Security
HITRUST vs. SOC 2: Pick the Program Your Team Will Actually Operate
A health system’s vendor-risk team sends over a questionnaire, and somewhere in it is the question every healthcare software company eventually gets: do you have HITRUST, or SOC 2? The HITRUST vs SOC 2 decision usually gets made right there, under deadline, by whoever happens to own security that quarter.
That is the wrong place to make it. The two programs are not a cheaper and a more expensive version of the same thing. They are built differently, they put different parties on the hook, and they ask different things of the team that has to live with the controls afterward.
The short answer: HITRUST is a certification that HITRUST itself issues after reviewing an authorized assessor’s work against prescriptive requirements. SOC 2 is a licensed CPA firm’s attestation against criteria you design your own controls to meet. If a customer contract names HITRUST, the decision is made. If not, SOC 2 plus a healthcare-specific control set is often enough. Under either one, the real risk is a policy library that nobody in the building actually follows.
HITRUST vs. SOC 2: Who Assesses, Who Certifies
The cleanest way to compare the two is to ask who writes the rules, who checks your work, and who checks the checker.
| HITRUST | SOC 2 | |
|---|---|---|
| Who writes the requirements | HITRUST, in the HITRUST CSF | The AICPA, in the Trust Services Criteria |
| How prescriptive | Fixed requirement statements you are scored against | Criteria; you design the controls that meet them |
| Who performs the assessment | An External Assessor firm approved by HITRUST | A licensed CPA firm |
| Who reviews that work before you get a result | HITRUST runs quality assurance on every validated assessment | The CPA firm, under its own professional standards |
| What you receive | A HITRUST report and certification letter, if your scores meet the threshold | An attestation report carrying the CPA firm’s opinion |
| How long it lasts | e1 and i1 certifications for 1 year, r2 for 2 years | Type II covers a past period, Type I a point in time; relying parties decide how recent is recent enough |
The scope difference is concrete. When HITRUST released version 11 of its framework, the e1 assessment held 44 requirement statements and the i1 held 182. The r2 starts from those 182 and adds statements tailored to your risk profile; HITRUST’s 2025 Trust Report says an r2 validated assessment averaged approximately 379 requirements in 2024. The validity periods are HITRUST’s own.
The structural difference matters more than the counts. Under HITRUST, the assessor submits the assessment to HITRUST, and per the HITRUST Assessment Handbook a HITRUST QA analyst reviews it before HITRUST issues the report and certification letter. That makes HITRUST a private organization that writes the framework, oversees the assessors and grants the certificate. It also means that, on top of the assessor’s engagement, you work through HITRUST’s own platform, fees and submission process, with limited room for flexibility.
SOC 2 has a simpler chain. The AICPA sets the standards for SOC engagements, and a CPA firm performs the examination and signs the opinion. Once the auditor signs, you are done: there is no program owner reviewing your report before it reaches your customer. The structure is simpler, and the scope is yours to set. We have written separately about what a SOC 2 Type II report actually tells a buyer, including which of the five criteria are mandatory and why “SOC 2 certified” is the wrong phrase.
What the PCI Assessor Model Adds to the Picture
Payments compliance offers a useful third model, because it separates two jobs the other programs blend.
The PCI Security Standards Council was founded by the card brands. It writes the standards, and it says plainly that it does not enforce compliance: the payment brands and acquiring banks decide who must validate and what happens to those who do not. What the Council does control is the assessor. Qualified Security Assessor companies are qualified by the Council, and individual QSAs re-qualify every 12 months. Its Assessor Quality Management team audits assessor work, and under the QSA Qualification Requirements a QSA company that falls short can be placed in remediation, with its public listing shown in red, and can lose its qualification.
The feedback lands on the assessor, not on the merchant’s compliance status. That is the point worth carrying back to healthcare: independent oversight of the people doing the checking is what keeps an assessment honest. HITRUST builds that oversight into every certification. SOC 2 relies on the CPA firm’s own quality processes. Neither approach is wrong, but you should know which one your customers are trusting when they read your report.
When SOC 2 Plus a Healthcare Control Set Is Enough
For many healthcare software companies, a SOC 2 examination with a deliberately chosen set of healthcare controls layered on top is the better fit. It tends to work when:
- Your customers accept it. Read the contracts and the vendor-risk questionnaires you have actually received, not the ones you fear. If they ask for SOC 2 or “an independent security assessment,” you have room to choose.
