---
title: "Compliance Audit Cheat Sheet: Does your HIPAA have a SOC 2?"
description: "There are multiple audits that a Business Associate might have: HIPAA, SOC 2, SOC 1, SSAE 16. What do they all mean?"
image: https://web.otava.com/hs-fs/hub/390445/file-1346596626.jpg
---

Call Today 1-734-213-2020

- [Events](http://onlinetech.com/events)
- [Support](http://onlinetech.com/support)
- [OTPortal](https://customer.onlinetech.com/CustomerLogin.aspx)
- [Company](http://onlinetech.com/company/overview)
- [News](http://onlinetech.com/news/overview)
- [Resources](http://onlinetech.com/resources/overview)
- [Blog](http://resource.onlinetech.com/)
- [Contact](http://onlinetech.com/contact)

[![twitter](https://web.otava.com/hs-fs/file-1181652072-png/Images/twitter.png)](http://twitter.com/onlinetech)[![linkedin](https://web.otava.com/hs-fs/file-1181371560-png/Images/linkedin.png)](http://www.linkedin.com/company/online-tech?trk=fc_badge)

[![OnLINE TECH](https://web.otava.com/hs-fs/file-1190669575-png/Images/logo-new.png "OnLINE TECH")](http://onlinetech.com/)

- [Home](http://onlinetech.com/)
- [Colocation](http://onlinetech.com/colocation/overview) 
    - [Overview](http://onlinetech.com/colocation/overview)
    - [Locations](http://onlinetech.com/colocation/locations)
    - [Packages](http://onlinetech.com/colocation/packages)
    - [Features](http://onlinetech.com/colocation/features)
    - [Resources](http://onlinetech.com/colocation/resources)
    - [Quote](http://onlinetech.com/colocation/quote)
    - [Rack and Stack](http://onlinetech.com/colocation/rack-and-stack)
- [Managed Servers](http://onlinetech.com/managed-dedicated-servers/overview) 
    - [Overview](http://onlinetech.com/managed-dedicated-servers/overview)
    - [Packages](http://onlinetech.com/managed-dedicated-servers/overview)
    - [Features](http://onlinetech.com/managed-dedicated-servers/features)
    - [Resources](http://onlinetech.com/managed-dedicated-servers/resources)
    - [Quote](http://onlinetech.com/managed-dedicated-servers/quote)
- [Cloud](http://onlinetech.com/cloud-computing-hosting/overview) 
    - [Overview](http://onlinetech.com/cloud-computing-hosting/overview)
    - [Packages](http://onlinetech.com/cloud-computing-hosting/packages)
    - [Features](http://onlinetech.com/cloud-computing-hosting/features)
    - [Resources](http://onlinetech.com/cloud-computing-hosting/resources)
    - [Quote](http://onlinetech.com/cloud-computing-hosting/quote)
- [Managed Services](http://onlinetech.com/managed-services/overview) 
    - [Overview](http://onlinetech.com/managed-services/overview)
    - [IT Disaster Recovery](http://onlinetech.com/managed-services/it-disaster-recovery)
    - [Offsite Backup](http://onlinetech.com/managed-services/offsite-backup)
    - [OTMonitor](http://onlinetech.com/managed-services/remote-server-monitoring)
    - [OTManage](http://onlinetech.com/managed-services/colocation-management)
    - [OTPortal](http://onlinetech.com/managed-services/client-hosting-portal)
    - [Managed SAN Hosting](http://onlinetech.com/managed-services/managed-san-hosting)
- [Compliant Hosting](http://onlinetech.com/compliant-hosting/overview) 
    - [Overview](http://onlinetech.com/compliant-hosting/overview)
    - [PCI Compliant Hosting](http://onlinetech.com/compliant-hosting/pci-compliant-hosting/overview)
    - [HIPAA Compliant Hosting](http://onlinetech.com/compliant-hosting/hipaa-compliant-hosting/overview)
    - [SOX Compliant Hosting](http://onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting)
    - [Safe Harbor Compliant Hosting](http://onlinetech.com/compliant-hosting/safe-harbor-compliant-hosting)
    - [Quote](http://onlinetech.com/compliant-hosting/quote)
- [Secure Hosting](http://onlinetech.com/secure-hosting/overview) 
    - [Overview](http://onlinetech.com/secure-hosting/overview)
    - [Technical Security](http://onlinetech.com/secure-hosting/technical-security)
    - [Physical Security](http://onlinetech.com/secure-hosting/physical-security)
    - [Administrative Security](http://onlinetech.com/secure-hosting/administrative-security)
    - [Defense in Depth](http://onlinetech.com/secure-hosting/defense-in-depth)

# OT Blog

We are a community of IT professionals.

