What is SOC 2

What SOC 2 actually is.

SOC 2 (System and Organization Controls 2) is an attestation — an independent auditor's report confirming that a service organization's controls meet criteria specified by AICPA (American Institute of Certified Public Accountants). The auditor examines controls, tests operation, and produces a report that the service organization can share with customers.

Key characteristics:

• Voluntary — no government requires SOC 2; it's a private-sector framework driven by customer demands.
• Service organization-focused — SOC 2 is designed for companies providing services to other organizations (SaaS vendors, MSPs, data processors), not for end-user organizations.
• Independent auditor-based — CPA firm performs the audit; the service organization engages them and pays for the audit.
• Trust Services Criteria-aligned — controls are evaluated against five defined categories (Security, Availability, Processing Integrity, Confidentiality, Privacy).

Five categories of criteria.

Security (Common Criteria): required baseline. Protection of information and systems against unauthorized access, disclosure, and damage. Every SOC 2 includes Security.

Availability: system availability for operation and use as committed. Relevant for vendors where uptime commitments matter.

Processing Integrity: system processing is complete, accurate, valid, timely, and authorized. Relevant for vendors processing financial or clinical data where integrity is critical.

Confidentiality: information designated as confidential is protected. Relevant for vendors handling sensitive customer data.

Privacy: personal information is collected, used, retained, disclosed, and disposed according to commitments and privacy criteria. Distinct from HIPAA privacy — less commonly added unless specifically relevant to the service.

Two audit types.

Type I — point-in-time attestation. Auditor examines control design as of a specific date and attests that controls are suitably designed. Easier and faster to complete; less rigorous evidence collection.

Type II — operational attestation over a period (typically 6-12 months). Auditor examines control design AND control operation over the period, testing that controls operated effectively throughout. More rigorous; substantially more evidence collection.

Type II is the standard for enterprise customers. Type I may be acceptable for initial attestation or smaller customer requirements, but healthcare enterprise customers typically require Type II. Organizations achieving first-time SOC 2 often do Type I first, then move to Type II for subsequent years.

How SOC 2 fits for healthcare vendors.

Healthcare IT vendors typically need both HIPAA compliance (regulatory obligation) AND SOC 2 attestation (customer expectation). They're complementary — HIPAA is regulatory framework; SOC 2 is third-party verification of controls. See our HIPAA vs SOC 2 comparison page for the distinction.

Practical scope for healthcare IT vendors: Security + Availability + Confidentiality is the common bundle. Security is required baseline; Availability is typically required by healthcare customers who need uptime commitments; Confidentiality maps naturally to PHI handling. Privacy criteria often skipped as it's less aligned with HIPAA-governed PHI handling.

Medical practices themselves don't need SOC 2 — that's a vendor-side framework. Practices evaluating vendors should check for SOC 2 as part of vendor due diligence alongside BAA and HIPAA compliance. See our vendor management page.