- You need HIPAA safeguards regardless. Neither program is HIPAA compliance. HHS states that it does not endorse or otherwise recognize private organizations’ certifications regarding the Security Rule. Your HIPAA obligations stand on their own, and a targeted healthcare control set aimed at them is work you would do anyway.
- You want a path, not a dead end. The overlap is real. HITRUST’s own guide to moving from SOC 2 to the e1 estimates that about 36 of the 44 e1 requirements at version 11 map to one or more SOC 2 controls, when the SOC 2 covers all five Trust Services Criteria. A well-run SOC 2 program leaves you closer to HITRUST if a customer later demands it.
- Your team is small. A criteria-based program lets you design controls that fit how you build and ship, instead of adopting requirement statements written for organizations many times your size.
When HITRUST Is the Right Call
HITRUST is the right call when the market makes it so. If a health system or payer you sell to names HITRUST in its contract or vendor-risk program, debating the merits wastes time. Find out which assessment they will accept (e1, i1 or r2), because the gap between the e1’s fixed set and a tailored r2 is large.
It can also be the right call when you need one framework that covers several obligations at once, and you have the people to run it. HITRUST built its framework to harmonize many authoritative sources, HIPAA among them. That consolidation is worth something to an organization that would otherwise be answering to several frameworks separately.
What HITRUST should not be is a reason the organization cannot do things. When a certification becomes the answer to every engineering proposal (“we can’t, because HITRUST”), the program is running the company instead of protecting it.
The Real Risk: Policy Nobody Practices
Here is the pattern that worries us more than the choice of program. A security function writes policies for the assessors, apart from the people who do the work. The documents are thorough. The assessment goes smoothly. And the engineers, support staff and administrators who touch patient data every day work the way they always have, because nobody connected the policy to the job.
Every assessment samples evidence over a window; none of them watches every day. A program written for the assessor rather than the team can pass an assessment and still fail an incident. HITRUST’s own scoring hints at the gap: its handbook defines separate maturity levels in the r2 for policy, procedure and implementation, because having a written policy and running the control are different things.
So the first question for a new security leader is not “HITRUST or SOC 2?” It is whether the organization practices the security its documents describe. Answer it by checking practice against paper:
- Pick five policies and ask the people they govern to describe what they do. Compare.
- Trace one access request, one production change and one offboarding from start to finish.
- Look for controls that exist only as a sentence, with no system enforcing them.
Whatever program you choose afterward will be cheaper and more honest for having done this first.
Operating the Controls Costs Real Money
Any of these programs takes real work, and the assessment fee is the smallest part of it. Policies have to be understood and implemented by people who have other jobs. And the features that enforce a stated control, such as single sign-on you can require, audit logs kept long enough to matter, and administrative restrictions on who can change what, often sit on higher pricing tiers of the platforms you already use.
Budget for those upgrades when you choose a program, not after an assessor asks for evidence. A control you cannot enforce is a control you will eventually document around. When the software itself is part of the gap, that is engineering work: the access rules, audit trails and change controls have to live in the code and the pipeline, which is the same discipline we describe in modernizing healthcare software without breaking compliance.
Frequently Asked Questions
Is HITRUST harder than SOC 2?
It is more prescriptive. HITRUST scores you against fixed requirement statements, and HITRUST reviews the assessor’s work before it issues a certification. SOC 2 lets you design controls to meet broader criteria, and the CPA firm’s opinion is the final word.
Does SOC 2 or HITRUST make a company HIPAA compliant?
No. HHS does not recognize private certifications as satisfying the Security Rule. Both programs can show how your controls address HIPAA’s safeguards, but your HIPAA obligations remain yours.
Can a SOC 2 program prepare you for HITRUST later?
Partly. HITRUST estimates that about 36 of the 44 e1 requirements at version 11 map to SOC 2 controls, when the SOC 2 covers all five Trust Services Criteria. The rest, and any move to the i1 or r2, is additional work.
Which HITRUST assessment do customers usually ask for?
That depends on the customer, so ask. The e1 and i1 are fixed requirement sets (44 and 182 statements when version 11 was released); the r2 is tailored and larger. Get the required level in writing before you scope the work.
Before You Pick a Program
If you are choosing between HITRUST and SOC 2, start with two documents: the contracts that say what your customers require, and an honest account of which of your written controls your team actually runs.
Clear Function builds and modernizes software for teams that handle regulated data, including custom healthcare software development for organizations across the healthcare industry. If the gap you find is in the software, the platforms or the delivery pipeline, we would welcome the conversation about closing it.
Newsletter
Subscribe to newsletter
Subscribe to receive the latest blog posts to your inbox every week.
