ISO/IEC 27001, SOC 2 and HIPAA together: what US healthcare clients ask a provider to show: video

The three documents healthcare buyers ask for

Health technology companies and healthcare service providers are commonly asked for three things: a SOC 2 report, evidence of HIPAA compliance and, for international clients, ISO/IEC 27001. They come from three different places. A licensed US CPA firm issues the SOC 2 report under the AICPA attestation standards, and it is a report, not a certificate. HIPAA is a US law with no government certification; compliance is shown through a documented risk analysis, safeguards, policies, training and agreements. ISO/IEC 27001 is certified by an accredited body.

This short film walks through how one programme prepares a provider for all three without running three projects.

These are the documents US healthcare buyers commonly ask a provider for during procurement.

Security is always in scope for SOC 2, and availability, confidentiality, processing integrity or privacy are added where clients rely on them; HHS does not recognise any private certification of HIPAA Security Rule compliance.

One risk process, one control set, two independent opinions

A single documented risk process serves all three frameworks: the HIPAA risk analysis, the ISO/IEC 27001 risk assessment and the risk assessment the SOC 2 criteria expect. One control set then meets ISO/IEC 27001 Annex A, the Trust Services Criteria and the HIPAA safeguards together, with HIPAA-specific items such as business associate agreements and breach procedures added where they apply.

The same evidence serves the certification body and the CPA firm, and supports the HIPAA documentation US healthcare buyers ask for in procurement. Because a SOC 2 Type 2 report covers controls operating over a period, the controls need to be running early, and the report period, the certificate's audits and the HIPAA risk reviews can then be planned together.

Sterling prepares the controls, evidence and SOC 2 system description and supports the provider through each review, with one consultant and one Effivity workspace under an all-inclusive proposal. The CPA firm and the certification body make their own decisions, and HIPAA has no certificate to issue.