HIPAA vs SOC 2: which do you need?

The short answer

HIPAA and SOC 2 are different kinds of things, so "HIPAA vs SOC 2" is a bit like "speed limit vs driving test."

HIPAA is a law. If your product creates, receives, maintains, or transmits protected health information (PHI) for a covered entity or another business associate, the HIPAA Privacy, Security, and Breach Notification Rules apply to you — automatically, with no opt-in, no audit, and no certificate. Compliance is enforced by the HHS Office for Civil Rights through investigations and penalties. You don't get to decide whether to do HIPAA; you only decide whether to do it before or after something goes wrong.

SOC 2 is a voluntary attestation. No law requires it. A CPA firm examines your controls against the AICPA's Trust Services Criteria and issues a report. The pressure to get one comes from the market, not the government: enterprise buyers — including hospitals, payers, and digital health companies — ask for a SOC 2 report in nearly every vendor security review, because it's the proof artifact their procurement teams know how to read.

So the decision tree is short. Touch PHI? HIPAA is mandatory. Sell to enterprises (in healthcare or anywhere else)? You'll be asked for SOC 2. For most B2B health SaaS, that means both — and as we'll show below, doing them together costs much less than doing them in sequence.

Not sure where your gaps are? Two free tools give you a baseline in minutes: the HIPAA SaaS checklist and the SOC 2 readiness assessment.

Side by side

When you need HIPAA only

HIPAA alone is enough when the law applies but no buyer is demanding third-party assurance:

• You sell to small practices and clinics. A solo dentist's office wants a BAA and confidence you're not reckless; they don't have a procurement team that reads SOC 2 reports.
• You're pre-revenue and validating. Get legally compliant first — BAAs, risk analysis, core safeguards. Add SOC 2 when the first enterprise prospect asks (and budget for the fact that they will).
• You're a downstream subcontractor with a narrow PHI footprint. Your upstream business associate needs your BAA and your safeguards; their customer's SOC 2 demand stops at them.

Start with the HIPAA compliance guide and the legal cornerstone, the HIPAA glossary entry, if you're in this bucket.

When you need SOC 2 only

SOC 2 alone is the answer when you sell to enterprises but never touch PHI:

• General B2B SaaS — dev tools, fintech, HR, analytics — where buyers want assurance over customer data, but no health data is involved.
• Healthcare-adjacent products that genuinely avoid PHI — e.g., software sold to hospitals that only processes de-identified data, scheduling metadata without patient identifiers, or purely administrative content. Be careful here: "we don't think of it as health data" is not the test. If data identifies an individual and relates to their health, care, or payment for care, it's PHI, and you're back in the both-frameworks bucket.

The SOC 2 compliance guide covers that path end to end, and the SOC 2 glossary entry has the quick version.

When you need both (most B2B health SaaS)

If you sell software that handles PHI to hospitals, health systems, payers, pharma, or digital health companies, you need both — and you'll usually be asked for both in the same security review:

• The buyer's legal team requires a signed BAA and attestation of HIPAA compliance. That's the law talking.
• The buyer's security team requires a SOC 2 Type II report. That's procurement talking.

Neither substitutes for the other. A SOC 2 report without HIPAA compliance leaves the buyer legally exposed (and you in violation). HIPAA compliance without SOC 2 means every deal goes through a 300-question security questionnaire instead of a report review. The vendors that move fastest through health-tech procurement carry both.

One more reason "both" is the default: your own vendors. The moment you handle PHI, every subprocessor in your PHI path — hosting, email, analytics, support tooling — needs a BAA with you, and your customers' security teams will ask how you assess those vendors. A SOC 2 program already includes vendor risk management (CC9), so running the two frameworks together means you answer that question once instead of building two parallel vendor review processes.

The overlap: 60–70% of the work is shared

Here's the good news. The HIPAA Security Rule's administrative, physical, and technical safeguards (§164.308, §164.310, §164.312) and SOC 2's Trust Services Criteria describe largely the same control set:

In practice, teams that map their controls once find that roughly 60–70% of the work satisfies both frameworks simultaneously. The HIPAA-only remainder is mostly legal and procedural: BAAs with customers and vendors, breach notification procedures and timelines, the formal risk analysis document, and HIPAA-specific policies. The SOC 2-only remainder is mostly the audit machinery: control descriptions, evidence packaging, and the examination itself.

The efficient order: together, not sequentially

The common mistake is treating these as two projects a year apart: do HIPAA now, "do SOC 2 later when someone asks." That sequencing means you build the control set, let it drift, then rebuild and re-document it for the auditor — paying for the overlap twice.

The efficient pattern is one combined program:

1. Map once. Build a single control set mapped to both the HIPAA Security Rule safeguards and the Trust Services Criteria. This is exactly what a multi-framework GRC platform is for — our guide to managing multiple frameworks covers the mechanics.
2. Implement the shared 60–70% first. Access control, encryption, logging, incident response, vendor review, training. Every hour here pays out twice.
3. Layer the HIPAA-specific items. Risk analysis document, BAAs, breach notification procedures, HIPAA policies. You're legally compliant at this point — typically 2–4 months in.
4. Start the SOC 2 observation window immediately. The controls are already running; let the Type II clock run while you sell with HIPAA compliance and (optionally) a quick Type I report.
5. One audit, one report. When the window closes, the auditor examines controls that were designed for both frameworks from day one.

