SOC 2, ISO 27001 and HITRUST for an offshore billing vendor: what HIPAA requires and what each proves

The Security Rule lets a covered entity permit a business associate to create, receive, maintain or transmit electronic protected health information only if the covered entity obtains satisfactory assurances that the business associate will appropriately safeguard it (45 CFR 164.308(b)). The assurances are documented in a written contract that requires the business associate to comply with the Security Rule, to bind its subcontractors and to report any security incident, including breaches (45 CFR 164.314(a)). The same duty runs down the chain to subcontractors.

HHS says no standard or implementation specification requires a covered entity to certify compliance, and that an outside organization’s certification does not stop HHS from later finding a violation (HHS on certification). It also says a business associate cannot self-certify, or be certified by a third party, instead of the contract (HHS on business associate contracts). Using an outside organization for the periodic evaluation is a business decision, not a requirement.

• It is not named in the rule. None of the three appears in the Security Rule text, in Public Law 116-321, in OCR’s 2022 request for information or in the January 2025 proposal. In the documents read for this guide HHS does not say that any of them maps to the Security Rule.
• A mapping is not compliance. OCR’s 2016 crosswalk maps the Security Rule to the NIST Cybersecurity Framework and lists ISO/IEC 27001 control numbers among the framework’s references, and it says the mappings do not show compliance (HHS crosswalk). NIST’s HIPAA implementation guide says using it does not ensure compliance either.
• A report describes a scope. A clean report on one system or one delivery site says nothing about another. A SOC report is generally restricted to the service organization’s management and its users, and does not relieve the user of responsibility for risk.
• The examiner matters. The AICPA says SOC services should be thoroughly evaluated by service organizations and CPA firms.

• The report or certificate itself, not a logo, with its date and the period it covers.
• Its scope: which systems, sites and services, and whether the delivery location and the subcontractors that touch your data fall within it.
• Who issued it: a CPA firm for SOC 2, an outside certification body for ISO/IEC 27001, an authorized external assessor for HITRUST.
• Exceptions, qualifications and open corrective actions, and what the vendor did about them.
• The documents a vendor review needs whatever the vendor holds: the signed business associate agreement, its risk analysis, its policies and its training records, which the training and access rules page covers.

A vendor that holds none of the three is not in breach of the Security Rule for that reason, and a vendor that holds one is not shown by it to meet the Security Rule. The January 2025 proposal would add a written verification from business associates at least once a year; where that stands is in HIPAA Security Rule update for business associates. The contract terms are on the business associate agreement page, and the question list is in offshore medical billing vendor questions. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.