In March 2026, HHS’s Office for Civil Rights completed its investigation into MMG Fusion, a software vendor that helps oral healthcare practices manage patient communications.
That is nothing out of the ordinary. But then OCR found that MMG had disclosed the PHI of approximately 15 million individuals. They had never conducted a thorough risk analysis and failed to notify the same to the covered entities it served.
MMG was not a hospital or a health plan. It was exactly the kind of healthtech vendor that today is expected to walk into a procurement review with SOC 2 Type II report already in hand, along with proof of a HIPAA program that can survive an OCR investigation and a HITRUST certification a health system has named in the contract.
KLEAP has already broken down what these three frameworks are and how they relate to each other before. In a previous blog about prioritizing between HITRUST, HIPAA, and SOC 2, we have handed healthcare startups the exact tips to survive. Our article on HIPPA vs SOC 2 compliance in healthcare gives more clarity on the two.
Both blogs answer some fundamental queries. However, once those are answered, the follow-up questions we hear from organizations are usually about their next moves.
That question has become more urgent this year. Digital health startups raised $4 billion across 110 deals in the first quarter of 2026 alone, a billion dollars ahead of the same period last year. Capital is moving quickly into companies chasing enterprise and hospital contracts, and those contracts are gated by compliance.
Understanding HIPAA, HITRUST, and SOC 2 compliance in healthcare is only the first step. This blog compares the three frameworks side by side, answers the specific questions healthcare startups ask us most about sequencing and audit prep, and explains how KLEAP scopes your compliance requirements, assesses risk from your internal environment to your vendor chain, and closes the gaps a manual penetration test finds before an auditor or a hospital procurement team does.
Why Isn't Knowing HIPAA, SOC 2, and HITRUST Enough?
We have already mentioned in other blogs that HIPAA is the legal floor, SOC 2 is what enterprise procurement asks for, and HITRUST is what the most demanding health systems name in a contract. Knowing that is necessary, but not sufficient.
The question we hear often from organizations is what a hospital procurement team wants to see as proof of HIPAA, despite holding a SOC 2 report. Many misunderstand that HIPAA is a certificate, which it is not.
What you need are the following:
- A documented risk analysis scoped to everywhere PHI actually lives, not just your system boundary.
- A signed Business Associate Agreement with every vendor that touches PHI and probably has a strong and verifiable risk assessment done for your vendors.
- A breach notification process built to HIPAA’s 60-day clock, which SOC 2 does not require at all.
- Evidence against Privacy Rule obligations that most SOC 2 reports never scope in.
While some controls will overlap on their own, what will never happen automatically is the documentation. So, you have to give extra emphasis on that.
The practical problem is that most startups end up solving each piece separately. It’s an easy trap to fall into. You have to treat vendors for HIPAA readiness the same way as you treat vendors for SOC 2 readiness. If you do not, then when you meet vendors for HITRUST, it becomes a difficult task.
Risk assessment should ideally be one and comprehensive enough to be helpful to prepare for any framework. When you conduct three separate risk assessments, gathering three evidence sets that were never built to reference each other – that fragmentation is expensive. By the time a fourth requirement, or a hospital-specific addendum shows up, the startup is paying to redo work it has already spent.
In our experience, the healthcare startups that move through hospital procurement fastest are the ones that never let HIPAA, SOC 2, and HITRUST readiness become three separate entities to begin with.
That urgency compounds fastest for startups that haven’t built any of this yet. New features, new subprocessors, and new PHI flows are added every other week, and none of it is documented anywhere.
Every week that passes without a risk analysis adds to the pressure. And doing it all while the deal is underway makes the whole process slower and costlier than building the same in real time.
That pressure can also quickly spiral out of control. A SOC 2 Type II report needs a six-to-twelve-month observation window before it’s ready for a procurement team. It means a startup that starts scoping the day a hospital asks for one is already six to twelve months behind that deal.
For a startup with no compliance program in place, it isn’t about choosing between HIPAA, SOC 2, and HITRUST. It’s starting the risk analysis that underlies all three. That step doesn’t require the framework decision to be made first, and it’s the same starting point KLEAP scopes for any healthcare startup regardless of where they eventually land on the sequencing.
How Do HIPAA, SOC 2, and HITRUST Compare?
Before deciding what a compliance program should look like, it helps to see the three frameworks side by side.
HIPAA, SOC 2, and HITRUST protect the same data, but they answer different questions for different audiences, which is exactly why treating them as interchangeable is where most healthcare startups run into trouble.
Dimension
What it is
Federal law
AICPA attestation report
Certification against the HITRUST CSF
Who’s Asking
OCR, patients, and regulators.
Enterprise security and procurement teams
Health plans and large health systems that name it in contract
What You Get
No certificate. It is a documented evidence of compliance.
