The Nonprofit AI Almanac

Guide

Compliance words: SOC 2, ISO 27001, HIPAA and GDPR

Please note: This site is only a guide to help people understand. Consult your IT, security and/or privacy department for clarification.

Why these words come up

AI vendors often list SOC 2, ISO 27001, HIPAA and GDPR on their sales pages. The words sound alike, but they are not the same kind of thing.

Two of them are about the vendor. SOC 2 is an audit report on the vendor's controls. ISO 27001 is a standard the vendor can be certified against.

The other two are laws. HIPAA is a US health privacy law. GDPR is an EU data protection law. Laws apply to organizations, and that can include yours.

None of them covers how your own team uses a tool. That part is up to you.

At a glance

Here is the short version. Each row is explained in more detail below.

The four compliance words compared
WordWhat it isWho makes itWhat to ask for
SOC 2An auditor's report on a service company's controlsA CPA firm, using AICPA criteriaThe latest report, which products it covers, and its dates
ISO/IEC 27001A standard for managing information security, with optional certificationAn outside certification body (not ISO)The certificate and its scope
HIPAAA US law for health informationUS Congress (1996); HHS writes and enforces the rulesA signed business associate agreement, if HIPAA applies to you
GDPRAn EU law for personal dataThe European UnionA signed data processing agreement if the vendor processes data for you, and where data is stored or sent

Official sources for this section:

SOC 2: an auditor's report, not a certificate

A SOC 2 report comes from an independent CPA firm. The auditor checks a service company's controls against the AICPA's Trust Services Criteria. The criteria cover security, availability, processing integrity, confidentiality and privacy.

A report may not cover all five of those areas. Check which ones your vendor's report covers.

There are two types. A Type I report looks at whether the controls are designed well, as of one date. A Type II report also tests whether the controls actually worked throughout a stated period of time.

A Type II report lists the tests the auditor ran and what they found. Read those results, including any problems the auditor noted.

The auditor's opinion comes in more than one type, so read it instead of assuming a simple pass. The AICPA also tells readers to look for "complementary user entity controls". "User entities" is the AICPA's name for a vendor's customers, so this part is about controls on your side.

SOC 2 is a report, not a certificate or a badge. Its use is restricted to readers who understand the vendor's system. So you usually have to ask the vendor for it. A shorter SOC 3 report is made for anyone to read.

A report describes one system for one stretch of time. Check that it names the product you would use, and check its dates.

Official sources for this section:

ISO/IEC 27001 and 27002: a standard, and guidance

ISO/IEC 27001 is a standard for an "information security management system". That means the policies, people and tools a company uses to manage risks to its data.

ISO and IEC write the standard together. ISO says it does not certify anyone. Outside certification bodies do the audits and issue certificates.

A certificate from an accredited certification body gives extra confidence. Accredited means another independent body has checked that the certifier is competent.

ISO says you can check a certificate in the IAF CertSearch database, or ask the certification body. Both can confirm its status, so check that it is still current. ISO also says a certificate should name the full standard, such as "ISO/IEC 27001:2022".

A certificate has a scope. The scope says which parts of the company it covers. Ask to see the scope, and check that the product you would use is inside it.

ISO's security committee says customers should check both the scope and the "statement of applicability" to be sure their needs are covered. Ask for both.

A certificate does not mean a company cannot be hacked. It means the company runs a formal system to manage its security risks.

ISO/IEC 27002 is a separate document. ISO says 27001 sets the requirements, while 27002 gives guidance on security controls, such as access control and cryptography. If a vendor says it follows ISO for security, ask for its 27001 certificate.

ISO's own FAQ says 27002 cannot be certified to. Only 27001 can. So a claim to be "27002 certified" is a warning sign.

Official sources for this section:

HIPAA: a US law for health information

HIPAA is a US law. Its rules protect health information held by "covered entities". There are three kinds. The first is health plans. The second is health care clearinghouses, which turn health billing data into a standard format. The third is health care providers that send health data electronically for things like billing.

The rules also apply to "business associates". A business associate does work for a covered entity that involves health details. HHS lists cloud storage and a vendor's AI chatbot on a patient portal as examples.

