StreamCase has completed its SOC 2 Type II examination. For an organization handling independent medical evaluations, choosing software means deciding where sensitive medical records will be handled. You need to understand how a vendor protects that information and what evidence supports its claims. Our SOC 2 Type II report gives your organization and its security reviewers an independent assessment to use in that decision.
What the Examination Covered
SOC 2 is an examination performed by an independent CPA firm using criteria developed by the American Institute of Certified Public Accountants. A Type II report addresses both the design of controls and how those controls operated over a defined period.
Our examination covered the system described in the report and three Trust Services Criteria categories:
Security, addressing protection against unauthorized access and other security risks.
Confidentiality, addressing protection of information designated as confidential.
Availability, addressing whether the system supports its availability commitments.
The auditor concluded that the controls described in the report were suitably designed and operated effectively, in all material respects, during the examination period. That opinion is subject to the scope and conditions in the report, including responsibilities assigned to customers and service providers.
What this Means for Your Organization
A software demonstration can show how records are organized. A security review helps your organization decide whether the service fits its requirements for handling those records. Learn more about how StreamCase protects medical records.
The SOC 2 report adds independent evidence to that review. It describes the system examined, the controls tested, and the auditor's findings. Your organization can use it alongside its own requirements and agreements when evaluating StreamCase.
The report covers a specific system and period. It does not guarantee that a security incident can never occur, and it does not assess the clinical accuracy of AI-generated output. Professional review of medical records and conclusions remains essential.
How SOC 2 Relates to HIPAA
SOC 2 and HIPAA share substantial security groundwork. Alongside our SOC 2 work, StreamCase received a HIPAA attestation certificate issued through Comp AI. The two forms of documentation address different questions: the SOC 2 report provides independent assurance over the examined controls, while HIPAA addresses obligations specific to protected health information (PHI).
Completing a SOC 2 examination does not replace HIPAA obligations, including a required business associate agreement and risk analysis. That distinction does not make the underlying controls separate projects. Risk assessment, workforce training, access reviews, and incident procedures can support both.
Where the Controls Overlap
Our SOC 2 report documents risk assessment, workforce training, periodic access reviews, and incident procedures. These are also relevant to HIPAA safeguards:
Risk assessment identifies threats and vulnerabilities so protections can be prioritized. HIPAA requires that analysis to address risks to electronic protected health information, not just general business risk.
Training turns written security policies into responsibilities people understand and follow. HIPAA also requires security awareness and training for the workforce.
Access reviews check who should retain access. HIPAA ties access authorization to the person’s role and the information needed for that role.
Incident procedures establish how suspected security problems are identified, investigated, and addressed. HIPAA adds specific duties for incidents involving protected health information.
The practical benefit is a common operating foundation: controls that protect records day to day and evidence that those controls are being maintained. The HIPAA Security Rule applies that foundation specifically to electronic protected health information.
What HIPAA Adds
The overlap is substantial, but a SOC 2 examination alone does not establish that every HIPAA obligation has been met. Three areas need their own policies, agreements, and procedures.
Permitted uses and disclosures. Protecting a record from unauthorized access is different from determining whether a particular use or disclosure is permitted. The HIPAA Privacy Rule governs those purposes and limits, including the minimum necessary standard where applicable. In an IME workflow, secure software does not by itself authorize sharing the underlying records.
Business associate agreements. Where a business associate relationship applies, a BAA defines permitted uses of PHI and the parties’ responsibilities for safeguarding it. Applicable subcontractor relationships also require appropriate agreements. A SOC 2 report is evidence for vendor review, not a substitute for these contractual obligations.
Breach assessment and notification. A security incident and a reportable HIPAA breach are not interchangeable. HIPAA requires evaluating impermissible uses or disclosures under its breach rules and making required notifications. Business associates must notify the covered entity after discovering a breach of unsecured PHI. This requires a PHI-specific assessment and notification process alongside general incident response.
For your organization, the useful review combines both: evidence that security controls operate effectively, plus the HIPAA-specific documentation and agreements that govern how PHI is handled. Our SOC 2 report and HIPAA attestation are part of that review, not substitutes for the responsibilities each party retains.
Reviewing StreamCase for Your Organization
StreamCase helps independent medical evaluators organize medical records and prepare for case review. With our SOC 2 Type II examination complete, organizations now have an additional source of independent evidence to consider when evaluating the platform.
Contact StreamCase to discuss your security review and request access to the SOC 2 Type II report.