A Type I or Type II attestation report
A pass/fail certificate (e1, i1, or r2)
How Long Does It Last
An ongoing legal duty, not a one-time event
Typically renewed every 6–12 months for Type II
1 year for e1/i1, 2 years with an interim review for r2
Where Does a KLEAP Engagement Start
One risk analysis scoped to every place PHI lives
Ideally, a common risk analysis that cuts across all three. Manual penetration testing can also be performed to find evidence that controls are mapped to your Trust Services Criteria
Tier selection scoped to the specific buyer requirement, not the highest tier available. However, the first step remains a common risk assessment program.
None of this changes the basic order of operations. HIPAA is compulsory for every healthcare startup touching PHI. SOC 2 compliance in healthcare is what helps you get enterprise clients and thus unlocks bigger revenue.
And HITRUST is what the most demanding health systems require by name, which means it’s rarely worth pursuing before a contract actually asks for it. Whether you’re comparing vendors for HIPAA readiness, or for SOC 2 and HITRUST readiness, run your options through the table above.
How Does KLEAP Approach HIPAA, SOC 2, and HITRUST Compliance Together?
KLEAP’s compliance and advisory engagements take the fastest, most defensible route to building durable SOC 2 compliance in healthcare, alongside HIPAA and HITRUST. The goal is to build one control set and one evidence base, then validate it with hands-on testing instead of a questionnaire. That work happens in three parts
1. Scoping Your Compliance Requirements Across All Three Frameworks
Every engagement opens with a scoping conversation, not a template. A dedicated expert maps where PHI is created, received, maintained, and transmitted across your product and infrastructure
They confirm which Trust Services Criteria actually apply to your SOC 2 report and evaluates whether HITRUST is even worth pursuing yet, or whether an e1 makes more sense than jumping straight to an r2. We cover HITRUST tier fit in more depth here.
KLEAP maps HIPAA safeguards to SOC 2 criteria to the relevant HITRUST CSF requirements, so the risk analysis you run feeds every framework you’re pursuing instead of getting rebuilt for each one.
2. Assessing Risk From Your Internal Endpoints to Your Vendor Chain
Risk assessment tells you where you actually stand. KLEAP’s risk assessments cover the full chain: internal endpoints and networks, the applications and APIs that handle PHI, cloud configuration, and the vendors and subprocessors PHI goes to outside your environment.
That last piece matters more than most startups initially budget for. A signed Business Associate Agreement from a cloud provider only covers the infrastructure layer, not the application layer. The assumption that using HIPAA compliant cloud computing platforms is the most expensive misconception in health tech, costing organizations millions in breach remediation, regulatory penalties, and lost enterprise contracts.
Neither HIPAA nor SOC 2 closes that gap automatically. Your vendor chain has to be assessed on its own terms, not assumed to be covered just because a BAA exists. SOC 2 especially requires a vendor risk assessment to be in place.
We’re also direct with clients about what a risk assessment is not. OCR’s Risk Analysis Initiative has resolved twelve enforcement actions to date, and its current guidance is explicit that documentation alone no longer satisfies the rule.
Regulators want evidence that identified risks were actually reduced, not simply filed away. A readiness score from a compliance automation platform is not that evidence.
3. Finding and Fixing Gaps Through Manual Penetration Testing
This is where KLEAP differs most from a platform-only approach. We do not hand over automated scan output repackaged as a compliance deliverable.
Our penetration testing engagements are scoped to the specific systems in your compliance boundary and tested manually, by someone reasoning through your environment the way an attacker would, looking for the broken access control and business logic that scanners routinely miss and that keep showing up in the breach reports OCR investigates.
Every finding is mapped back to the specific HIPAA safeguard, SOC 2 criterion, or HITRUST control it affects, so a single test produces evidence that does triple duty across frameworks instead of three separate deliverables.
And a finding isn’t marked closed because it was reported. We support the remediation and retest cycle so a fix is verified, not assumed. We go deeper on how manual pentesting strengthens a SOC 2 Type II report specifically here.
What Does a KLEAP Compliance Engagement Look Like, Step by Step?
A healthtech company preparing for a first SOC 2 audit while already carrying HIPAA obligations usually wants the same thing: a sequence of the process and a realistic timeline. Here’s roughly how a KLEAP engagement runs, though the exact pace depends on how much of the HIPAA foundation is already in place.
1. Discovery & Framework Scoping
Dedicated expert maps current PHI flows, systems, and any existing certifications. They confirm which SOC 2 type and HITRUST tier actually apply.
1–2 weeks
2. Unified Risk & Vendor Assessment
One risk analysis covering internal endpoints, applications, and vendor/subprocessor exposure, mapped across HIPAA, SOC 2, and HITRUST.
3–5 weeks
3. Manual Penetration Testing & Remediation
Hands-on testing of the in-scope environment. The findings are prioritized, mapped to the controls they affect, and retested after fixes.
