Get a SOC 2 that holds up, examined by a CPA firm that works only in healthcare, built into your GRC program, not bolted on once a year.
A SOC 2 report has become table stakes to provide products and services to healthcare entities.
Do any of these sound familiar?
The complication is that a SOC 2 is only as good as the firm behind it, and most of those firms know CPA standards, not healthcare. They can audit your controls without knowing why a downtime procedure for your EHR matters more than the policy describing it, and the report that comes back reads generic where your buyers expected specific.
Meditology partners with your team across the full SOC 2 journey, aligned to the AICPA Trust Services Criteria (TSC), the HIPAA Security Rule, and the HITRUST CSF where controls overlap. We do not hand you a generic, off-the-shelf control set. We work with you to identify the controls that fit your environment, provide education along the way, and recommend remediation you own and operate.
Your starting point determines the path. Two tracks cover both.
We educate your team on what SOC 2 requires, scope the engagement, and run interviews and walkthroughs to understand how your environment really works. Together we establish the appropriate control set, then simulate the examination to show you current controls, control and evidence gaps, and recommended remediation.
We provide evidence-tracking templates, a documentation structure, and advisory guidance so your team closes gaps. This phase includes ongoing testing of remediation items and creation of your system description. If you want a point-in-time milestone, Meditology Assurance can issue a SOC 2 Type 1 report (control design at a point in time).
Meditology Assurance issues a SOC 2 Type 2 report on the design and operating effectiveness of your controls over a defined period, the artifact your customers and their auditors accept.
Year 1 typically covers readiness, remediation, and Type 1. Year 2 and beyond covers the recurring Type 2.
We review your existing control set and prior report, recommend updates as needed, and discuss scope changes (added systems, new commitments, additional criteria). When the gap warrants it, we add an optional mini-readiness to close it before testing begins.
Meditology Assurance issues the recurring SOC 2 Type 2 report.
Security (also known as the Common Criteria) is required on every engagement. Availability, Confidentiality, Processing Integrity, and Privacy are add-on TSC categories, optional and scoped to the commitments you make to your customers.
Understanding your service commitments and system requirements is a critical first step in any SOC 2 examination.
Most firms that issue SOC 2 reports are industry-agnostic CPA firms. Most healthcare security specialists are advisors who cannot issue the report at all. Meditology Assurance sits in the overlap: a licensed CPA firm working only in healthcare, and a certified HITRUST External Assessor.
That combination is the practical difference. Your examination is scoped around EHR and clinical system carve-outs by people who have done it before, rather than by auditors learning your environment on your budget. Many SOC 2 security controls also demonstrate HIPAA compliance, so one control effort serves both.
A SOC 2 is an examination that provides an auditor’s opinion on the design of specific controls at a point in time (Type 1) or the design and operating effectiveness of those controls over a period of time (Type 2). The controls map to the AICPA Trust Services Criteria.
Type 1 reports on control design at a point in time. Type 2 reports on design and operating effectiveness over a defined period.
No. A clean opinion reflects the controls you design and operate. Meditology prepares you so the examination holds no surprises, and keeps the advisory and examination roles properly separated.
Yes. We review your existing control set and prior report, recommend updates, discuss scope changes, and add an optional mini-readiness if needed, then move into the recurring Type 2 examination.
Yes. The same control library answers both. Evidence collected once earns credit across mapped frameworks, and many SOC 2 security controls also demonstrate HIPAA compliance.
Management owns control design and operation. People from compliance, IT, and information security provide evidence and join interviews and walkthroughs, and your application development team may contribute change-management and SDLC detail.
Timeline and cost depend on the criteria in scope, control maturity, evidence readiness, the systems in scope, Type 1 versus Type 2, and the reporting period.
After the first SOC 2 Type 2 examination, the audit is performed every 12 months.
Book a 30-minute conversation to scope your SOC 2 path and where HITRUST can ride along.