[![mobile-securtiy-whitepaper-banner-module-graphic](https://web.otava.com/hs-fs/file-1200369117-png/Images/mobile-securtiy-whitepaper-banner-module-graphic.png "mobile-securtiy-whitepaper-banner-module-graphic")](http://www.onlinetech.com/resources/white-papers/mobile-security)

- [![Overview](https://web.otava.com/hs-fs/file-1200848795-png/Images/icon_newsletter.png)All Posts](http://resource.onlinetech.com)
- [![Quote](https://web.otava.com/hs-fs/file-1194859824-png/Images/icon_hipaa.png)HIPAA Compliance](http://resource.onlinetech.com/category/hipaa-compliance-2/)
- [![Locations](https://web.otava.com/hs-fs/file-1200954737-png/Images/icon_pci.png)PCI Compliance](http://resource.onlinetech.com/category/pci-compliance-2/)
- [![Features](https://web.otava.com/hs-fs/file-1200893870-png/Images/icon_cloud.png)Cloud Computing](http://resource.onlinetech.com/category/cloud-computing/)
- [![Resources](https://web.otava.com/hs-fs/file-1200893840-png/Images/icon_disaster_recovery.png)Disaster Recovery](http://resource.onlinetech.com/category/disaster-recovery-trends/)
- [![CEO Voices](https://web.otava.com/hs-fs/file-1200893845-png/Images/icon_the_team.png)CEO Voices](http://resource.onlinetech.com/category/ceo-voices)
- [![Data Centers](https://web.otava.com/hs-fs/file-1194859849-png/Images/icon_data_centers.png)Data Centers](http://resource.onlinetech.com/category/data-centers)

## [Compliance Audit Cheat Sheet: Does your HIPAA have a SOC 2?](https://web.otava.com/blog/compliance-audit-cheat-sheet-does-your-hipaa-have-a-soc-2)

Posted on [July 29, 2014](https://web.otava.com/blog/compliance-audit-cheat-sheet-does-your-hipaa-have-a-soc-2) by [April Sage](https://web.otava.com/blog/author/april-sage)

Wondering where all these standards come from and what they all mean? Here’s a guide to some common data center audits and reports.

![compliance](https://web.otava.com/hs-fs/hub/390445/file-1346596626.jpg "compliance")

**[Safe Harbor](http://www.onlinetech.com/compliant-hosting/safe-harbor-compliant-hosting)**  
What is the U.S.-EU Safe Harbor Law? The U.S.-European Union Safe Harbor Program is a streamlined process for US companies to comply with the EU Data Protection Directive of 1998 on maintaining the privacy and integrity of personal data. Different from HIPAA, PCI and SOX compliance requirements, the Safe Harbor program framework was developed by the U.S. Department of Commerce in 2000 in consultation with the European Commission on Data Protection.

***Recommended Reading:***  
[Safe Harbor Compliant Hosting](http://www.onlinetech.com/compliant-hosting/safe-harbor-compliant-hosting)  
[US - EU Safe Harbor Program](http://www.export.gov/safeharbor/)

**[SAS 70](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/sas-70-hosting)**  
The Statement on Auditing Standard No. 70 was the original audit to measure a data center’s financial reporting and recordkeeping controls. Developed by the AICPA (American Institute of CPAs, there two types:

- **Type 1 – **Reports on a company's description of their operational controls
- **Type 2 – **Reports on an auditor's opinion on how effective these controls are over a specified period of time (six months)

**[SSAE 16](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/ssae-16-hosting)**  
The Statement on Standards for Attestation Engagements No. 16 replaced SAS 70 in June 2011. A SSAE 16 audit measures the controls relevant to financial reporting.

- **Type 1** – A data center’s description and assertion of controls, as reported by the company.
- **Type 2 – **Auditors test the accuracy of the controls and the implementation and effectiveness of controls over a specified period of time.

**[SOC 1](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/soc-1-hosting)**  
The first of three new Service Organization Controls reports developed by the AICPA, this report measures the controls of a data center as relevant to financial reporting. It is essentially the same as a SSAE 16 audit.

