SOC 2 vs HIPAA comes down to law versus proof. HIPAA is a federal law that sets rules for protecting patient health information. SOC 2 is an independent audit showing whether a vendor’s security controls work. Clinics evaluating an AI voice agent should require both: a signed BAA under HIPAA and a current SOC 2 Type II report.
Key takeaways
- HIPAA is legally required for covered entities and their business associates. SOC 2 is voluntary, but it is the most common way vendors prove their security practices.
- A SOC 2 report does not make a vendor HIPAA compliant, and HIPAA compliance does not prove controls were tested. They answer different questions.
- For AI voice agents that handle patient calls, ask for a signed Business Associate Agreement (BAA) and a SOC 2 Type II report before any patient data flows.
- “SOC 2 ready” or “in progress” is not the same as a completed report.
- Simbie AI is SOC 2 Type II certified, HIPAA-compliant and signs BAAs with customers.
Why this matters when you buy an AI voice agent
A voice agent sits in the middle of your patient conversations. When it answers calls, verifies identity, books appointments or takes refill requests, it handles protected health information (PHI): names, dates of birth, medication names and the reason for the call. It may also store recordings or transcripts and write details into your EMR.
That makes the vendor part of how your practice protects patient data. A polished demo shows how the agent sounds. It does not show how recordings are secured, who can access transcripts, or what happens during a security incident. HIPAA and SOC 2 are the two frameworks that answer those questions, and they answer them in different ways.
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects patient health information. The U.S. Department of Health and Human Services (HHS), through its Office for Civil Rights, enforces it.
Two parts matter most when you evaluate a vendor:
- The Privacy Rule sets limits on how protected health information can be used and disclosed.
- The HIPAA Security Rule requires administrative, physical and technical safeguards for electronic PHI, such as access controls, audit controls and transmission security, along with regular risk assessments.
HIPAA applies to covered entities, such as healthcare providers and health plans, and to their business associates: vendors that create, receive, store or transmit PHI on their behalf. An AI voice agent that handles patient calls is a business associate.
Why the BAA matters
According to HHS guidance on business associates, HIPAA generally requires covered entities to have a written contract, the Business Associate Agreement (BAA), with business associates that handle PHI. The BAA describes how PHI may be used, requires appropriate safeguards and sets obligations such as breach notification. Business associates are directly liable under HIPAA, and violations can bring civil and criminal penalties.
The same requirements apply to a vendor’s own subcontractors. If a voice agent relies on telephony or AI model providers that touch PHI, those relationships need business associate agreements too.
There is no official HIPAA certification. A vendor that says it is “HIPAA certified” means it follows HIPAA requirements, which you should verify through its BAA, policies and security evidence.
What is SOC 2?
SOC 2 stands for System and Organization Controls 2. It is an attestation framework from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm examines a service organization’s controls and issues a SOC 2 report. The report is often called a “certification,” but strictly it is an auditor’s opinion on the vendor’s controls.
The five trust services criteria
SOC 2 reports are built on the AICPA’s five trust services criteria:
- Security: Protecting systems and data from unauthorized access. This is the only criterion required in every SOC 2 report.
- Availability: Keeping systems available for operation and use.
- Processing integrity: Making sure system processing is complete, valid, accurate and authorized.
- Confidentiality: Protecting information designated as confidential.
- Privacy: Handling personal information in line with stated commitments.
The other four criteria are optional, so check which criteria are in scope.
SOC 2 Type I vs Type II
- Type I reviews whether controls are designed properly at a single point in time.
- Type II reviews whether controls operated effectively over a review period, often several months to a year.
For a vendor handling live patient calls, Type II is the more meaningful report, because it shows the controls worked consistently, not just on the day of the audit.
