System and Organization Controls for Healthcare Organizations

SOC COMPLIANCE

Internal Controls for Healthcare Organizations

For healthcare companies, choosing a third-party service provider that you can trust is critical. In many cases, the healthcare company is entrusting the service provider with its customers’ protected health information (PHI), which is protected by the Health Insurance Portability and Accountability Act (HIPAA). Under HIPPA, penalties for a single violation can reach $50,000 and cap out at $1.5 million annually.

Thus, it is essential that a healthcare company use service providers that have strong internal controls to protect their customers’ PHI. But how can a healthcare company perform due diligence and gain assurance over their service providers’ security?

Healthcare system and organization controls: manual audits vs SOC 2 reports

One option is to include specific security requirements within its contracts with the service provider. Some healthcare companies go as far as to manually audit the security of their higher risk providers. In doing so, the healthcare company gains assurances through the manual review and the service provider’s contractual representations that certain security controls are in place. However, this is labor intensive, especially for organizations that have a large number of vendors.

A second option is to request and review a service provider’s System and Organization Controls (SOC) 2 Report. SOC 2 Reports are widely accepted and provide assurances relating to the service provider’s controls surrounding Security, Availability, Confidentiality, Processing Integrity, and Privacy. SOC 2 Reports therefore replace the laborious manual audit with a simple report review process. Service providers benefit by undergoing a single examination by a CPA firm rather than continuous customer audits. Because of the reduced overall effort, increased rigor of the audit, and the broad acceptance across industries, it is no surprise the SOC 2 reports are popular.

As a best practice, when evaluating third-party service providers, a healthcare company should determine if the provider obtains a SOC 2 report annually. If so, the healthcare company should obtain and review the SOC 2 report to confirm the service provider has adequate data security controls. If the prospective service provider does not have a SOC report, the healthcare company should determine if the service provider obtains another industry recognized certification such as HITRUST.

Source: Becker’s Hospital Review

Are you a healthcare company that uses third-party service providers and want to learn more about SOC reports? Or are you a third-party service provider whose clients include healthcare companies and want to learn more about the SOC reporting process? Keiter’s Risk Advisory Services team can help you.

Additional Resources:

• Does your service organization need a System and organization Control (SOC) Report?
• When to Choose a SOC 1 vs SOC 2 Report
• 8 Steps to Prepare for a System and Organization Control Report
• How long does it take to get a SOC Report?
• System and Organization Control Audit Insights