hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us

United States · Guide

HIPAA vs SOC 2: What US Health-Tech Start-ups Need

For a US health-tech start-up, HIPAA's Security Rule is a legal duty if you handle patient data as a business associate; SOC 2 is a voluntary report issued by a US-licensed CPA firm, as AICPA standards require. Neither replaces the other. Start the HIPAA risk analysis first, then add SOC 2 when buyers require a report.

Book a free gap assessmentRead the detail

Did you know SOC 2 or ISO 27001 can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.

100% success, on time: the Sterling Promise

100%The Sterling Promise: success and on-time completion

We stay with you until your agreed outcome is achieved, through consulting, audit preparation and the resolution of audit findings. The engagement defines the standard, scope, outcome and responsibilities; your organization puts the agreed controls into use; an independent assessor reviews your HIPAA program; a US-licensed CPA firm issues the SOC 2 report, and that decision stays independent.

What the guarantee covers →

  • Done for you, end to end

    We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

  • Simple and quick

    A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

  • 8,100+ client engagements

    In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

  • Under US$10,000, all-inclusive

    For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

How Sterling delivers both for US health-tech, done for you

Quick, done for you, with a 100% success and on-time completion record. We start with a free gap assessment against both, so you see what one control set covers and what is specific to each. We write policies and controls for your stack, set up evidence collection, run the internal audit and evaluation, and coordinate the independent examination and the HIPAA assessment. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require; for HIPAA we provide compliance consulting and an independent HIPAA assessment. The people who consult never examine or assess you. Behind it: 8,100+ client engagements in 60+ countries over 20+ years, and experts with 30+ years of experience.

Included in every engagement

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

  • Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
  • Sterling Academy: preferential course access, with complimentary awareness training for your people.
  • Internal auditor training for your audit team, as applicable to your standard.
  • For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

All-inclusive pricing for start-ups and SMEs

Did you know SOC 2 or ISO 27001 can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.

Under US$10,000all-inclusive, for most start-ups and SMEs

Sterling's all-inclusive fee for SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001 is under US$10,000 for most start-ups and SMEs. It covers our done-for-you consulting and the independent audit: the SOC 2 report from a US-licensed CPA firm, as AICPA standards require, or the certification audit by an accredited certification body. For HIPAA, it covers HIPAA compliance consulting and an independent HIPAA assessment. Effivity, training and a vulnerability assessment are included. That's less than a month's cost of an in-house security hire: the US Bureau of Labor Statistics puts the national median annual wage for information security analysts at $129,180 (May 2025), about $10,765 a month in pay alone[1].

A fixed quote follows a free gap assessment.

What the fee covers, and what it doesn't:

  • It is the fee for your first SOC 2 report or your first certification only.
  • Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
  • It assumes a typical start-up or SME scope: one product or service and one main location.
  • Larger or multi-site scopes get a fixed quote after the gap assessment.
  • PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

Why US hospitals and health plans ask for both

The outcome. You give each US reviewer the evidence it actually wants, and a health-system deal keeps moving instead of stalling in security review.

In the same week, a US hospital's security team requests a SOC 2 report and its lawyers send a business associate agreement citing HIPAA. Many founders assume one covers the other. It does not.

  • HIPAA is a legal duty. Subpart C of 45 CFR Part 164 says a covered entity or business associate must comply with its standards for electronic protected health information[4]. You carry it whether anyone asks or not.
  • SOC 2 is evidence you obtain. The AICPA describes it as an examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy[2]. You obtain it because a buyer requires it.

HIPAA vs SOC 2 side by side, as a US reviewer sees them

The points a US health customer's reviewer weighs, row by row.

