SOC 2 Type 2 (Type II): AICPA Trust Services Criteria, Type I vs. Type II, and HIPAA Mapping in Clinical Research

What Is SOC 2 Type 2 (Type II)? Short Answer

SOC 2 Type 2 (formally styled SOC 2 Type II under the American Institute of Certified Public Accountants [AICPA] framework) is an independent third-party examination report issued by a licensed CPA firm that attests to both the suitability of the design and the operating effectiveness of a service organization’s controls over a specified multi-month audit period (typically 6 to 12 consecutive months). Governed by AICPA attestation standard AT-C Section 205 (SSAE No. 18) and evaluated against the Trust Services Criteria (TSC), SOC 2 Type II is the primary assurance benchmark used by academic medical centers, pharmaceutical trial sponsors, and healthcare compliance officers to evaluate cloud Electronic Data Capture (EDC), telehealth, EHR integration, and clinical AI vendors.

Definition and Scope: SOC 1 vs. SOC 2 and Type I vs. Type II

Within the AICPA System and Organization Controls (SOC) suite, reports are separated by their subject matter (financial reporting vs. operational security/trust) and by their temporal scope (point-in-time design vs. multi-month operational testing):

• SOC 1 vs. SOC 2 vs. SOC 3: A SOC 1 report evaluates Internal Control over Financial Reporting (ICFR); a SOC 2 report evaluates operational information security and data governance controls against the AICPA Trust Services Criteria and is restricted-use (shared under a non-disclosure agreement with customers, auditors, and business partners) containing detailed test matrices in Section IV; a SOC 3 report is an abbreviated public-use summary of a SOC 2 engagement that omits the detailed control tests and exceptions.
• SOC 2 Type I (Point in Time): Evaluates whether management’s description of the system is fairly presented and whether the controls are suitably designed to meet the applicable Trust Services Criteria as of a single specified date (for example, ‘as of June 30, 2026’). It does not test whether those controls were actually followed over time.
• SOC 2 Type II (Period of Time): Evaluates everything in Type I plus tests whether the controls operated effectively throughout a specified audit period (typically 6 to 12 months; minimum 3 months for initial examinations) by sampling access logs, change tickets, vulnerability scans, employee offboarding timestamps, and incident records across the entire window.

What Standards Govern SOC 2 Type 2? AT-C Section 205 and the Five Trust Services Criteria

Every SOC 2 Type II engagement is performed by an independent CPA firm under AICPA Statements on Standards for Attestation Engagements (SSAE No. 18, codified in AT-C Section 205, Assertion-Based Examination Engagements) using the AICPA Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (aligned with the 17 internal control principles of the 2013 COSO framework).

Of the five Trust Services Criteria categories, Security (the Common Criteria, CC1–CC9) is mandatory for every SOC 2 report; the remaining four categories are scoped into the audit based on the service commitments the vendor makes to its customers:

Trust Services Criteria (TSC) Category	AICPA Criteria Series	Mandatory or Optional?	Core Control Objective & Clinical Research / Health IT Relevance
1. Security (Common Criteria)	CC1 – CC9	Mandatory (Required in all SOC 2 reports)	Protects system resources against unauthorized physical and logical access. Covers COSO governance (CC1–CC5), logical/physical access (CC6), system operations/monitoring (CC7), change management (CC8), and vendor/risk mitigation (CC9).
2. Availability	A1	Optional (Scoped by SLA)	Ensures the system is available for operation and use as committed in Service Level Agreements (SLAs)—critical for 24/7 EHR APIs, randomization/RTSM systems, and emergency telehealth.
3. Processing Integrity	PI1	Optional (Recommended for EDC/eCOA)	Addresses whether system processing is complete, valid, accurate, timely, and authorized—vital for clinical trial eCRF edit checks, laboratory assay pipelines, and medical billing engines.
4. Confidentiality	C1	Optional (Standard for R&D SaaS)	Protects information designated as confidential (such as unblinded trial protocols, proprietary molecular structures, and pre-patent IP) from inception through secure destruction.
5. Privacy	P1 – P8	Optional (For direct PII collection)	Governs how Personal Identifiable Information (PII) is collected, used, retained, disclosed, and disposed of in accordance with the entity’s privacy notice (notice, choice/consent, access, and quality).

How to Read a SOC 2 Type 2 Report in Vendor Due Diligence (Sections I–V)

When a university research security office, hospital CISO, or pharmaceutical sponsor exercises its vendor audit rights to review a SaaS provider’s SOC 2 Type II report, the document is organized into five standardized sections:

1. Section I — Independent Service Auditor’s Report (The Opinion): States the CPA firm’s formal opinion on management’s assertion. Buyers verify whether the opinion is Unqualified (Clean), Qualified (material failures occurred in one or more criteria), Adverse, or a Disclaimer of Opinion.
2. Section II — Management’s Assertion: Signed attestation by the service organization’s executive management confirming the system boundaries, the audit period dates, and the criteria in scope.
3. Section III — Description of the System: Details the exact software services included in the boundary (watch for products excluded from scope!), the infrastructure architecture, data flows, Subservice Organizations (e.g., AWS, Microsoft Azure, Google Cloud Platform, managed via the Carve-Out or Inclusive method), and Complementary User Entity Controls (CUECs)—the controls the customer institution itself must configure (such as enforcing institutional SSO and reviewing user role assignments) for the vendor’s security model to hold.
4. Section IV — Trust Services Criteria, Related Controls, Tests of Controls, and Results of Tests: The detailed evidence table listing every control activity, how the CPA auditor tested it across the 6- to 12-month period, and whether “No exceptions noted” or specific control exceptions occurred.
5. Section V — Other Information Provided by the Service Organization (Optional, Unaudited): Where management documents remediation plans for any exceptions noted in Section IV, or includes a cross-walk mapping table to HIPAA, HITRUST, or ISO/IEC 27001.