**[SOC 2](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/soc-2-a-soc-3-hosting)**  
This report and audit is completely different from the previous. SOC 2 measures controls specifically related to IT and data center service providers. The five controls are security, availability, processing integrity (ensuring system accuracy, completion and authorization), confidentiality and privacy. There are two types:

- **Type 1** – A data center’s system and suitability of its design of controls, as reported by the company.
- **Type 2 **– Includes everything in Type 1, with the addition of verification of an auditor's opinion on the operating effectiveness of the controls.

**[SOC 3](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/soc-3-hosting)**  
This report includes the auditor’s opinion of SOC 2 components with an additional seal of approval to be used on websites and other documents. The report is less detailed and technical than a SOC 2 report.

***Recommended Reading:***  
[A SOC of A Different Color: Critical Differences Between SOC 2 and SOC 1/SSAE 16](http://resource.onlinetech.com/a-soc-of-a-different-color-critical-differences-between-soc-2-and-soc-1ssae-16/)  
[What’s the Difference Between SAS 70, SSAE 16 and SOC?](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/sas-70-ssae-16-and-soc-comparison)

**[HIPAA](http://www.onlinetech.com/compliant-hosting/hipaa-compliant-hosting)**  
Mandated by the U.S. Health and Human Services Dept., the Health Insurance Portability and Accountability Act of 1996 specifies laws to secure protected health information (PHI), or patient health data (medical records). When it comes to data centers, a hosting provider needs to meet HIPAA compliance in order to ensure sensitive patient information is protected. A HIPAA audit conducted by an independent auditor against the OCR HIPAA Audit Protocol can provide a documented report to prove a business associate providing services to healthcare providers has the proper policies and procedures in place to protect patient data. No other audit or report can provide evidence of full HIPAA compliance.

***Recommended Reading:***  
[HIPAA Compliant Hosting White Paper](http://www.onlinetech.com/resources/white-papers/hipaa-compliant-data-centers) (Complete list of technical, physical and administrative hosting requirements).  
[Five Questions to Ask Your HIPAA Hosting Provider](http://www.onlinetech.com/resources/e-tips/hipaa-compliance/five-questions-to-ask-your-hipaa-hosting-provider)  
[Encrypting Data to Meet HIPAA Compliance](http://resource.onlinetech.com/encrypting-data-to-meet-hipaa-compliance/)

[![Watch webinar: HIPAA, HITECH & the Law](https://no-cache.hubspot.com/cta/default/390445/68476aab-4f3a-4dbd-8f97-3e84996d3260.png)](https://cta-redirect.hubspot.com/cta/redirect/390445/68476aab-4f3a-4dbd-8f97-3e84996d3260)

**[PCI DSS](http://www.onlinetech.com/compliant-hosting/pci-compliant-hosting)**  
The Payment Card Industry Data Security Standard was created by the major credit card issuers, and applies to companies that accept, store process and transmit credit cardholder data. When it comes to data center operators, they should prove they have a PCI compliant environment with an independent audit. They should also know what services can help your company fulfill the [12 PCI requirements](http://www.onlinetech.com/compliant-hosting/pci-compliant-hosting/resources/what-is-pci-compliance).

***Recommended Reading:***  
[PCI Compliant Hosting White Paper](http://www.onlinetech.com/resources/white-papers/pci-compliant-data-centers) (Complete list of technical, physical and administrative hosting requirements).  
[PCI Compliance and Virtualization: New Recommendations](http://resource.onlinetech.com/pci-compliance-and-virtualization-new-recommendations/)  
[Guide to Becoming PCI Compliant: Build and Maintain a Secure Network](http://resource.onlinetech.com/guide-to-becoming-pci-compliant-build-and-maintain-a-secure-network/)  
[Guide to Becoming PCI Compliant: Protect Cardholder Data](http://resource.onlinetech.com/guide-to-becoming-pci-compliant-protect-cardholder-data/)

[![Watch webinar: PCI Guidance for the Cloud](https://no-cache.hubspot.com/cta/default/390445/39922c4e-ded5-4a64-b0f9-2a9a437268da.png)](https://cta-redirect.hubspot.com/cta/redirect/390445/39922c4e-ded5-4a64-b0f9-2a9a437268da)

What questions do you have about audits? Leave a comment below and we'll answer it in a future post.

