Simbie AI has completed a SOC 2 Type II audit. An independent CPA firm examined our security controls and confirmed that they operated effectively over the audit period.
For medical practices, this matters because Simbie’s AI voice agents handle protected health information on every call: patient names, dates of birth, appointment details and the reason for the call. A SOC 2 Type II report gives practices independent evidence of how that data is protected.
What SOC 2 Type II means
SOC 2 is an attestation framework from the American Institute of Certified Public Accountants (AICPA). A licensed CPA firm examines a service organization’s controls and issues a report. A Type I report looks at whether controls are designed properly at one point in time. A Type II report, like ours, looks at whether those controls worked consistently over a period of months.
SOC 2 reports are built on five trust services criteria: security, availability, processing integrity, confidentiality and privacy. Security is required in every SOC 2 report.
What it means for practices using Simbie
- Faster security reviews. Practices and health systems can review an independent report instead of starting their vendor assessment from scratch.
- Independent evidence of our controls. The audit covers areas such as access control, encryption, logging and incident response.
- It works alongside HIPAA. SOC 2 does not replace HIPAA. Simbie also signs a Business Associate Agreement with each customer as part of onboarding. Our guide to SOC 2 vs HIPAA explains how the two fit together.
Security is ongoing work
Passing an audit is a checkpoint, not a finish line. We continue to monitor our controls and keep our security program current as Simbie grows.
To request our SOC 2 Type II report, or to see how Simbie’s AI voice agents work with your EMR, book a demo.