HIPAA vs SOC 2, HITRUST and ISO/IEC 27001: what each one proves, and when you need more than one

HIPAA vs SOC 2: a legal duty against an independent report

A hospital, health plan or health-tech platform sends a vendor questionnaire, a business associate agreement and a request for "your SOC 2" or "your HITRUST". Which of these makes the supplier HIPAA compliant? None of them on its own, because they sit on different levels.

HIPAA sets duties. Once you create, receive, maintain or transmit protected health information for a covered entity, the Privacy, Security and Breach Notification Rules apply to you directly, and nobody issues a pass. SOC 2, HITRUST and ISO/IEC 27001 are assurance routes: an outside party tests your controls against a defined set of criteria and puts its conclusion in writing.

So the real choice is not HIPAA or SOC 2, but HIPAA plus which proof.

HIPAA, SOC 2, HITRUST and ISO/IEC 27001 side by side

Why a report or a certificate does not make you HIPAA compliant

HHS has stated that it does not recognise private certifications of Security Rule compliance and that holding one does not stop it finding a violation, which applies to a HITRUST certification as much as to a seal bought online. The Privacy Rule makes the gap wider: permitted uses and disclosures, the minimum necessary standard, individual rights of access and amendment, and six-year retention are legal duties that no security framework was written to test.

Three things stay with you whatever proof you hold. The risk analysis must cover every system that holds electronic PHI; The Security Rule risk analysis: how to conduct one explains the method. Business associate agreements must be signed with each covered entity you serve and issued to every subcontractor that touches PHI; Business associate agreements: what to sign and what to issue covers both directions. And the breach procedure must run the four-factor assessment and meet the sixty-day limit from discovery.

The proofs still matter to OCR. The law requires it to consider whether recognised security practices were in place over the previous twelve months, and an independently tested control set is an easy way to show that.

Where the Security Rule and the three proofs overlap

Most of the work is shared; the test differs. HIPAA examines whether a safeguard is reasonable and appropriate for your risks, SOC 2 samples whether it operated through the period, and ISO/IEC 27001 examines whether it answers an assessed risk.

HITRUST has no column because its requirement set varies with the assessment and scope; the CSF lists HIPAA among its sources, and its Insights Reports translate results into HIPAA terms. One caution: scopes must match, because a SOC 2 system that leaves out the platform holding PHI proves nothing about it.

Which proof, for which customer

Choose SOC 2 when US enterprise clients, health-tech platforms or payers send security questionnaires that end in a request for a report, and when you host, process or support their systems. SOC 2 Type 1 vs Type 2: which report, and when helps with the first report.

Choose HITRUST when a hospital system or payer names it in its vendor requirements, or when you want one assessment many healthcare customers can rely on. Work done for an e1 or i1 counts towards a larger assessment later.

Choose ISO/IEC 27001 when your customers include international buyers, tenders or regulators outside the United States, or when you want one security system across the whole business.

Stay with HIPAA alone, documented properly, when your customers accept due diligence and their own vendor audit, and nobody has asked for independent proof.

Combining them, and in what order

Health BPOs, billing companies and SaaS providers often end up with two proofs. The order that wastes least is to build the HIPAA programme first, with the risk analysis and PHI data-flow map at its centre, then run the chosen examination or assessment on the same controls. Where an ISMS already exists, it becomes the frame, and the Privacy Rule, agreements and breach procedures are added around it. ISO/IEC 27001 vs SOC 2: which one, or both? covers that pairing in depth.

HIPAA vs SOC 2, HITRUST and ISO/IEC 27001: questions buyers ask