That FAQ speaks to covered entities and to the Security Rule. In IHS's reading, a SOC 2 report is likewise not a substitute for HIPAA compliance.
Is a healthcare vendor a HIPAA business associate?
Often yes, when it handles ePHI for a covered entity or another business associate. HHS states that when a covered entity engages a cloud service provider to create, receive, maintain, or transmit ePHI on its behalf, the provider is a business associate under HIPAA, and that this is true even if the provider processes or stores only encrypted ePHI and lacks an encryption key (HHS cloud computing guidance, page opened November 5, 2026). The same guidance says a cloud provider hired by a business associate to handle ePHI is also a business associate, and that the covered entity (or business associate) and the provider must enter a business associate agreement.
Under 45 CFR 164.308(b)(1), "A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor." (eCFR 164.308, read November 5, 2026.) The business associate contract must provide that the business associate will report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410 (eCFR 164.314(a)(2)(i)).
What do regulators look for that a SOC 2 file also needs?
OCR's published resolution agreement with Montefiore Medical Center, a covered entity, lists the Security Rule provisions OCR cited after investigating a reported breach. The potential violations were the risk analysis requirement in 164.308(a)(1)(ii)(A), the requirement to regularly review records of information system activity in 164.308(a)(1)(ii)(D), and the audit controls requirement in 164.312(b). The agreement states that it is not an admission of liability (HHS resolution agreement, content last reviewed June 25, 2024, page opened November 5, 2026).
A further rule shapes the documents. Under 164.316(b)(2)(i), documentation is retained "for 6 years from the date of its creation or the date when it last was in effect, whichever is later" (eCFR 164.316).
How does IHS help with SOC 2 readiness?
IHS prepares the vendor and stops before the examination. The work, in order:
- Scope the system and list the customer requests, so the categories in scope match what buyers ask for.
- Run a gap assessment of current practice against the criteria categories the vendor picks.
- Draft policies and procedures: access, incident response, change management, vendor oversight, business continuity, risk assessment.
- Build an evidence map that names, for each control, who produces what record and how often.
- Draft the business associate agreement checklist and subcontractor oversight records that tie to 164.308(b) and 164.314(a).
- Walk through a mock request list the way a CPA firm would issue it.
Your team supplies system facts, configurations, tickets, logs and screenshots. Your management adopts every document. You select and engage the CPA firm. IHS does not take possession of ePHI, so do not send it, and IHS does not perform penetration testing, run vulnerability scans, sell a compliance platform or select the auditor for you. IHS is a consulting firm, not a law firm or CPA firm, and this page is not legal or accounting advice.
What should you have ready before the first call?
- The customer contracts or security questionnaires that ask for a SOC 2 report, with the categories they name.
- A list of systems that create, receive, maintain or transmit customer data, including cloud providers and subcontractors.
- Your signed business associate agreements and any subcontractor agreements (164.308(b)(3)).
- Your latest HIPAA risk analysis and risk management plan, if you have them (164.308(a)(1)(ii)(A) and (B)).
- Current written security policies and the dates they were last reviewed (164.316).
- The person who will own evidence collection after the engagement.
Bring what you have; a missing item is a finding, not a barrier to the call.
How does SOC 2 compare with HITRUST and with software platforms?
A SOC 2 report is a CPA firm's report on a vendor's controls over customer data. HITRUST is a separate private program; IHS is not a HITRUST licensee, and our security compliance foundations page explains what IHS does around it. A compliance software platform automates evidence collection. The Journal of Accountancy reports that most of these software companies are not CPA firms (Journal of Accountancy, February 1, 2026).
A Journal of Accountancy article by the AICPA's technical director for peer review describes a May 2026 reviewer alert asking peer reviewers whether a CPA firm's SOC 2 engagements fit each client's own risks or repeat identical reports, risk assessments, sample sizes and testing (Journal of Accountancy, May 14, 2026, page opened November 5, 2026). In IHS's reading, that is a reason to keep control descriptions specific to your system. IHS does not tell you which route to take.
For the HIPAA side, see risk analysis and risk management and business associate management. Both are part of IHS Compliance Services.
What does it cost?
The AICPA pages we opened do not publish a fee schedule for SOC 2 examinations; the CPA firm you engage quotes its own fee, and fees depend on scope. Verify current fees with the CPA firm. IHS scopes each engagement after a free introductory call.
What this is not
- Not a SOC 2 report, opinion or attestation. Only a CPA firm issues one.
- Not a guarantee that a CPA firm will issue a report without exceptions, or that a customer will accept it.
- Not legal or accounting advice, and not a HIPAA certification, which HHS says no standard requires.
- Not a substitute for your own risk analysis, penetration testing or vulnerability scanning.
Frequently asked questions
What is SOC 2 readiness for a healthcare vendor?
It is the preparation a vendor does before a CPA firm examines its controls: choosing which trust services categories apply, finding gaps, writing the policies, and collecting the evidence. Integral Healthcare Solutions (IHS) drafts the policies and the evidence map with your team. A CPA firm that you engage performs the examination and issues the report.
Does IHS issue a SOC 2 report?
No. IHS is not a CPA firm and issues no attestation, opinion or report. AICPA's SOC 2 examination is performed by a CPA firm. IHS prepares the vendor for that examination.
Does HIPAA require a SOC 2 report?
The HIPAA Security Rule sections we opened do not mention SOC 2. HHS states that no standard or implementation specification requires a covered entity to certify compliance. A hospital or health plan may still require a SOC 2 report in its vendor contract, which is a commercial requirement and not a HIPAA one.
Is a vendor that hosts patient data a HIPAA business associate?
HHS states that when a covered entity engages a cloud service provider to create, receive, maintain, or transmit ePHI on its behalf, the provider is a business associate. HHS adds that this holds even if the provider processes or stores only encrypted ePHI and lacks an encryption key. A vendor that fits that description needs a business associate agreement with the covered entity or, as a subcontractor, with the business associate that engaged it.
Does a clean SOC 2 report satisfy the HIPAA risk analysis?
The Security Rule lists the risk analysis as a Required specification, and it says nothing about substituting a third-party report. In IHS's reading, a SOC 2 report is evidence a customer can review, and the risk analysis is the vendor's own documented assessment. Neither replaces the other.
What does IHS draft, and what does my team supply?
IHS drafts the gap assessment, policies, procedures, risk assessment worksheet, vendor oversight records and an evidence map. Your engineers and IT staff supply system facts, configurations and the evidence the controls produce. Your management adopts every document and signs the statements the CPA firm asks for.
Should we choose a Type 1 or a Type 2 report?
This page does not define the two types, because the definitions sit in AICPA's SOC 2 guide, which AICPA sells and we did not open. Ask the customer who requires the report which type its contract names, and ask the CPA firm what each requires.
Will a compliance software platform get us a SOC 2 report?
A platform can collect evidence. A Journal of Accountancy article from February 2026 reports that most of these software companies are not CPA firms. A report still comes only from a CPA firm. A May 2026 article in the same journal says an AICPA reviewer alert asks peer reviewers whether a CPA firm's SOC 2 engagements fit each client's own risks or repeat identical reports, risk assessments, sample sizes and testing.
Will the HIPAA Security Rule change soon?
HHS proposed changes on December 27, 2024 (90 FR 898, January 6, 2025). It is a proposal, not a rule. The Unified Agenda entry we opened lists Final Action as July 2027 under Long-Term Actions, which is a target and not a commitment.