SOC 2 Type II is an independent audit report that evaluates the quality of a service organization’s security controls and their actual performance over a period of time, usually several months to a year. Licensed CPAs will perform an audit weighed against the AICPA’s Trust Services Criteria. SOC 2 Type II is not a certification, but a report on security controls that will usually be requested by buyers under a confidentiality agreement.
Also called: SOC 2 Type 2, SOC 2 report, SOC 2 attestation
What does a SOC 2 audit cover?
A SOC 2 audit evaluates controls to the standards of AICPA’s Trust Services Criteria, and security is always included in the audit. Other criteria, like availability, processing integrity, confidentiality, and privacy, are optional. Organizations can choose which of these to add to the audit, based on the particular services they provide and what they offer to their customers. Every report will specifically state which criteria it covers.
Type I vs. Type II
Type I checks whether security controls are designed properly at a single point in time. Type II shows whether these controls have operated effectively over a specifically defined time period, giving stronger evidence of the security controls to buyers.
SOC 2 vs. HITRUST vs. ISO 27001
- SOC 2: An audit report issued by a CPA firm, checking a service organization’s security controls.
- HITRUST: A certification framework for healthcare organizations to certify that an organization follows protocols that align with HIPAA compliance.
- ISO 27001: An international certification of an organization’s security management system.
Note that a SOC 2 report can be mapped to check similar criteria as a HITRUST certification, but receiving a SOC 2 audit report does not mean that an organization is HITRUST certified.
Choosing a HIPAA compliant patient access solution
Why does it matter when outsourcing patient access?
Type II reports show whether a partner’s controls, such as their access management, monitoring, and incident response, hold up in the daily operation of the business, not just if they should theoretically hold up on paper.
What should buyers look for in a report?
- Audit period: How long is the testing window? A longer audit period usually provides more evidence. Dates should have no gaps from the prior report.
- Criteria and systems in scope: What criteria are covered and which systems, locations, and services are included? These should match the actual work you hope to outsource.
- Exceptions: What exceptions, if any, did the auditor note? What were management’s responses and remediations? Having exceptions isn’t an immediate disqualification for a vendor, but it’s important to understand what exceptions were and how they were addressed.
- Currency: How recent was the report? If the audit period ended several months ago, try asking if they have a bridge letter or if they can inform you of their next audit’s timing.
FAQs
Is SOC 2 required for healthcare vendors?
No. SOC 2 is not required by law, but many buyers ask for it since it offers independent assessment and assurance of the vendor’s security controls.
How often is a SOC 2 Type II report renewed?
Typically, it is renewed annually. Vendors tend to undergo new audits each year to keep their reports current, and most buyers will expect reports to have an audit period ending within the last 12 months.
Does SOC 2 cover HIPAA requirements?
SOC 2 doesn’t cover HIPAA requirements directly, since SOC 2 isn’t a HIPAA assessment, and HIPAA doesn’t have an official certification. There is some overlap between the requirements of HIPAA’s Security Rule safeguards and the controls tested in SOC 2 audits, but a SOC 2 report is not inherent proof of HIPAA compliance.
