SOC 2 + HIPAA Overlay Engagements: How They Work

A SOC 2 engagement can cover HIPAA in two ways. The auditor adds HIPAA criteria to the SOC 2 examination and issues one SOC 2+ report, or the auditor issues a SOC 2 report and delivers a HIPAA assessment separately. Neither produces a HIPAA certificate, because none exists. Which format you need depends on what your healthcare customers will accept, so ask them before you ask auditors.

This guide is for comparing auditor proposals. It covers what each format concludes, how to ask for the fee, which firms on our SOC 2 and HIPAA auditors list offer it, and eight questions to put in writing before you sign. For the provision-by-provision mapping of HIPAA to the SOC 2 criteria, see SOC 2 vs HIPAA. For scoping the SOC 2 itself in a healthcare company, see SOC 2 for healthcare companies. Our general guide on how to choose a SOC 2 auditor covers the questions that apply regardless of HIPAA.

What does a SOC 2 + HIPAA overlay engagement actually mean from the auditor’s side?

It means one of two deliverables, and the engagement letter should name which. In a SOC 2+ examination, the CPA firm tests the SOC 2 criteria plus additional HIPAA criteria and reports on both. In the other arrangement, the firm issues a SOC 2 Type 2 report and delivers a HIPAA Security Rule gap analysis, readiness assessment, or HITRUST assessment as a separate document.

The AICPA’s SOC 2 guide includes an illustrative report for a SOC 2+ examination, and Schneider Downs lists SOC 2 + HIPAA among the SOC 2+ reports it issues. Schneider Downs also states that a SOC 2+ report does not certify the added framework: the opinion states whether controls met the added criteria. Linford & Company takes the other route. It typically runs fieldwork for both in tandem and issues two separate reports, one for the SOC 2 criteria and one for HIPAA.

A customer that asks for a “SOC 2 + HIPAA report” may accept a gap analysis or may require something else, such as a HITRUST CSF validated assessment. Get the recipient’s answer in writing before the engagement letter is signed.

How does the auditor structure the engagement to avoid double-billing for overlap?

Overlap lets an auditor reuse evidence requests and some testing, but each scope still has to be tested and reported, so ask for the fee in writing instead of assuming a discount. Linford’s tandem fieldwork shows that firms do share work across the two scopes. It does not show that they discount for it.

Ask each firm to split the quote into SOC 2 and HIPAA lines, even if the total is one fixed fee, and to say which tasks are shared (kickoff, evidence request list, walkthroughs) and which are not. An encryption configuration may inform both scopes, but the auditor still has to decide whether it meets the SOC 2 criteria and the HIPAA specification. If your PHI system boundary or subservice organization scope is still open, ask whether the firm will work time and materials with a cap, and get the cap, the change-order triggers, and the deliverables in writing. Also ask whether the SOC 2 attest work and any HIPAA assessment or advisory work sit under one engagement letter or two, who does each part, and what independence safeguards apply when the same firm does both.

Compare the combined proposal with the same firm’s separately scoped quotes. For how fee structures differ by firm type, see Big Four vs. specialist SOC 2 auditor pricing. For the overlap itself, the SOC 2 vs HIPAA mapping shows which Security Rule provisions SOC 2 evidence covers and which need separate HIPAA work, such as the risk analysis, business associate agreements, and breach notification.

Which SOC 2 firms in our directory offer the HIPAA overlay (and how do you tell)?

Healthcare client experience, HITRUST accreditation, and SOC 2 + HIPAA overlay work are separate facts. A firm that serves hospitals or holds HITRUST CSF Assessor status has not thereby shown overlay capability. For this roster, a firm counts when its own published material describes SOC 2 work mapped to the HIPAA Security Rule. The table links the firm page that shows it.

A role is recorded only when the firm's own page describes it. Serving healthcare clients or holding HITRUST assessor status does not count. The same firms are on the SOC 2 and HIPAA auditors list.

SOC 2 issuers that are also HITRUST External Assessors are on HITRUST CSF assessors, and firms with healthcare experience, overlay or not, are on SOC 2 auditors for healthcare.

With a firm that has healthcare experience but no recorded overlay role, ask what method its HIPAA component follows (HITRUST CSF, NIST SP 800-66, or its own framework) and whether it has issued standalone HIPAA reports before. Confirm the firm’s AICPA peer review standing first, using our peer review guide, because that applies to every SOC 2 firm.

How does a HIPAA-overlay engagement change the bridge letter and renewal cadence?

A SOC 2 bridge letter is management’s statement about the period after the report’s observation window, so it does not extend a HIPAA assessment or a HITRUST certification. Our bridge letter guide covers how the letter works.

If a customer relies on a SOC 2+ report, the bridge letter covers that report. If the customer relies on a SOC 2 report plus a separate HIPAA assessment, ask how the firm will handle changes to the HIPAA-relevant controls after the assessment date. The answer may be a line in the same letter, a separate document, or nothing within the firm’s usual bridge-letter scope. Settle it before the engagement ends.

The cycles also differ. SOC 2 Type 2 is commonly repeated each year. HHS says the Security Rule does not specify how often to perform a risk analysis, and the frequency varies by organization. A HITRUST r2 certification is valid for two years with an interim assessment after one year, while i1 is a one-year certification. Agree the HIPAA review cadence at the start, record it in the engagement letter or statement of work, and scope any updated HIPAA assessment a recipient requests as its own deliverable. A standalone HIPAA assessment has its own price range, summarized on our HIPAA framework page.

What questions should you ask the auditor before signing a combined SOC 2 + HIPAA engagement?

Send these eight questions before the engagement letter is executed and ask for the answers in writing, either in the letter or in a separate representation document.

1. Will you deliver a SOC 2+ report with HIPAA criteria, or a SOC 2 report plus a separate HIPAA assessment? Either can be legitimate. Ask which HIPAA criteria are included, what the opinion covers, and whether a gap analysis or HITRUST assessment comes with it.

2. Is the HIPAA portion an attestation, a gap analysis, or a HITRUST CSF assessment, and what method does it follow (HITRUST CSF, NIST SP 800-66, or your own framework)? NIST SP 800-66 is a HIPAA Security Rule implementation resource, and HITRUST CSF is a separate assessment route. Ask for a redacted example.

3. What is the fee split between SOC 2 and HIPAA work, and which evidence tasks are shared? A price alone does not show how the work is staffed or tested. Ask for the shared request list and the deliverables.

4. Do you hold HITRUST CSF Assessor accreditation, and can you issue HITRUST i1 or r2 validated assessments as well? If not, ask whether your customers will accept the HIPAA deliverable you do offer, since some customers expect a HITRUST report.

5. Will someone with HIPAA Security Rule assessment experience be on the engagement team, or will the SOC 2 team also cover the HIPAA scope? A SOC 2 team new to HIPAA can miss the breach notification rule, business associate obligations, and the required versus addressable distinction. Ask for that person’s background and prior HIPAA engagements.

6. What can management state in a bridge letter, and what separate HIPAA update would the recipient need? The right answer depends on the report and on what the recipient requires.

7. If our customer is a covered entity that asks for a business associate agreement review, is that in scope or a separate engagement? Ask whether the firm will inspect the agreement inventory and report findings, and who advises on contract language. Put the boundary in the statement of work so a customer’s legal request is not mistaken for an audit deliverable.

8. If we later move from a HIPAA gap analysis to a HITRUST i1 or r2 validated assessment, how do price and timeline change, and can the same team do it? A firm with a HITRUST practice will have a specific answer. A firm without one will not.