SOC 2 is an attestation report in which an independent CPA firm examines a vendor's controls against the AICPA Trust Services Criteria — security, and optionally availability, confidentiality, processing integrity, and privacy. Two report types exist and the difference is material: a Type I describes whether controls are suitably designed at a single point in time, while a Type II tests whether those controls actually operated effectively over a period of months. A Type II is the one that demonstrates the controls were not just on paper but lived day to day, which is why enterprise buyers ask for it specifically.
For a telemedicine vendor SOC 2 does double duty. Hospital procurement and partner diligence request it routinely as a baseline trust artifact, so having one removes a recurring sales obstacle. And the program you run to earn it — risk assessments, access reviews, change management, monitoring — produces much of the evidence your HIPAA Security Rule risk-management story needs anyway, so the effort is not wasted on a single checkbox.
The critical caveat is that SOC 2 is not a substitute for HIPAA compliance; it is evidence that sits alongside it. The two ask overlapping but distinct questions, and a SOC 2 report does not by itself prove you meet the HIPAA Security and Privacy Rules. The common mistake is reading the logo instead of the report. The truth lives in the details — the scope (which systems were actually covered), the listed exceptions (where controls failed during the period), and any carve-outs for subservice organizations. A clean-looking report with a narrow scope can mean very little; always read the scope and exceptions sections.
The handbook · 7 volumes
Fora Soft Video Engineering Handbook
SOC 2 is the report hospital buyers ask for in due diligence, though it does not replace HIPAA. We cover the whole video stack in seven volumes; for teams preparing SOC 2 for a video product start with Volume 7: compliance, production serving and infrastructure. Volume 3 covers WebRTC, CDNs and DRM; Volume 1 covers video encoding. Written by Nikolay Sapunov, CEO at Fora Soft.
Hospital buyers asking for SOC 2 before signing your telehealth platform?
We will review the controls in your video infrastructure and give you a gap list and engineering plan to get SOC 2 evidence ready. 250+ video products shipped since 2005.