Run this way, most health SaaS companies go from nothing to HIPAA-compliant with a SOC 2 Type II in 9–12 months, for substantially less than the cost of two sequential programs.

What a SOC 2 with HIPAA mapping looks like to buyers

There's a specific artifact worth knowing about: a SOC 2 examination with HIPAA mapping (auditors variously call it SOC 2+, SOC 2 with additional subject matter, or a HIPAA-mapped SOC 2). The CPA firm performs the normal SOC 2 examination and additionally maps your controls to the HIPAA Security Rule safeguards within the same report.

To a buyer's security team, this is the best possible answer to "are you HIPAA compliant?" — because instead of your own attestation, they get an independent auditor's documentation of which controls address which §164.308–§164.312 requirements, with evidence that those controls operated over time. It typically adds modestly to the audit fee (far less than a second engagement) and turns two assurance questions into one document. If you're going to pay for a SOC 2 audit anyway and you handle PHI, ask every candidate audit firm about HIPAA mapping before you sign.

Related reading

• HIPAA checklist for SaaS — free interactive gap assessment for the HIPAA side
• SOC 2 readiness assessment — free readiness check for the SOC 2 side
• HIPAA compliance: the practical guide — the full HIPAA picture
• SOC 2 compliance: the practical guide — the full SOC 2 picture
• HIPAA compliance cost — real numbers for the HIPAA half of the budget
• Managing multiple frameworks — how to run one control set across both
• HIPAA explained and SOC 2 explained — glossary entries

Common questions

Is SOC 2 required for HIPAA compliance?

No. HIPAA doesn't require any third-party audit or certification, including SOC 2. They're independent: HIPAA is a federal law you must comply with if you handle PHI; SOC 2 is a voluntary attestation your customers may ask for. Doing one doesn't satisfy the other, though the underlying controls overlap substantially.

Does a SOC 2 report make me HIPAA compliant?

No. A SOC 2 report attests to your controls against the Trust Services Criteria, not against the HIPAA Privacy, Security, and Breach Notification Rules. SOC 2 doesn't cover BAAs, the required risk analysis under §164.308(a)(1)(ii)(A), breach notification procedures, or HIPAA-specific policies. It does cover much of the same technical ground, which is why doing both together is efficient.

Which should I do first, HIPAA or SOC 2?

HIPAA, if you currently handle PHI — it's a legal obligation, and operating without it is unlawful exposure, not a roadmap item. But the practical answer for most health SaaS is to run both as one program: build the shared controls once, layer the HIPAA-specific items (BAAs, breach procedures, risk analysis) and the SOC 2 audit on top.

Can one audit cover both HIPAA and SOC 2?

Effectively yes. Many CPA firms offer a SOC 2 examination with a HIPAA mapping (often called SOC 2+ or SOC 2 with additional subject matter), where the auditor maps your controls to the HIPAA Security Rule alongside the Trust Services Criteria. You get one fieldwork cycle and one report that answers both questions buyers ask.

Is HIPAA or SOC 2 more expensive?

SOC 2 usually costs more in cash because of the audit fee ($10K–$40K+ per year depending on Type I vs Type II and scope). HIPAA has no audit fee — its cost is implementation: typically $15K–$80K in the first year for a small SaaS. Done together, the combined program costs far less than the sum because 60–70% of the control work is shared.

Do healthcare customers ask for SOC 2 or HIPAA?

Both, usually in the same security review. The BAA and HIPAA compliance attestations are the legal requirement; the SOC 2 report is the proof artifact procurement teams know how to read. A vendor with a signed BAA but no SOC 2 gets a long questionnaire; a vendor with a SOC 2 that maps to HIPAA gets a short one.

What is a SOC 2 Type II with HIPAA mapping?

A SOC 2 Type II examination where the auditor also maps your controls to the HIPAA Security Rule safeguards, documenting the mapping in the report. Buyers see, in one document, that your controls operated effectively over a period AND how they correspond to the §164.308–§164.312 safeguards. It's the strongest single artifact a health SaaS can hand a prospect.

Is HIPAA a certification like SOC 2?

Neither is technically a certification. HIPAA has no certifying body at all — compliance is self-implemented and enforced by HHS OCR through investigations and penalties. SOC 2 produces an auditor's attestation report, not a certificate. Of the common health-tech frameworks, only HITRUST issues an actual certification.

Do I need SOC 2 if I only sell to small clinics?

Probably not yet. Small practices rarely run formal vendor security reviews — they need a BAA and basic assurances. SOC 2 becomes necessary when you move upmarket to hospitals, health systems, payers, or digital health companies with procurement processes. HIPAA compliance, by contrast, is required from the first byte of PHI regardless of customer size.

How long does it take to get both HIPAA and SOC 2?

Run together: roughly 2–4 months to implement the shared control set and HIPAA-specific items, then a SOC 2 Type I almost immediately, then a Type II after a 3–12 month observation window. Most health SaaS companies go from zero to HIPAA-compliant-with-SOC-2-Type-II inside 9–12 months. Sequentially, the same work takes closer to two years.

Last updated: June 11, 2026 · Reviewed by the LukaGRC compliance team