SOC 2 Type II requirements for healthcare data: what carriers should ask of a benefits technology vendor

When a carrier brings on a benefits technology vendor to handle member data or broker request-for-proposal (RFP) documents, the carrier's vendor team needs evidence of how the vendor protects that data. A SOC 2 (System and Organization Controls 2) Type II report provides that evidence: an independent accounting firm tests whether the vendor's controls worked as designed over a set period, generally six, nine, or 12 months. A vendor that meets SOC 2 Type II requirements for healthcare data has passed that test and can share the report with the carrier during the review.¹

Carriers run this review because state insurance law and the Health Insurance Portability and Accountability Act (HIPAA) for health lines make vendor oversight part of a carrier's own obligations. The National Association of Insurance Commissioners (NAIC) Insurance Data Security Model Law, adopted in 28 jurisdictions, applies to insurers and includes oversight of third-party service providers. On health lines, HIPAA requires a covered entity to obtain "satisfactory assurances" from any business associate that handles its electronic protected health information.^{2, 3}

That oversight matters more now because Verizon's 2026 Data Breach Investigations Report found a third party involved in 48% of breaches, up 60% from the year before. When nearly half of breaches involve a third party, the SOC 2 Type II report a vendor hands over deserves a careful read, and a careful read starts with knowing what the report contains.⁴

What are SOC 2 Type II requirements for healthcare data?

The requirements behind a SOC 2 Type II report are the trust services criteria published by the American Institute of Certified Public Accountants (AICPA), the body that defines SOC reporting. An independent accounting firm uses those criteria to test a vendor's controls across up to five categories: security, availability, processing integrity, confidentiality, and privacy. The Type II version of the report adds a test of whether those controls operated effectively over a period of time. For healthcare data, a carrier pairs the report with HIPAA's requirements, which are covered later in this post.⁵

A report can cover one or more of the five categories, so the categories named in the report are worth comparing against the data the vendor will hold.

Beyond the list of categories, a SOC 2 Type II report includes three parts that explain what the auditor examined and found:

• System description. The scope of the audit, meaning the product, systems, and controls the auditor evaluated.
• Tests and results. Each control the auditor tested and the result of that test.
• Auditor's opinion. A formal statement on whether the system description is accurate and whether the controls were designed and operated effectively.

How far the auditor's opinion reaches depends on whether the report is a Type I or a Type II.

SOC 2 Type I vs Type II: what's the difference?

A SOC 2 Type I report looks at how a vendor's controls were designed as of a single date, while a Type II report looks at the same design and then tests whether the controls operated that way over a period of time. Most Type II periods run six, nine, or 12 months, and 12 months is the most common.¹

For a carrier, the Type II report gives the fuller picture, because it tests whether the vendor's controls kept working across months of day-to-day use rather than on one date.

With the Type II report in hand, the next question in the review is how that report relates to HIPAA, which sets its own rules for protected health information.

SOC 2 vs HIPAA: what's the difference for carriers?

SOC 2 and HIPAA cover different ground in a carrier's review, because SOC 2 Type II is an independent audit of how a vendor's controls performed, while HIPAA is a federal law that sets requirements for protecting health information. HIPAA's Security Rule requires covered entities and business associates to perform a periodic technical and nontechnical evaluation of their safeguards, and the rule doesn't set up a certification of its own.

When a carrier is a HIPAA covered entity, HIPAA reaches its vendors through the business associate relationship. A business associate is a person or company that creates, receives, maintains, or transmits protected health information on a covered entity's behalf, and the covered entity has to obtain "satisfactory assurances" that the business associate will safeguard that information.⁶

A business associate agreement is the contract that carries those assurances, and a SOC 2 Type II report is the independent evidence of how the vendor's controls performed, so the two documents cover different parts of the same review.

Does HIPAA apply to every carrier line?

HIPAA's definition of a health plan includes health insurance issuers and issuers of long-term care policies, which places a carrier's medical and long-term care lines under HIPAA. The same definition excludes excepted benefits, so a carrier's disability and accident lines fall outside HIPAA's health plan definition.⁶

Those lines still come with vendor oversight duties, because the NAIC model law covered in the next section applies to insurers themselves.

Why do insurance carriers require SOC 2 Type II from vendors?