QuestionHIPAA Security RuleSOC 2
What it isFederal regulation, 45 CFR Part 164 Subpart C[4]A report on controls under AICPA standards[1][2]
Is it voluntaryNo, if you are a covered entity or business associate[4][5]Yes; customers or contracts may require it
What it protectsElectronic protected health information[4][5]The system and controls you describe, tested against the Trust Services Criteria you select[2][3]
Who evaluates itNo outside examiner is named in the rule text[4]; Sterling offers an independent HIPAA assessmentA US-licensed CPA firm issues the report, as AICPA standards require
What you can hand a customerA completed assessment, your policies and signed business associate agreementsThe SOC 2 report itself, under confidentiality
PrescriptivenessNamed standards, some required, some addressable[4]You choose categories and describe your own controls, within the criteria[2][3]
Time dimensionContinuous obligation, documentation kept for 6 years[4]Type 1 at a date; Type 2 over a period

What the Security Rule requires that a SOC 2 scope may not cover

The outcome. No patient-data duty slips through because a SOC 2 project was assumed to cover it.

  • Patient data at the center. The rule is built around electronic protected health information, tied by definition to protected health information[5]. SOC 2 categories speak of your system and the information you commit to protect, with no patient-data concept.
  • Named elements. The security management process includes risk analysis, risk management, a sanction policy and system activity review, all marked required[4]. The rule also requires a designated security official and workforce training[4].
  • Contract duties. Business associate contracts must require the business associate to report security incidents, including breaches of unsecured protected health information[4].
  • Documentation. Policies and procedures must be written, retained for 6 years and reviewed periodically[4].
  • Physical safeguards. Device and media controls and disposal are in the rule[4]; a SOC 2 scope can include them but need not.

What a SOC 2 report gives US procurement teams that HIPAA does not

The outcome. A document US vendor-risk teams recognize, so reviewers clear many questions at once.

An independent CPA firm examines the description of your system and your controls and reports on them[2]. The Trust Services Criteria cover five categories, security, availability, processing integrity, confidentiality and privacy[3], and you choose which are in scope. A reviewer reads the opinion and any noted exceptions instead of trusting a questionnaire.

The rule text describes no report from an outside examiner[4]. That gap is why large US health customers, even knowing a vendor is bound by HIPAA, often ask for a SOC 2 report too.

The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require. Sterling coordinates the whole engagement, so you deal with us end to end; the people who consult with you never take part in the examination.

One control set for US health and enterprise buyers

The outcome. Most of the work is done once and counted twice. The mapping below is Sterling's working view, not an official crosswalk; check the criteria and the rule text for your own program.

Control areaHIPAA Security Rule sectionSOC 2 relevance (security category)
Risk assessment164.308(a)(1), required[4]Risk assessment is part of what the examiner expects to see described and operating
Access control164.308(a)(3)-(4), 164.312(a)[4]Logical access is central to the security category
Training164.308(a)(5)[4]Security awareness evidence is commonly tested
Incident response164.308(a)(6)[4]Incident handling is commonly in scope
Backup and recovery164.308(a)(7)[4]In scope under availability if you select it
Vendor management164.308(b), 164.314(a)[4]Vendor oversight is commonly tested
Patient-data specificsBusiness associate agreements, 6-year retention[4]No direct equivalent; added on top

Which to do first for your next US customer

Four situations cover most US start-ups:

  • A hospital or health plan is about to sign a business associate agreement. Do the HIPAA work first: the obligation is already yours, and an agreement with no program behind it is a risk.
  • A health-system security team requests a SOC 2 report. Start the SOC 2 path without postponing the HIPAA basics; share your risk analysis and policies while the examination period runs.
  • You sell to healthcare and general US enterprise. Plan both on one control set. SOC 2 for Series A explains the SOC 2 timing logic.
  • You handle no patient data, such as a consumer wellness app. HIPAA may not apply and SOC 2 may be all a buyer requires; get a legal read first.

In every case, answer questionnaires accurately. See answering security questionnaires.

What we recommend for most US start-ups (Sterling's recommendation)

This is Sterling's recommendation, not a requirement of HHS or the AICPA, and not legal advice. 1. Confirm your HIPAA status with counsel, then start the risk analysis at once. 2. Build one control set and tag each control to the rule and to the SOC 2 criteria. 3. Scope SOC 2 to security first; add categories only when a contract calls for them. 4. Complete an independent HIPAA assessment when your first large health customer requests evidence. 5. Describe each accurately: HIPAA is a duty you meet, SOC 2 a report you obtain. For HIPAA, say "assessed against the Security Rule", with date and scope. 6. Read the HIPAA hub and the SOC 2 hub.