SOC 2 vs HIPAA: key differences
| HIPAA | SOC 2 | |
|---|---|---|
| What it is | Federal law | Voluntary audit and attestation framework |
| Who sets it | HHS, enforced by the Office for Civil Rights | AICPA, examined by independent CPA firms |
| Who must follow it | Covered entities and business associates | No legal requirement; vendors pursue it to demonstrate compliance with security practices |
| Focus | Protected health information | Customer data across the trust services criteria |
| What you get | Obligations, a BAA and policies | A SOC 2 report with an auditor’s opinion |
| Independent testing | Not required by the law itself | Core to the framework, especially Type II |
| Consequences | Regulatory penalties for HIPAA violations | Loss of customer trust if controls fail |
Where HIPAA and SOC 2 overlap
Many controls serve both frameworks, which is why vendors often map them together:
- Access controls and access management, such as role-based permissions and multi-factor authentication
- Encryption of data at rest and in transit
- Audit logs and monitoring
- Risk assessments and risk management
- Incident response and breach notification processes
- Vendor management and oversight of subcontractors
- Disaster recovery and backups
Does SOC 2 mean HIPAA compliant?
No. A SOC 2 report shows that a vendor’s security controls were designed well and, for Type II, operated effectively. It does not confirm that the vendor meets every HIPAA requirement, such as signing a BAA, following the Privacy Rule or handling PHI exactly as HIPAA requires.
The reverse is also true. A vendor can say it follows HIPAA without any independent testing of its controls. That is why clinics should ask for both: the BAA and HIPAA program show the vendor accepts its legal obligations, and the SOC 2 Type II report shows its controls work in practice.
“SOC 2 ready” is not a SOC 2 report
Watch the wording. “SOC 2 compliant,” “SOC 2 ready” or “audit in progress” can mean the vendor has not completed an audit. Ask for the report itself, usually shared under a nondisclosure agreement, and check:
- Whether it is Type I or Type II
- The review period and report date
- Which trust services criteria are in scope
- Which systems are in scope, including telephony, transcription, storage and EMR connections
- Any exceptions the auditor noted, and how they were fixed
Security controls to check in an AI voice agent
Voice agents create more places where PHI can live than many clinics expect: live audio, transcripts, call summaries, the admin console and the EMR connection. Check each layer.
Encryption
Ask how audio, transcripts, summaries, exports and backups are protected. Look for strong encryption at rest, such as AES-256, and current transport encryption in transit, such as TLS 1.2 or higher. Ask who manages encryption keys.
Access controls and access management
Not every user needs the same access. Front desk staff may need appointment details, while only a few people need full recordings. Look for:
- Role-based access by job function
- Multi-factor authentication for every admin account
- Single sign-on (SSO) where possible
- Least-privilege defaults, expanded only when needed
Audit logs, retention and deletion
| Control area | What good looks like |
|---|---|
| Audit logs | Access events, configuration changes, exports and handoffs are logged |
| Retention | The practice can set and understand retention windows for recordings and transcripts |
| Deletion | Secure deletion is documented, with clear timing |
| Incident review | Logs are detailed enough to reconstruct what happened |
PHI and AI model training
Ask directly whether call recordings or transcripts containing PHI are used to train AI models. You want a clear written answer, ideally that PHI is excluded from model training.
Incident response
Ask how the vendor detects, investigates and reports security incidents, and how quickly it notifies customers. The answer should match the breach notification terms in the BAA.
EMR integration without new risk
When a voice agent writes to your EMR, the integration becomes part of your security review. Ask for a walkthrough of one call from start to finish: the patient calls, the agent verifies identity, checks the schedule, books the appointment and writes the result to the chart. Staff should be able to see what happened, and compliance should be able to audit it later.
A sound integration has:
- Supported APIs, not shared inboxes or manual file transfers
- Limited write access, so the agent writes only to approved fields
- A scoped service account with the minimum permissions each workflow needs
- Defined exception handling, so failed write-backs create a task or alert instead of disappearing
Start with one or two high-volume, low-risk workflows, such as scheduling or after-hours message capture, and expand once the data flow is predictable. Our EMR compatibility guide for AI voice agents covers what to ask about integration in more detail.