- [Tweet](https://twitter.com/share)

 This entry was posted in [Audits](https://web.otava.com/blog/topic/audits)

### Follow Us

<https://www.youtube.com/user/OnlineTechDataCenter?sub_confirmation=1><https://twitter.com/OtavaLLC><https://www.linkedin.com/company/14060381>

### White Papers

 View a list of our [white papers](http://www.onlinetech.com/resources/white-papers):

- [Encryption of Cloud Data](http://www.onlinetech.com/resources/white-papers/encryption-of-cloud-data)
- [HIPAA Compliant Hosting](http://www.onlinetech.com/resources/white-papers/hipaa-compliant-data-centers)
- [PCI Compliant Hosting](http://www.onlinetech.com/resources/white-papers/pci-compliant-data-centers)
- [Disaster Recovery](http://www.onlinetech.com/resources/white-papers/disaster-recovery)
- [Mobile Security](http://www.onlinetech.com/resources/white-papers/mobile-security)

Search for:

### Want to stay informed on all things Online Tech?

Sign up to receive compliant and secure hosting resources now!

View our [Privacy Policy](http://www.onlinetech.com/site-resources/privacy-policy).

### Subscribe to Email Updates

### Informative Videos

[![Data Center Carbon Footprint](http://i.ytimg.com/vi/RlGuz4HURkc/hqdefault.jpg) Data Center Industry Lowers Carbon Footprint: Watch Video»](http://www.onlinetech.com/resources/wiki/data-centers/how-the-data-center-industry-lowers-the-carbon-footprint) [![Mobile Data Centers](http://i.ytimg.com/vi/2egqPGQrmKY/hqdefault.jpg) Mobile Data Centers: Watch Video »](http://www.onlinetech.com/resources/wiki/data-centers/after-the-cloud-what-next-mobile-technology-in-data-centers) [![Private Cloud](http://i.ytimg.com/vi/B0GwEDGCF6Y/hqdefault.jpg) Switch to the Private Cloud: Watch Video »](http://www.onlinetech.com/resources/wiki/data-centers/the-big-switch-to-managed-services-and-private-cloud)

### Categories

- [Cybersecurity (5)](https://web.otava.com/blog/topic/cybersecurity)
- [General IT (3)](https://web.otava.com/blog/topic/general-it)
- [HIPAA (2)](https://web.otava.com/blog/topic/hipaa)
- [Audits (1)](https://web.otava.com/blog/topic/audits)

### About Online Tech

[Online Tech](http://www.onlinetech.com/) is the leader in [secure, compliant hosting services](http://www.onlinetech.com/compliant-hosting/overview) including [private cloud hosting](http://www.onlinetech.com/cloud-computing-hosting/packages/private-cloud), [managed cloud hosting](http://www.onlinetech.com/cloud-computing-hosting/packages/managed-cloud), [hybrid cloud hosting](http://www.onlinetech.com/cloud-computing-hosting/packages/hybrid-cloud-hosting), [managed dedicated servers](http://www.onlinetech.com/managed-dedicated-servers/packages/basic-managed-server), [disaster recovery](http://www.onlinetech.com/managed-services/it-disaster-recovery/it-disaster-recovery-case-studies), [offsite backup](http://www.onlinetech.com/managed-services/it-disaster-recovery/offsite-backup) services, and [Michigan colocation.](http://www.onlinetech.com/colocation/overview)

Online Tech’s Midwest data centers assure mission critical applications are always available, comply with government & industry regulations, and continue operating after a disaster.

Backed by independent [HIPAA](http://www.onlinetech.com/compliant-hosting/hipaa-compliant-hosting/overview), [PCI](http://www.onlinetech.com/compliant-hosting/pci-compliant-hosting/overview), [SAS 70](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/sas-70-hosting), [SSAE 16](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/ssae-16-hosting), [SOC 2](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/soc-2-a-soc-3-hosting), and [SOC 3](http://www.onlinetech.com/compliant-hosting/sarbanes-oxley-sox-compliant-hosting/soc-3-hosting) audits, Online Tech delivers the security, privacy, and availability expected from world class data center operators.

For more information, call (734) 213-2020 or email [contactus@onlinetech.com](mailto:contactus@onlinetech.com).

