Related Terms
PHI
HIPAA
See Also
Security reviews are part of choosing any texting tool. See what makes patient texting compliant
Two-way HIPAA Texting
ABOUT THIS ENTRY
Category Core: Compliance
Reading time: 1 min
Updated: Nov 2026
SOC 2 Type II
Definition
SOC 2 Type II is an independent audit report showing that a service provider's security controls worked as designed over a set period of time, usually 3 to 12 months.
Why the distinction matters
SOC 2 comes from the American Institute of CPAs (AICPA). A licensed CPA firm tests the vendor against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Security is always in scope; the others are added when they apply.
The "Type" matters. A Type I report checks that controls exist on a single date. A Type II report checks that they actually ran, day after day, across the whole review window. For a practice choosing software that will hold patient data, Type II is the stronger signal. It sits alongside a vendor's HIPAA duties.
Example
Before signing with a patient texting vendor, a practice manager asks for its SOC 2 Type II report and a signed BAA. The report shows access reviews, encryption, and incident response were tested over 12 months. Curogram, for example, is SOC 2 Type II certified and HIPAA-compliant.
Frequently Asked
-
Is SOC 2 required for healthcare software?
No law requires it. HIPAA sets the legal rules, and SOC 2 Type II is an outside audit that shows how well a vendor follows its own controls.
-
What's the difference between SOC 2 Type I and Type II?
Type I checks controls at one point in time. Type II tests that they worked over a period, usually several months.
-
How can a practice see a vendor's SOC 2 report?
Ask the vendor. Reports are usually shared under a nondisclosure agreement because they describe internal security details.