Ready to clear your next health-system review? Get a proposal built around your product and your buyers.

How Sterling delivers SOC 2

A SOC 2 engagement has one deliverable that no consultant can hand you: the report. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require[1]. What Sterling does is make sure you get there ready, and that nothing between today and the report lands on your desk.

With Sterling, you deal with one team from start to finish. We coordinate:

  • a readiness review and a gap assessment against the Trust Services Criteria;
  • the policies, procedures and controls you need, written for how your company actually works;
  • evidence collection, so the examination does not become a scramble;
  • an internal audit before the examiner arrives, carried out by people who did not advise you on the controls;
  • the Type 1 or Type 2 path that fits your deal timeline, and the examination itself, including scheduling, requests and follow-ups.

Our experts bring 30+ years of experience, and the firm has completed 8,100+ client engagements in 60+ countries over 20+ years. You get a single plan, a single point of contact and a clear view of what happens next.

[1] SOC (System and Organization Controls) Suite of Services. AICPA & CIMA. accessed October 23, 2026.

Information only

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.

FAQs

Frequently asked questions

Does SOC 2 make us HIPAA compliant?

No. They answer different questions. A SOC 2 report is an independent examination of the controls you chose to describe. The Security Rule is a legal requirement with its own named standards, including documentation, training and business associate contract duties. A SOC 2 report can support parts of the HIPAA story, but it does not replace the rule.

Does HIPAA compliance replace a SOC 2 report?

Not in the eyes of most procurement teams. The rule text does not describe an outside report, so health customers often ask for a SOC 2 report to get independent evidence. An independent HIPAA assessment from Sterling is useful in the same conversation, but a buyer who has asked for a SOC 2 report will still want one.

Which should a seed-stage health-tech company do first?

If you already handle patient data for a covered entity, the HIPAA work, starting with the risk analysis, comes first because the obligation is already yours. Add SOC 2 when sales conversations require a report. A gap assessment will show how much one control set can cover.

Can we use one set of policies for both?

Largely yes. Access, risk, training, incident, backup and vendor policies serve both. Keep a mapping so each policy shows which HIPAA sections and which SOC 2 criteria it supports, and add the patient-data specifics, such as business associate agreements and retention, as extra sections.

Who signs the SOC 2 report and who assesses HIPAA?

A US-licensed CPA firm issues the SOC 2 report, as AICPA standards require. For HIPAA, Sterling provides compliance consulting and an independent HIPAA assessment, carried out by people who took no part in the consulting. In both cases you deal with Sterling throughout.

How long does it take to have both in place?

It depends on your starting point. In Sterling's planning view, the HIPAA risk analysis, policies and core safeguards come first and can be in place within a few months for a single product. A SOC 2 Type 1 can follow once controls are designed; a Type 2 needs its observation period to elapse, so effort alone cannot shorten it. The free gap assessment gives you dated milestones for both, which you can share with a US buyer.

What does it cost to do both?

It depends on scope, architecture and what you already have. Sterling's all-inclusive fee for most start-ups and SMEs is described in the pricing note above, and a fixed quote follows a free gap assessment.

Keep exploring

More in Compliance guides for US companies

Compliance guides for US companies

Free gap assessment

Start with a free gap assessment

Not sure where you stand? Start with a free gap assessment. In one conversation, a Sterling consultant looks at what your customers, investors or contracts are asking for, compares it with what you have in place today, and tells you what is missing, in what order to fix it and how long it is likely to take.

usa@sterling-grc.com

+1 201 263 4443 (global headquarters) · A Sterling consultant replies within one working day

What would you like to achieve?

Choose a starting point. The enquiry form asks for your name, work email, phone with country code and company.

Your goal
Book my free gap assessment

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice