SOC 2 by industry
SOC 2 for healthcare IT and health BPO: what health-system vendor reviews expect beside HIPAA
What changes when the service organisation handles PHI: why health systems and plans ask, what belongs in scope for health-tech SaaS, billing, coding and claims teams, where examiners sample, and how the report sits beside HIPAA, business associate agreements and HITRUST.
Key points
- For health-tech SaaS, medical billing and coding, revenue-cycle and claims processing firms, the SOC 2 report is usually requested alongside a business associate agreement, not instead of one.
- The system in scope is wherever protected health information (PHI) is created, received, stored or transmitted for a client: your platform, your delivery floors and the client systems your staff log into.
- Confidentiality is the category health clients ask about first; Processing integrity matters when you submit claims or post payments for them; Privacy needs a deliberate decision.
- A SOC 2 report does not by itself demonstrate HIPAA compliance. It is evidence of controls; the HIPAA programme, risk analysis and agreements still have to exist.
Why healthcare buyers ask for a SOC 2 report
The request usually comes from a US hospital, health system, physician group or health plan working through its vendor risk review before it lets an outside party near patient data. The reviewer wants a signed business associate agreement, answers to a security questionnaire and independent evidence that the controls behind those answers operated. A SOC 2 Type 2 report is the evidence most vendor risk teams already know how to read.
The pressure behind it is regulatory. A billing, coding, claims or software firm that creates, receives, maintains or transmits PHI for a US health plan, provider or clearinghouse is a business associate under HIPAA, directly liable since the 2013 Omnibus Rule. A report from a licensed CPA firm helps the client document its diligence. Sterling does not issue the report; the CPA firm examines and opines. The route itself is explained on the SOC 2 hub.
What sits inside the scope for healthcare IT and health BPO
Follow the PHI. For a health-tech SaaS, the system description covers the application, its APIs and integrations with electronic health record and practice-management systems, the production cloud accounts and the support tools that can see patient data. For a billing, coding or revenue-cycle BPO, it covers delivery floors or work-from-home set-ups, virtual desktops, workflow tools and your controls over access to clients' own systems.
Three scope mistakes recur: describing only your platform when most PHI work happens inside client systems; leaving out a second site or offshore team on the same accounts; and ignoring a clearinghouse, cloud host or subcontracted coding partner that belongs in the description as a subservice organisation or overseen vendor. See SOC 2 scope: system boundaries, trust services categories and carve-outs and SOC 2 vendor management and subservice organisations.
Where the criteria bite for healthcare IT and health BPO
| Criteria area | What it means in a healthcare service organisation | Evidence the examiner samples |
|---|---|---|
| CC6 Logical and physical access | Who can reach PHI in your platform and in each client's EHR, billing portal or payer system, and how that access is granted and removed | Access approvals per client account, leaver removal from client systems, access reviews, multi-factor authentication, clean-desk rules |
| C Confidentiality | PHI identified, protected, retained and returned or destroyed as each client contract and agreement requires | Data classification, retention mapped to contracts, return or destruction records at contract end |
| CC7 System operations | Detecting security incidents quickly enough to meet the notification duties you owe covered-entity clients | Incident register with discovery dates, client notification within the agreed timeframe, post-incident reviews |
| PI Processing integrity, if in scope | Claims, codes, charges and payment postings processed completely, accurately and on time | Batch reconciliations, rejection and denial handling records, coding quality review samples, error logs with corrections |
| CC9 Vendor risk and CC1 workforce | Subcontractors that touch PHI, and the people who handle it every day | Vendor risk assessments, subcontractor agreements, subservice SOC report reviews, background checks, training records |
The full criteria set is in SOC 2 Trust Services Criteria explained, criterion by criterion.
Working alongside HIPAA, business associate agreements and HITRUST
HIPAA and SOC 2 answer different questions. HIPAA examines whether you meet the Privacy, Security and Breach Notification Rules as a business associate: a risk analysis, safeguards, policies, training and agreements in both directions. SOC 2 asks whether a CPA firm can express an opinion on the controls you describe. HHS recognises no HIPAA certification, so a report supports the HIPAA case without closing it. One control set, one risk register and one evidence calendar can serve both; see HIPAA vs SOC 2, HITRUST and ISO/IEC 27001 and Business associate agreements: what to sign and what to issue.
Some health systems and payers ask for HITRUST instead of, or beside, SOC 2. HITRUST issues its certification after an authorised External Assessor tests the controls, and its framework maps HIPAA among many sources. Policies, access controls and evidence built for SOC 2 carry over; the assessor and requirement statements differ. See HITRUST vs SOC 2 and ISO/IEC 27001.
What a healthcare engagement looks like
Duration depends on how many client systems your people work in, how many delivery sites and teams handle PHI, whether a HIPAA risk analysis already exists and when the health-system customer needs the report. The operations head, the compliance or privacy officer, IT, HR and whoever owns client contracts must be involved. With Design™, Sterling guides your team to own the controls; with Drive™, Sterling carries more of the documentation, evidence and readiness testing so delivery keeps its turnaround.
How Sterling works with healthcare IT and health BPO firms
One control set for the report, the agreement and the vendor review.
Our expert and experienced consultants map the criteria to your PHI flows and client system access, align them with your HIPAA programme, test controls before the period starts, and keep the evidence in Effivity, included with the engagement at no additional cost. Sterling does not issue the report; an independent, licensed CPA firm examines and opines. We ensure a successful SOC 2 examination for our clients.
Book a free discovery callSOC 2 for healthcare IT and health BPO: questions buyers ask
A hospital asked for our SOC 2 report and a signed BAA. Is the report enough on its own?
No. The business associate agreement is needed regardless, and the report does not replace your HIPAA risk analysis, policies or breach procedures. It is independent evidence that your controls operated.
Should the Privacy category be in a SOC 2 report for a medical billing company?
Not automatically. Confidentiality usually comes first because it covers PHI you hold for clients. Add Privacy when you collect personal information under your own notice, such as a patient-facing portal, and agree the choice with the CPA firm.
Our coders work in the hospital's own EHR. Does that belong in our SOC 2 scope?
Yes, your side of it does. The hospital's system is not yours to describe, but how you request, approve, review and remove your staff's access to it, and how they handle PHI there, are your controls.
A health-system customer wants HITRUST, not SOC 2. Is our SOC 2 work wasted?
No. Most policies, access controls and evidence carry over. HITRUST adds its own requirement statements, an authorised External Assessor and HITRUST's quality assurance, so plan a gap analysis against the assessment your customer names.
SOC 2 by industry
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 for accounting and professional services
- SOC 2 for BPO and shared services
- SOC 2 for fintech and payments
- SOC 2 gap analysis
- SOC 2 governance
- SOC 2 for healthcare IT and health BPO
- SOC 2 for HR, payroll and staffing
- SOC 2 implementation plan
- SOC 2 in India
- SOC 2 for managed service providers and data centres
- SOC 2 for SaaS and technology
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Plan a SOC 2 programme that fits your PHI flows and client systems.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice