What Is SOC 2 Type II?

SOC 2 (System and Organization Controls 2) is an auditing standard from the AICPA. A Type II report certifies that a vendor's security controls operated effectively over a period of time — typically 6–12 months. Enterprise healthcare buyers increasingly require it before signing vendor contracts.

SOC 2 Type I certifies that controls exist. Type II certifies that they worked.

SOC 2 vs. HIPAA

They overlap significantly but are not the same:

HIPAA is a legal requirement for anyone handling PHI. It mandates specific technical safeguards.
SOC 2 is a voluntary certification that demonstrates security posture to enterprise buyers.

In practice, building a HIPAA-compliant cloud architecture first gives you most of the technical controls needed for SOC 2. You're doing the engineering work once for both certifications.

The Five Trust Service Criteria

Security (CC) — Always included. Covers logical access, encryption, network security, incident management.
Availability (A) — Uptime and SLA commitments. Include this if uptime is in your sales conversation.
Processing Integrity (PI) — Data processed accurately and completely. Relevant for billing systems.
Confidentiality (C) — Sensitive data protected. Overlaps heavily with HIPAA for healthcare vendors.
Privacy (P) — Personal data collected and disclosed appropriately. Add if you have direct patient-facing features.

Most healthcare software vendors start with Security + Availability + Confidentiality.

What Auditors Actually Check

Access Control:

IAM least-privilege policies (no wildcard permissions)
MFA enforced for all production system access — no exceptions, including developers
Quarterly access reviews — documented with evidence

Change Management:

All production code changes reviewed by a second engineer
No direct production pushes; deployments gated

Monitoring & Alerting:

CloudWatch / GCP Monitoring alarms for anomalous access
Log retention ≥ 90 days for security events (HIPAA requires 6 years for PHI logs — satisfy both simultaneously)
Automated alerts for failed logins, API anomalies, and configuration changes

Incident Response:

A documented, tested incident response plan
Defined RTO/RPO per service tier

The HIPAA engineering checklist maps these controls to HIPAA requirements — evidence for both can be collected simultaneously.

The Observation Period Trap

The most common mistake: starting a Type II audit too early. Type II requires evidence of controls operating over time — typically 6 months minimum. If you enable CloudTrail on January 1 and start your audit February 1, you'll fail due to insufficient observation history.

Start your observation period only after your Zero Trust architecture is fully deployed and your operational processes are documented. Run for 6 months, then engage an auditor.

The HIPAA & SOC 2 Cloud Architecture service implements all SOC 2 Trust Service Criteria controls from day one — evidence-ready for both HIPAA and Type II.