4–8 weeks, run alongside control implementation
4. Evidence Package & Audit Support
Policies, control documentation, and pentest evidence assembled into an audit-ready package. The expert coordinates with your CPA firm or HITRUST assessor.
Through the SOC 2 observation window (6–12 months) or HITRUST assessment cycle
5. Post-Audit Monitoring
Dedicated expert stays engaged for vendor changes, and upcoming recertification windows.
Ongoing
For a full breakdown of what a SOC 2 Type II observation period actually demands, our SOC 2 procurement guide walks through it in detail.
What’s different about running that timeline inside a KLEAP engagement is that the knowledge an expert gathered from scoping your requirements in phase one is passed down in the next phases, seamlessly, and more efficiently than if it were to be done by different teams.
How Does KLEAP Lead Compliance Monitoring From a Security Standpoint?
A SOC 2 Type II report and a HITRUST certificate both describe a period that ends. HIPAA never does. That mismatch is where a lot of compliance programs go astray.
After the audit closes, the dedicated attention closes with it, and the next serious look at the environment happens only when the next renewal comes due or, worse, after an incident.
KLEAP treats compliance monitoring as a security function, not paperwork. That means the same expert who built your risk assessment and ran your penetration test stays engaged between formal engagements.
They watch for your product and vendor list changes, flagging when a new PHI flow needs to be brought into scope, and timing remediation work ahead of recertification instead of scrambling for it the month before.
That continuous ownership is what compliance for scaling health-tech startups actually requires. A program built to keep pace as the product, the team, and the vendor list grows.
It’s the difference between a program that reads well on paper and one that would hold up before an OCR investigation.
What Are the Compliance Questions Healthcare Startups Ask Us Most (FAQ)?
The questions below come up in nearly every first conversation we have with a healthtech startups. Here’s how we answer them.
1. We already have SOC 2. What additional controls and documentation would we need to satisfy HIPAA expectations from a hospital procurement team?
A SOC 2 report gets you partway there, not all the way. A hospital procurement team will still want a documented risk analysis scoped to everywhere PHI actually lives, not just your SOC 2 system boundary.
They would also like to see your signed BAAs with every vendor that touches PHI along with a breach notification process built to HIPAA’s 60-day clock.
You will also need to show evidence that you’re meeting the Privacy Rule obligations.
2. How do SOC 2 controls typically map to common healthcare security and privacy requirements like HIPAA?
SOC 2’s Security category, the Common Criteria, overlaps heavily with HIPAA’s technical and administrative safeguards: access control, encryption, audit logging, incident response, and vendor risk management all show up in both.
The mapping breaks down on Privacy. Most SOC 2 reports don’t even include the Privacy category, and none of them satisfy HIPAA’s Privacy Rule requirements around patient access and disclosure. The safer approach is to build one control set mapped to both frameworks rather than treating either as a substitute for the other.
3. What does SOC 2 and HIPAA compliance actually look like for a healthcare startup?
For most healthcare startups, SOC 2 compliance in healthcare and HIPAA aren’t sequential projects. They’re the same underlying environment evaluated by two different audiences. An enterprise security team reviews a SOC 2 report, and a federal regulator enforces HIPAA.
Real compliance for scaling health-tech startups means building one program that satisfies both from the start, instead of retrofitting a SOC 2 layer onto a HIPAA program that was never built with enterprise procurement in mind, or the reverse.
4. I’m building a digital health platform. Between HITRUST, HIPAA, and SOC 2, which certifications should I prioritize to win hospital customers?
HIPAA should come first always. It’s not optional.
SOC 2 should come next, as an enterprise or hospital deal actually depends on it. A SOC 2 Type II is coveted by most procurement teams.
HITRUST comes last for almost every startup, and only once a specific health plan or health system names asks for it specifically. Pursuing an r2 speculatively is one of the more expensive mistakes an early-stage team can make. Our prioritization guide walks through the full sequencing logic.
Where Should You Start?
KLEAP works with digital health platforms, healthtech startups, and healthcare organizations to sequence HIPAA, SOC 2, and HITRUST so that each engagement builds on the last instead of repeating it.
If you already hold a SOC 2 report and are working out what HIPAA still requires, or you’re scoping HITRUST for the first time, the starting point should be a conversation with one dedicated expert who scopes the full picture before recommending an engagement.
KLEAP’s compliance and advisory work and manual penetration testing aren’t sold as separate line items that happen to touch the same client. They’re one engagement, run by one expert, building one body of evidence for SOC 2 compliance in healthcare that holds up whether the person asking is an auditor, a hospital procurement team, or OCR.
For the fundamentals on how HIPAA, SOC 2, and HITRUST relate to each other, our blogs are the place to start. When you’re ready to move from understanding the frameworks to being ready for them, that’s where we come in.
