HIPAA to SOC 2 and NIST CSF 2.0 crosswalk

What HIPAA does not prepare you for

These are the SOC 2 criteria with no meaningful counterpart in the Security Rule. They are mostly governance and change management rather than security technology, which is why they surprise people: an organization with genuinely good security controls can still be a long way from a SOC 2 report.

CC1.2

Board or governing body oversight of internal control. HIPAA names a security official but says nothing about who oversees them.

CC2.3

Communication with external parties about the system and its controls. HIPAA's external communication duties are about breach notification, not about describing your controls.

CC3.1

Specifying objectives clearly enough to identify risks to them. HIPAA fixes the objective for you, so nobody has had to write one down.

CC3.3

Consideration of the potential for fraud. Outside the Security Rule entirely.

CC3.4

Identifying and assessing changes that could affect internal control.

CC5.2

General control activities over technology. HIPAA implies these; SOC 2 tests them as a distinct set.

CC7.1

Detecting configuration changes and scanning for vulnerabilities. HIPAA requires periodic evaluation but not continuous detection.

CC8.1

Change management — authorizing, designing, testing and approving changes. The single most common gap for an organization coming from HIPAA, and the one that takes longest to build.

Common questions

Does HIPAA compliance count toward SOC 2?

The evidence overlaps substantially; the assessments do not. Your risk analysis, access control records, training records, vendor agreements and incident procedures all produce artifacts a service auditor will want to see. What HIPAA does not give you is proof of how each control operated across a period, which is the whole basis of a SOC 2 Type II opinion — and it says nothing about change management, board oversight or fraud consideration, which SOC 2 tests directly.

What is the biggest gap between HIPAA and SOC 2?

Change management. SOC 2's CC8.1 asks how changes to infrastructure, data and software are authorized, designed, tested, approved and implemented, and the Security Rule has no real counterpart — so it is almost never in place at an organization arriving from HIPAA, and it is the slowest of the gaps to build because it is a working practice rather than a document.

Is NIST CSF the same as the HIPAA Security Rule?

No, but they are close relatives. HHS itself has published crosswalk material between the Security Rule and the NIST framework, and the proposed Security Rule overhaul leans further toward NIST-style specificity. CSF 2.0 is broader — it adds a Govern function covering roles, policy and supply chain that HIPAA touches only lightly — and it is voluntary guidance rather than a regulation.

Can I use this mapping in an audit?

Not as evidence, no. It is an orientation aid for working out what you already have. A service auditor scopes criteria against your own system description and the commitments you make to your customers, not against a published table — and no mapping can tell them whether your control operated effectively. Use it to plan; expect your auditor to derive their own.

A planning aid based on the AICPA 2017 trust services criteria and NIST CSF 2.0, offered as general information rather than legal advice. Mapping a HIPAA control to a criterion does not mean satisfying one satisfies the other, and no published table substitutes for the scoping your own service auditor will do.