According to the American Institute of Certified Public Accountants (AICPA), SOC 2 (Service Organization Control) aims to provide service management, user entities, business partners, and other parties with information about controls at the service organization relevant to security, availability, processing integrity, confidentiality, or privacy to support users’ evaluations of their own systems of internal control.

Where does SOC 2 fit in?

There is a significant overlap between SOC 2 and HITRUST e1 — as much as 90%. You can save your organization time and money by doing your SOC 2 and HITRUST e1 with a single audit. If you work with health plans or hospital systems (or plan to in the future), the HITRUST e1 is a valuable stepping stone toward achieving your HITRUST r2.

The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a US law that outlines how protected healthcare information (PHI) can be stored, used, and disseminated, providing civil and criminal penalties for violations. 

Where does HIPAA fit in?

HIPAA is different from the other frameworks in that it's not a framework at all. Rather, it's a set of rules required by law if you're handling a certain type of information, called PHI, in a certain way. Following HIPAA rules is not voluntary. Obtaining a SOC 2 report is often done in tandem, as that is what will be required to close deals, especially larger enterprise ones. There is enough overlap between SOC 2 Trust Services Criteria (TSC) and HIPAA that it's worth considering completing both at the same time as the most efficient use of your company's resources.

The HITRUST Common Security Framework (CSF) is a globally utilized and recognized framework with dozens of authoritative sources covering multiple industries. The CSF unifies and harmonizes many authoritative sources, pre-existing security regulations, and frameworks—such as NIST, HIPAA, ISO 27001, FedRAMP, PCI DSS, GDPR, and dozens of others.  There are three levels of certifications with varying levels of assurance: e1, i1 and r2.

How does HITRUST fit in?

HITRUST is one of the newer frameworks to emerge and is quickly becoming the 'gold standard' in regulated compliance—and not just in HealthTech. HITRUST has greatly reduced the barrier to entry with the new e1 assessment, having only 44 controls in both Year 1 and Year 2. With significant overlap with SOC 2 (up to 90%!), achieving HITRUST e1 and SOC 2 simultaneously with one audit is a no-brainer

You get the highest level of assurance by achieving your HITRUST r2 certification. The HITRUST CSF framework covers more than 40 authoritative sources – so one r2 certification report may cover multiple needs.