How Does SOC 2 Type 2 Integrate With EHR, HIPAA, and Clinical Research Workflows?

In healthcare informatics and clinical research data management, a SOC 2 Type II report interacts directly with federal privacy regulations and international security standards, but is never a standalone replacement for statutory compliance:

• SOC 2 Type II vs. HIPAA Compliance: The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) does not recognize or issue any official government ‘HIPAA certification.’ As explained in our comparison of HIPAA Aware vs. HIPAA Compliant vendors and our HIPAA Compliance Checklist, a Business Associate handling Protected Health Information (PHI) must sign a statutory Business Associate Agreement (BAA) and comply with the HIPAA Security, Privacy, and Breach Notification Rules (45 CFR Parts 160 and 164). To provide third-party assurance, leading health-tech and EHR-connected vendors commission a combined SOC 2 Type II + HIPAA Security Rule examination under AT-C Section 205, where the auditor tests additional controls mapped to 45 CFR §§ 164.308 (Administrative), 164.310 (Physical), and 164.312 (Technical Safeguards).
• SOC 2 Type II vs. ISO/IEC 27001 and HITRUST CSF: Whereas SOC 2 Type II is an attestation report primarily used in North America with flexible vendor-defined controls tested against AICPA criteria, ISO/IEC 27001 (supported by ISO/IEC 27002 controls) is an international Information Security Management System (ISMS) certification, and HITRUST CSF is a prescriptive, healthcare-specific certifiable framework.
• 21 CFR Part 11 and Good Clinical Practice (ICH E6): For Electronic Data Capture (EDC), eTMF, and eConsent platforms used in FDA-regulated clinical trials, a SOC 2 Type II report covering Security, Availability, and Processing Integrity provides foundational infrastructure assurance for Part 11 computer system validation (CSV), while the trial sponsor still verifies Part 11-specific electronic signature bindings and immutable time-stamped audit trails.

Common Misunderstandings

• Treating ‘Hosted on AWS/Azure SOC 2’ as vendor SOC 2 compliance: A software vendor hosted on Amazon Web Services or Microsoft Azure inherits physical data-center security from the cloud provider (a Carved-Out subservice organization), but the vendor’s own application code, database access, SDLC, and support staff are completely unverified unless the vendor holds its own SOC 2 Type II report.
• Ignoring Section IV exceptions when the cover opinion is ‘Unqualified’: A SOC 2 Type II report can still carry an overall unqualified opinion even when isolated sampling exceptions (such as a delayed quarterly access review or a late background check) appear in Section IV. Always inspect Section IV for ‘Exception noted’ entries and Section V for management’s remediation.
• Accepting a stale report without a Bridge Letter: A SOC 2 Type II report covers a historical 6- to 12-month window. If the audit period ended more than 3 to 6 months ago, procurement teams should request a signed Bridge Letter (Gap Letter) from the vendor attesting that no material degradation or changes in controls have occurred since the report’s period end date.

Frequently Asked Questions

What is soc 2 type 2 and how is it used in clinical research and healthcare?

A SOC 2 Type 2 (Type II) report is an independent CPA attestation report conducted under AICPA standard AT-C Section 205 that tests both the design and the operating effectiveness of a cloud vendor’s controls over a 6- to 12-month period. Clinical research sponsors and health systems use it to vet EDC, ePRO, telehealth, and EHR-integrated software vendors.

What standards or regulatory requirements govern soc 2 type 2?

SOC 2 Type II engagements are governed by AICPA SSAE No. 18 (AT-C Section 205) and evaluated against the AICPA Trust Services Criteria (TSC): Security (Common Criteria CC1–CC9, mandatory), Availability (A1), Processing Integrity (PI1), Confidentiality (C1), and Privacy (P1–P8).

How does soc 2 type 2 integrate with EHR and health informatics workflows?

SOC 2 Type II audits verify the technical and operational controls—including multi-factor authentication, encryption, API change management, logging, and cloud subservice oversight—that protect EHR integrations and clinical data pipelines. In healthcare, vendors frequently combine SOC 2 Type II with a HIPAA Security Rule (45 CFR Part 164) mapping to demonstrate third-party audited PHI safeguards.

Sources

• American Institute of Certified Public Accountants (AICPA). SOC 2® — SOC for Service Organizations: Trust Services Criteria. https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2
• American Institute of Certified Public Accountants (AICPA). Statements on Standards for Attestation Engagements (SSAE No. 18), AT-C Section 205 — Assertion-Based Examination Engagements. https://www.aicpa-cima.com/resources/download/aicpa-statements-on-standards-for-attestation-engagements
• U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR). Summary of the HIPAA Security Rule (45 CFR Part 164, Subpart C). https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html