HIPAA Security Rule to SOC 2 crosswalk

24 control objectives in HIPAA Security Rule and Breach Notification Rule are mapped here to SOC 2 Trust Services Criteria. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	HIPAA Security Rule	SOC 2
Security governance and policies	`164.308(a)(1)(i)`Security management process `164.316(a)`Policies and procedures	`CC1.1`Demonstrates commitment to integrity and ethical values `CC1.2`Board exercises oversight responsibility `CC5.3`Deploys control activities through policies and procedures
Security roles and accountability	`164.308(a)(2)`Assigned security responsibility	`CC1.3`Establishes structure, authority and responsibility `CC1.5`Enforces accountability
Risk assessment and treatment	`164.308(a)(1)(ii)(A)`Risk analysis `164.308(a)(1)(ii)(B)`Risk management	`CC3.1`Specifies suitable objectives `CC3.2`Identifies and analyzes risk `CC3.3`Considers potential for fraud `CC3.4`Identifies and assesses significant changes
Asset and system inventory	`164.310(d)(2)(iii)`Accountability (record of hardware and media movements)	`CC6.1`Logical access security (inventory of information assets is a point of focus)
Data classification and handling	`164.308(a)(1)(ii)(A)`Risk analysis (requires identifying where ePHI lives)	`C1.1`Identifies and maintains confidential information
Access provisioning, review and removal	`164.308(a)(3)`Workforce security (authorization, supervision, termination) `164.308(a)(4)`Information access management	`CC6.2`Registers and authorizes new users prior to issuing credentials `CC6.3`Authorizes, modifies or removes access based on roles
Least privilege and privileged access	`164.312(a)(1)`Access control `164.308(a)(4)`Information access management	`CC6.3`Role-based access and least privilege
Authentication, unique IDs and multi-factor authentication	`164.312(d)`Person or entity authentication `164.312(a)(2)(i)`Unique user identification	`CC6.1`Logical access security software, infrastructure and architectures
Encryption at rest and key management	`164.312(a)(2)(iv)`Encryption and decryption (addressable)	`CC6.1`Logical access security (encryption of data at rest)
Encryption in transit	`164.312(e)(1)`Transmission security	`CC6.7`Restricts transmission, movement and removal of information
Vulnerability scanning and patching	`164.308(a)(8)`Evaluation (periodic technical evaluation)	`CC7.1`Detection and monitoring procedures identify vulnerabilities
Penetration testing and independent assessment	`164.308(a)(8)`Evaluation	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC7.1`Detection and monitoring procedures
Logging, log review and monitoring	`164.312(b)`Audit controls `164.308(a)(1)(ii)(D)`Information system activity review	`CC7.2`Monitors system components for anomalies indicative of malicious acts, natural disasters and errors
Intrusion detection and integrity monitoring	`164.312(c)(1)`Integrity	`CC7.2`Monitors system components for anomalies `CC6.8`Prevents or detects unauthorized or malicious software
Malware protection	`164.308(a)(5)(ii)(B)`Protection from malicious software	`CC6.8`Implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software
Incident response and breach notification	`164.308(a)(6)`Security incident procedures `164.404`Notification to individuals (Breach Notification Rule)	`CC7.3`Evaluates security events to determine whether they are incidents `CC7.4`Responds to identified security incidents `CC7.5`Identifies, develops and implements activities to recover from incidents
Third-party and vendor risk management	`164.308(b)(1)`Business associate contracts and other arrangements `164.314(a)`Business associate contracts or other arrangements	`CC9.2`Assesses and manages risks associated with vendors and business partners
Business continuity and disaster recovery	`164.308(a)(7)`Contingency plan	`CC9.1`Identifies, selects and develops risk mitigation activities for business disruptions `A1.2`Environmental protections, software, data backup processes and recovery infrastructure `A1.3`Tests recovery plan procedures
Backup and redundancy	`164.308(a)(7)(ii)(A)`Data backup plan `164.308(a)(7)(ii)(B)`Disaster recovery plan	`A1.2`Data backup processes and recovery infrastructure
Security awareness and training	`164.308(a)(5)`Security awareness and training	`CC1.4`Demonstrates commitment to attract, develop and retain competent individuals `CC2.2`Internally communicates information necessary to support internal control
Personnel screening, terms and sanctions	`164.308(a)(3)(ii)(B)`Workforce clearance procedure `164.308(a)(3)(ii)(C)`Termination procedures `164.308(a)(1)(ii)(C)`Sanction policy	`CC1.4`Hiring and competence practices `CC6.3`Removes access on termination
Physical access and facility security	`164.310(a)`Facility access controls	`CC6.4`Restricts physical access to facilities and protected information assets
Data retention, media handling and secure disposal	`164.310(d)(2)(i)`Disposal `164.310(d)(2)(ii)`Media re-use	`CC6.5`Discontinues logical and physical protections over assets only after the ability to read or recover data is diminished `C1.2`Disposes of confidential information
Ongoing control monitoring and internal audit	`164.308(a)(8)`Evaluation	`CC4.1`Selects, develops and performs ongoing and/or separate evaluations `CC4.2`Evaluates and communicates internal control deficiencies

Open a control objective for the evidence checklist.SOC 2 to HIPAA Security Rule →

Scope: Citations are to 45 CFR 164. 'Addressable' vs 'required' implementation specifications are not distinguished here. Several themes have no direct HIPAA citation. Security (CC series), Availability (A1) and Confidentiality (C1). Processing Integrity and Privacy are not covered in this dataset version. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from HIPAA Security Rule

HIPAA Security Rule to PCI DSS 4.0 HIPAA Security Rule to NIST CSF 2.0 HIPAA Security Rule to ISO 27001:2022 HIPAA Security Rule to NIST 800-53 r5