Vendor evaluation checklist
Use this checklist during vendor demos, not after them.
| Area | Question to ask | What to look for |
|---|---|---|
| SOC 2 | Do you have a current SOC 2 report, and is it Type II? | Yes, Type II, shared under NDA |
| HIPAA | Will you sign a BAA before any PHI is processed? | Yes, with a BAA ready for legal review |
| Subcontractors | Are your telephony and AI model vendors covered by BAAs? | Yes, with a clear list of subcontractors |
| Encryption | How are audio, transcripts and stored PHI protected? | Encryption at rest and in transit |
| Access controls | Can we restrict access by role and require MFA? | Role-based access, MFA and SSO |
| Audit logs | What gets logged? | Access events, exports, configuration changes, admin actions |
| Retention | Can we set retention and deletion rules? | Yes, with documented options |
| Model training | Is PHI used to train AI models? | A clear written answer |
| EMR integration | Which EMRs do you connect to in production today? | Named systems and named workflows |
| Failure handling | What happens if a write-back to the EMR fails? | Alerts and a review queue |
| Human escalation | How are urgent or failed calls handed to staff? | A clear transfer or task process |
| Incident response | How and when do you notify customers of an incident? | A documented process that matches the BAA |
Assign sections to different people in the meeting: the practice manager on workflow fit and escalation, IT on SSO, logging and integration, and compliance on the BAA, audit scope and PHI handling. For a broader look at evaluating AI tools for privacy, see our guide to HIPAA-compliant AI, and for voice-specific HIPAA requirements, our guide to HIPAA compliance for AI voice agents.
How Simbie AI meets both SOC 2 and HIPAA
Simbie AI provides clinically trained AI voice agents for medical practices. They answer and place patient calls, schedule appointments, take refill requests, handle patient registration and collect pre-visit intake, then write the results into your EMR.
- SOC 2 Type II certified: Simbie’s controls have been independently examined over a review period.
- HIPAA-compliant: Simbie signs a Business Associate Agreement with customers as part of onboarding.
- Vendor oversight: Simbie manages BAAs with the vendors in its own stack, such as telephony and AI model providers, as part of its HIPAA compliance program.
- Human review: A virtual medical assistant (VMA) review step keeps a person involved in the agent’s work.
- EMR integration: Epic, eClinicalWorks, ModMed EMA, gGastro, EZDerm and Nextech.
Frequently asked questions
What is SOC 2 vs HIPAA?
HIPAA is a federal law that sets requirements for protecting patient health information. SOC 2 is a voluntary audit framework in which an independent CPA firm reports on whether a vendor’s security controls are designed and operating effectively. Healthcare vendors often need both.
Does SOC 2 mean HIPAA compliant?
No. SOC 2 shows that security controls work, but it does not confirm every HIPAA requirement, such as a signed BAA or Privacy Rule obligations. Ask for both a SOC 2 Type II report and a BAA.
Is SOC 2 legally required?
No. SOC 2 is voluntary. HIPAA is the legal requirement for covered entities and their business associates. Many healthcare organizations still require SOC 2 reports from vendors as part of vendor management.
What is the difference between SOC 1, SOC 2 and SOC 3?
SOC 1 reports focus on controls relevant to a customer’s financial reporting. SOC 2 reports cover controls related to the trust services criteria, such as security and privacy, and are shared with customers under NDA. SOC 3 is a shorter, general-use version of a SOC 2 report that can be shared publicly.
What does SOC 2 certification verify for an AI vendor?
It verifies, through an independent CPA firm, that the vendor’s controls for the in-scope trust services criteria were designed properly and, in a Type II report, operated effectively over a review period. Check that the scope includes the systems that handle your patient data.
Do AI voice agents need a BAA?
Yes. If an AI voice agent creates, receives, stores or transmits PHI for your practice, the vendor is a business associate under HIPAA and a BAA is required. Some practices also complete their own legal review before specific data sharing, such as call recording, begins.
Is Simbie AI SOC 2 and HIPAA compliant?
Yes. Simbie AI is SOC 2 Type II certified, HIPAA-compliant and signs BAAs with customers.
Ready to see how Simbie AI cuts costs by 60% for your practice? See how it works.