- [![footer_dell_logo](https://web.otava.com/hs-fs/file-1193999208-gif/Images/img_trans.gif?width=30&height=30&name=img_trans.gif)](http://onlinetech.com/company/online-tech-partners)
- [![footer_fortinet_logo](https://web.otava.com/hs-fs/file-1193999208-gif/Images/img_trans.gif?width=126&height=15&name=img_trans.gif)](http://onlinetech.com/company/online-tech-partners)
- [![Managed VMware Logo](https://web.otava.com/hs-fs/file-1193999208-gif/Images/img_trans.gif?width=115&height=30&name=img_trans.gif)](http://onlinetech.com/company/online-tech-partners)
- [![RedHat Dedicated Server Logo](https://web.otava.com/hs-fs/file-1193999208-gif/Images/img_trans.gif?width=30&height=30&name=img_trans.gif)](http://onlinetech.com/company/online-tech-partners)
- [![CentOS Dedicated Server Logo](https://web.otava.com/hs-fs/file-1193999208-gif/Images/img_trans.gif?width=115&height=30&name=img_trans.gif)](http://www.onlinetech.com/company/online-tech-partners)
- [![Microsoft Logo](https://web.otava.com/hs-fs/file-1193999208-gif/Images/img_trans.gif?width=115&height=30&name=img_trans.gif)](http://onlinetech.com/company/online-tech-partners)
- [![Cisco Logo](https://web.otava.com/hs-fs/file-1193999208-gif/Images/img_trans.gif?width=49&height=30&name=img_trans.gif)](http://onlinetech.com/company/online-tech-partners)

## [Colocation](http://onlinetech.com/colocation/overview)

- [Overview](http://www.onlinetech.com/colocation/overview)
- [Locations](http://www.onlinetech.com/colocation/locations)
- [Packages](http://www.onlinetech.com/colocation/packages)
- [Features](http://www.onlinetech.com/colocation/features)
- [Resources](http://www.onlinetech.com/colocation/resources)
- [Quote](http://www.onlinetech.com/colocation/quote)

## [Managed Servers](http://onlinetech.com/managed-dedicated-servers/overview)

- [Overview](http://onlinetech.com/managed-dedicated-servers/overview)
- [Packages](http://onlinetech.com/managed-dedicated-servers/packages)
- [Features](http://onlinetech.com/managed-dedicated-servers/features)
- [Resources](http://onlinetech.com/managed-dedicated-servers/resources)
- [Quote](http://onlinetech.com/managed-dedicated-servers/quote)

## [Cloud Hosting](http://onlinetech.com/cloud-computing-hosting/overview)

- [Overview](http://onlinetech.com/cloud-computing-hosting/overview)
- [Packages](http://onlinetech.com/cloud-computing-hosting/packages)
- [Features](http://onlinetech.com/cloud-computing-hosting/features)
- [Resources](http://onlinetech.com/cloud-computing-hosting/resources)
- [Quote](http://onlinetech.com/cloud-computing-hosting/quote)

## [Managed Services](http://onlinetech.com/managed-services/overview)

- [Overview](http://www.onlinetech.com/managed-services/overview)
- [IT Disaster Recovery](http://www.onlinetech.com/managed-services/it-disaster-recovery)
- [OTMonitor](http://www.onlinetech.com/managed-services/remote-server-monitoring)
- [OTManage](http://www.onlinetech.com/managed-services/colocation-management)
- [OTPortal](http://www.onlinetech.com/managed-services/client-hosting-portal)
- [Rack and Stack](http://www.onlinetech.com/managed-services/rack-and-stack)
- [Managed SAN Hosting](http://www.onlinetech.com/managed-services/managed-san-hosting)

## [Secure Hosting](http://onlinetech.com/compliant-hosting/overview)

- [Overview](http://www.onlinetech.com/secure-hosting/overview)
- [PCI Compliant Hosting](http://www.onlinetech.com/secure-hosting/pci-compliant-hosting)
- [HIPAA Compliant Hosting](http://www.onlinetech.com/secure-hosting/hipaa-compliant-hosting/overview)
- [SOX Compliant Hosting](http://www.onlinetech.com/secure-hosting/sarbanes-oxley-sox-compliant-hosting)
- [Quote](http://www.onlinetech.com/secure-hosting/quote)

## [Site Resources](http://onlinetech.com/site-resources/overview)

- [Overview](http://onlinetech.com/site-resources/overview)
- [Sitemap](http://onlinetech.com/site-resources/sitemap)
- [Legal Notices](http://onlinetech.com/site-resources/legal-notices)
- [Rules of Use](http://onlinetech.com/site-resources/rulesofuse)
- [Acceptable Use Policy](http://onlinetech.com/site-resources/aup)
- [Privacy Policy](http://onlinetech.com/site-resources/privacy-policy)

Copyright 2012 Online Tech. All Rights Reserved.