SOC 2 compliance

No. Approva is pursuing a SOC 2 Type II report; readiness work is underway, no audit has been engaged, and no report has been issued. The vocabulary is worth being precise about in a vendor review: SOC 2 produces an independent auditor’s attestation report, not a certification, so a vendor describing itself as “SOC 2 certified” is describing something that does not exist. Approva’s controls are designed against the Trust Services Criteria, and the supporting documentation is available under NDA.

Type II. A Type I report says whether controls are suitably designed at a single point in time; a Type II report also tests whether those controls operated effectively across a review period, which is the evidence a security reviewer actually wants. Approva is going straight to Type II rather than publishing a point-in-time Type I first. Until an observation period has run and been tested, there is no report to share.

Security is the common criteria every SOC 2 engagement includes. Approva’s program is designed to add availability, confidentiality, and processing integrity on top of it — availability covering uptime SLAs and incident response, confidentiality covering PHI access controls and encryption, and processing integrity covering change management and data validation. Logical access, vendor management, and risk assessment policies are documented as part of the same program. The privacy criterion is not part of the current scope.

Approva can share its security posture and controls documentation under NDA — logical access, vendor management, risk assessment, change management, encryption standards, and audit logging. The HIPAA program runs alongside it and is documented separately, including the Security Rule risk analysis under 45 CFR 164.308(a)(1) and the business associate agreement that has to be signed before any PHI is exchanged. Email prashanth@approva.health to start that review.

No. SOC 2 is a voluntary attestation against the Trust Services Criteria; HIPAA is a federal regulation with its own Privacy Rule and Security Rule obligations, and neither one substitutes for the other. A business associate still needs a signed BAA, a Security Rule risk analysis, breach notification procedures, and subcontractor flow-down whether or not a SOC 2 report exists. The two overlap heavily in the evidence they ask for — access control, encryption, incident response — which is why Approva runs one control set and maps it to both frameworks.

Approva is not publishing a target date. Readiness work is underway, no audit firm has been engaged, and a Type II report cannot exist until an observation period has run and been tested by that firm. Status is published on this page as milestones are reached rather than as a date Approva does not control. If a completed SOC 2 report is a hard gate in your procurement process, say so early and we will tell you plainly where the program stands.