Two frameworks, one job
HIPAA's Security Rule and SOC 2's Trust Services Criteria were written by different people for different reasons, and they still describe the same organization. Both want to know who can get at sensitive data, how you'd notice a problem, what you'd do about it, and whether you can prove any of that. The vocabulary differs. The controls largely don't.
| Aspect | HIPAA | SOC 2 |
|---|---|---|
| What it is | Federal law and regulations | An attestation report under AICPA standards |
| Who checks | HHS Office for Civil Rights, when it investigates | A licensed CPA firm you hire |
| Who it applies to | Covered entities and business associates | Anyone a customer asks |
| Structure | 18 standards, 36 specifications, plus Privacy and Breach rules | 5 categories; Security's 33 common criteria are mandatory |
| Output | Your own documentation; no certificate exists | A report with the auditor's opinion |
| Time dimension | Continuous obligation | Type 1 at a date, Type 2 over a period |
The crosswalk
This is a working map, not an official one. HHS publishes a crosswalk to NIST's framework, and auditors and platforms maintain their own HIPAA-to-SOC 2 mappings; this is the shape they all take. Click a safeguard to see the SOC 2 criteria it feeds and the evidence that serves both.
From a HIPAA safeguard to SOC 2
Risk analysis and management, 164.308(a)(1) maps to SOC 2 CC3.1 to CC3.4, CC4.1, CC9.1. Evidence that serves both: One written risk analysis with a risk register and treatment plan.
A control you can prove once is a control you can prove twice. Most of the extra work is labeling.Your engineer
Where HIPAA goes further than SOC 2
- The Privacy Rule. Patient rights, minimum necessary, notices of privacy practices. SOC 2's Privacy category is optional and different.
- Breach notification. Fixed deadlines and a regulator to notify. SOC 2 has incident response criteria but no 60-day clock.
- Business associate agreements. Specific required contract terms. SOC 2 wants vendor risk management, not a particular contract.
- The enterprise-wide risk analysis in the form OCR expects. SOC 2's risk assessment criteria are satisfied by a broader range of approaches.
Where SOC 2 goes further than HIPAA
- Change management. Code review, approvals and deployment controls. HIPAA barely mentions software change.
- Governance. Board oversight, organizational structure, hiring practices. HIPAA names a security official and stops.
- Operating effectiveness over time. A Type 2 audit samples a period; HIPAA has no audit at all unless OCR opens one.
- Availability, confidentiality and processing integrity as explicit categories, if you include them.
How to run both at once
- Build the HIPAA program first. It's the legal floor, and the risk analysis you need for it gives you the risk assessment SOC 2 wants.
- Write each policy once, tagged to both. An access control policy cites 164.308(a)(4), 164.312(a) and CC6.1 through CC6.3 in the same document.
- Collect evidence to the control, not the framework. One MFA export serves both. One quarterly access review serves both.
- Add the SOC 2-only controls when a deal needs the report: change management, governance, and the observation period.
- Ask the auditor for SOC 2 plus HIPAA. One report, both labels, and usually what hospital procurement accepts short of HITRUST.
With AccuSights: controls are cross-mapped natively. Answer the assessment once, and the platform shows HIPAA readiness and SOC 2 readiness from the same evidence. When the hospital asks for the report, the auditor logs into the same portal. See our SOC 2 guide for the audit side.