---
title: "What Is SOC 2 Type II? Type 1 vs Type 2 Explained"
description: "SOC 2 Type II is a CPA's report on how a vendor's security controls worked over a period. Type 1 vs Type 2, SOC 2 vs HIPAA, and Cuvo's report on every plan."
canonical: "https://cuvo.co/glossary/soc-2-type-ii"
last-updated: "Oct 26, 2026"
---
**Definition:** SOC 2 Type II is an independent CPA's report, under AICPA standards, on whether a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy were suitably designed and operated effectively over a period.

# What is a SOC 2 Type II report?

SOC 2 is the report a security or vendor risk team asks for before it approves a platform that will hold sensitive data. The Type II version is the one that shows the controls worked over time, not just on the day they were described. Cuvo Health provides SOC 2 Type II on every plan.

Published Oct 26, 2026. Facts reviewed Oct 26, 2026.

SOC 2 Type II is an independent CPA's report on a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy, the five categories of the AICPA's SOC 2 framework. A Type I report gives opinions on the description of the system and the design of its controls as of a specified date; a Type II report adds an opinion on whether those controls operated effectively over a period, and includes the auditor's tests of controls and their results. The AICPA notes that customers and business partners often request a SOC 2 report. Cuvo Health provides SOC 2 Type II on every plan, covering the platform all plans run on, so a brand's security and vendor risk review gets the report whichever plan it chooses.

**At a glance**
- What it is: A CPA's report on how a service organization's controls operated over a period
- Standard setter: The AICPA, the American Institute of Certified Public Accountants
- Categories: Security, availability, processing integrity, confidentiality and privacy
- Type I vs Type II: Type I covers design as of a date; Type II adds operating effectiveness over a period
- Contents: Management's assertion, the system description, the auditor's report, tests of controls and results
- On Cuvo: SOC 2 Type II on every plan, with a signed BAA, SAML SSO and an uptime SLA

**SOC 2 Type I, SOC 2 Type II and HIPAA compared**

| Question | SOC 2 Type I | SOC 2 Type II | HIPAA |
| --- | --- | --- | --- |
| **What it is** | A CPA's report on control design | A CPA's report on design and operating effectiveness | A federal law and its regulations |
| **Time covered** | As of a specified date | A period of time | A continuing legal duty |
| **Tests whether controls worked** | No | Yes, with the tests and results described | Requires safeguards; produces no report |
| **Required by law for telehealth?** | No | No; buyers and partners often request it | Yes, for covered entities and business associates |
| **What a brand gets from a vendor** | Evidence of design on one date | Evidence the controls ran over the period | A signed business associate agreement |

## 01. Why do telehealth buyers ask for SOC 2 Type II?

A brand that puts patient intake, prescriptions and payments on a vendor's platform is relying on that vendor's controls, and its own partners, retailers and enterprise customers may ask how it knows those controls work. A Type II report answers with evidence: an independent auditor tested the controls across the period and reported the results, including any exceptions. A Type I report shows only that the controls were designed suitably on one date.

## 02. How is SOC 2 Type II different from HIPAA compliance?

HIPAA is law; SOC 2 is a voluntary attestation report. HIPAA does not require a SOC 2 report, and a SOC 2 report does not by itself establish HIPAA compliance. A vendor that handles protected health information needs a business associate agreement and must meet the HIPAA Security Rule for electronic protected health information (45 CFR Part 164, Subpart C, applied to vendors by 164.504(e)(2)(ii)(B)); SOC 2 is the independent evidence of how its controls perform. On Cuvo, both arrive on every plan: a signed business associate agreement and the SOC 2 Type II report.

## 03. What should a brand check in a SOC 2 Type II report?

Read four things before relying on it. The period covered and its end date, because a report describes the past. The system description, to confirm it covers the platform and services the brand will actually use. The categories in scope, since a report may cover security alone. And the tests of controls and results, where any exceptions the auditor found are listed. On Cuvo, a brand's security and vendor risk review gets the SOC 2 Type II report whichever plan it chooses.

**Primary sources**
- [AICPA: SOC 2 reporting on controls at a service organization](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy): The five categories; customers often request the report
- [AICPA: Illustrative SOC 2 report with system description](https://www.aicpa-cima.com/resources/download/illustrative-soc-2-r-report-with-description-and-assertion): What a Type 2 report contains
- [Journal of Accountancy: Explaining the 3 faces of SOC](https://www.journalofaccountancy.com/newsletters/2016/jun/3-face-of-soc/): AICPA publication: type 1 and type 2 defined
- [45 CFR 164.504(e): business associate contracts](https://www.ecfr.gov/current/title-45/section-164.504): Security Rule compliance required of vendors

## Frequently asked questions

**Q: What is SOC 2 Type 2?**

A: It is an independent CPA's report, under AICPA standards, on whether a service organization's controls for security, availability, processing integrity, confidentiality or privacy were suitably designed and operated effectively over a period. On Cuvo, SOC 2 Type II comes with every plan.

**Q: SOC 2 Type 1 vs Type 2: what is the difference?**

A: A Type 1 report covers the system description and the design of controls as of a specified date; a Type 2 report adds an opinion on operating effectiveness over a period, with the auditor's tests and results. Cuvo Health provides the Type II report on every plan.

**Q: Is SOC 2 required for HIPAA?**

A: No. HIPAA requires business associate agreements and Security Rule safeguards, not a SOC 2 report, and a SOC 2 report does not by itself establish HIPAA compliance. On Cuvo, every plan carries both a signed business associate agreement and SOC 2 Type II.

**Q: What is in a SOC 2 Type 2 report?**

A: Management's assertion, a description of the system, the service auditor's report with its opinions, and the auditor's tests of controls and their results, according to the AICPA's illustrative report. On Cuvo, the report covers the platform all plans run on.

**Q: Does a telehealth platform need SOC 2 Type II?**

A: No law requires it, but buyers and partners often ask for it before they trust a platform with patient and payment data. Cuvo Health provides SOC 2 Type II on every plan, alongside a signed business associate agreement, SAML single sign-on and an uptime SLA.

**Related pages**

- [Telehealth vendor due diligence checklist](/blog/telehealth-vendor-due-diligence-checklist): What to request from a platform, SOC 2 report included
- [Business associate agreement (BAA)](/glossary/business-associate-agreement): The HIPAA contract that sits beside the SOC 2 report
- [HIPAA business associate agreements for telehealth brands](/blog/hipaa-business-associate-agreement-telehealth-brand): HIPAA duties a SOC 2 report does not replace
- [Cuvo pricing](/pricing): The security package on every plan
- [Cuvo compliance](/compliance): HIPAA, SOC 2 Type II and the rest of the regulated layer
- [Telehealth glossary](/glossary): Every term a telehealth founder meets

Canonical page: https://cuvo.co/glossary/soc-2-type-ii