Twenty-eight jurisdictions have adopted the NAIC's Insurance Data Security Model Law, which applies to insurers, insurance agents, and other entities licensed by a state department of insurance. The model law phases in requirements for an information security program and for oversight of third-party service providers, which is where a vendor's SOC 2 Type II report comes into a carrier's review.²

New York spells out vendor oversight in more detail. Under the New York Department of Financial Services cybersecurity regulation (23 NYCRR 500.11), covered entities need written policies for identifying and assessing the risk of third-party service providers, setting minimum cybersecurity practices for them, running due diligence on those practices, and assessing providers periodically based on the risk they present.⁷

On health lines, HHS has proposed a higher bar for business associates. The December 2024 proposal to update the HIPAA Security Rule would require business associates to verify their technical safeguards at least once every 12 months through a written analysis by a subject matter expert, along with a written certification that the analysis is accurate. HHS hasn't finalized the rule.⁸

Recent breach data puts numbers to vendor risk for insurers. Verizon's 2026 report found third-party involvement in 34% of breaches in the financial and insurance sector.⁴

With the oversight duty sitting with the carrier, the next step is reading the vendor's report closely, and the next section covers the six things to check.

What should carriers check in a vendor's SOC 2 Type II report?

A carrier reviewing a vendor's SOC 2 Type II report can check six things, and each one shows something different about the vendor's controls.

• Report type and period. A Type II report shows how controls worked over its review period, and the end date of that period shows how current the findings are.
• Categories covered. The categories listed in the report show which of the five areas the auditor tested, which makes them worth comparing against the data the vendor will hold.
• Scope in the system description. The system description lays out the scope and controls the auditor evaluated, so it confirms whether the product the carrier is buying sits inside the audit.
• Test results. The tests of controls section lists each control the auditor tested and the result, including any control that didn't operate as described.
• Complementary user entity controls. These are the controls the vendor expects its customers to run on their side, documented in the system description, so they show which responsibilities stay with the carrier.
• Business associate agreement. For health lines that involve protected health information, a business associate agreement carries the HIPAA assurances a SOC 2 report doesn't, so the two documents belong in the same review.

How Pasito meets SOC 2 Type II and HIPAA requirements

Pasito holds a SOC 2 Type II certification, independently audited across security, availability, and confidentiality. An outside firm, Prescient Assurance, runs our audit every year. Our most recent report covers January 2, 2025 to January 2, 2026, and we've held SOC 2 for more than four years.

On the HIPAA side, we maintain physical, technical, and administrative safeguards for protected health information and sign business associate agreements where applicable. All data is encrypted with AES-256 at rest and TLS 1.2+ in transit, and our Zero Data Retention contracts with LLM providers mean no client data is used to train models. We broke down how our AI works within those safeguards in an earlier post.

For carriers, that data includes member information in a benefits decision support tool that helps members identify best-fit plans based on preset demographic information, and broker RFP documents in RFP Intake, where AI analyzes the RFP documents a carrier receives and notes errors and missing data.

What to take away

A SOC 2 Type II report gives a carrier independent evidence of how a vendor's controls performed, and HIPAA and state insurance law are the reasons that review sits with the carrier. A practical next step is to request each vendor's most recent SOC 2 Type II report, along with a business associate agreement for any health lines, and read both against the six things above before member data moves. Carriers evaluating Pasito can request our SOC 2 report on our security page.

FAQ

Is SOC 2 required for HIPAA compliance?

HIPAA doesn't name SOC 2. The Security Rule requires periodic evaluations of safeguards and satisfactory assurances from business associates, and a SOC 2 Type II report is one form of independent evidence a vendor can provide.

What's the difference between SOC 2 and HIPAA?

SOC 2 is an independent audit of a vendor's controls against the AICPA's trust services criteria, and HIPAA is a federal law that sets requirements for protecting health information.

How long does a SOC 2 Type II audit period cover?

Type II periods generally run six, nine, or 12 months, and 12 months is the most common.

Does HIPAA apply to disability insurance carriers?

HIPAA's health plan definition excludes coverage only for accident or disability income insurance, so those lines fall outside it, though state insurance data security law still applies to insurers.

What are complementary user entity controls?

Complementary user entity controls are the controls a vendor expects its customers to perform, listed in the vendor's system description.

References

1. Linford & Co, "SOC 2 Type 2 reports: A comprehensive guide," May 22, 2024. https://linfordco.com/blog/soc-2-type-2-report/
2. National Association of Insurance Commissioners, "Insurance Data Security Model Law" government affairs brief, August 2025. https://content.naic.org/sites/default/files/government-affairs-brief-data-security-model-law.pdf
3. 45 CFR 164.308(a)(8) and (b)(1), Electronic Code of Federal Regulations, current as of October 16, 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
4. Verizon, "2026 Data Breach Investigations Report: Executive summary," 2026. https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
5. AICPA, "2017 Trust Services Criteria (With Revised Points of Focus, 2022)." https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
6. 45 CFR 160.103, Electronic Code of Federal Regulations, current as of October 16, 2026. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
7. 23 NYCRR 500.11, "Third-party service provider security policy," amended November 1, 2023. https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.11
8. U.S. Department of Health and Human Services, "HIPAA Security Rule Notice of Proposed Rulemaking to Strengthen Cybersecurity for Electronic Protected Health Information" fact sheet, December 27, 2024. https://hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet

‍

‍

‍