A vendor's own subcontractors that handle the data are business associates too. The vendor needs a BAA with each of them.

HHS says that if an organization is not a covered entity or a business associate, it does not have to follow the HIPAA rules. A clinic that bills electronically may be covered. Ask your privacy contact whether yours is.

If your organization is covered, a vendor that handles protected health information for you needs a signed business associate agreement first. The agreement says what the vendor may do with the information and how it must protect it.

HHS does not certify any person or product as "HIPAA compliant". So words like "HIPAA eligible" or "supports HIPAA" on a website do not make your use compliant. Ask whether the exact plan you would use comes with a BAA.

HIPAA has a Privacy Rule and a Security Rule. The Privacy Rule limits how health data is used and shared. It also gives people rights to their records. The Security Rule sets safeguards for health data kept or sent electronically. Staff training and access controls are two of them.

The Privacy Rule has a "minimum necessary" standard. Covered entities must take reasonable steps to use or share only the health data needed for the task. That is a good habit with AI tools too.

A third rule, the Breach Notification Rule, says covered entities and business associates must give notice after a breach of unsecured health information.

Health data that has been properly de-identified is not protected health information. HHS describes two ways to do it: "Safe Harbor" and "Expert Determination". Safe Harbor means removing a long list of identifiers, such as names, street addresses and ZIP codes. Removing names alone is not enough.

HHS's Office for Civil Rights enforces the Privacy and Security Rules.

Official sources for this section:

GDPR: an EU law for personal data

The GDPR is the EU's main data protection law. It protects personal data, meaning any information about a living person who can be identified.

EU data protection rules cover the European Economic Area (EEA). That is the EU countries plus Iceland, Liechtenstein and Norway.

It applies to a group with a branch in the EU, for that branch's work, wherever the data is processed.

It can also apply to groups outside Europe. That includes groups that offer goods or services to people in the EU, paid or free, or that monitor how people in the EU behave.

It is not only for businesses, and it does not depend on size. The law's meaning of "controller" includes any "other body".

The GDPR names two roles. The controller decides why and how personal data is used. The processor handles the data only on the controller's behalf. If your nonprofit uses a vendor to handle data for you, ask your privacy contact which role each of you has.

The work a processor does must be set out in a contract or other legal act. In this guide we call that contract a data processing agreement.

You need a lawful basis to use personal data. The GDPR lists six: consent, a contract, a legal duty, protecting someone's life, a task in the public interest, and legitimate interests.

People have rights over their data. These include the right to see it, correct it, have it deleted in some cases, and object to some uses. In principle, requests must be answered within one month.

Some data is "sensitive" and has stricter rules. This includes health data, religious beliefs, racial or ethnic origin, sexual orientation and trade union membership. It may only be used under specific conditions, such as a person's explicit consent.

One of those conditions is for nonprofits with a political, religious, philosophical or trade union aim. It covers data only about their members or people in regular contact with them.

If a data breach is likely to put people at risk, the controller must tell the data protection authority within 72 hours at the latest. If the risk to people is high, it must usually tell them too. A processor must report every breach to the controller.

Moving personal data out of the EEA has its own rules. A transfer needs an approved route, such as an adequacy decision or standard contractual clauses. An adequacy decision means the EU has found that the other country protects data well enough.

Official sources for this section:

Other privacy laws

The UK has its own, separate data protection rules.

Some US states have their own privacy laws, and they differ. California's attorney general says its law generally does not apply to nonprofits. Colorado's and Oregon's attorneys general say their laws can apply to nonprofits. Ask your privacy contact which laws apply to you.

Official sources for this section:

What these labels do NOT mean

No tool is compliant just because its vendor says so.

Compliance depends on choices your organization makes. What data do you put in? Which plan do you use? Which settings are on? Which agreements are signed? Has your team been trained?

A badge on a website is a claim. Ask for the evidence behind it, such as the report, the certificate or the signed agreement.

Reports and certificates also have limits. A SOC 2 report covers a stated system and stated dates. An ISO certificate covers a stated scope. Outside of those, they say nothing.

The bodies behind these words back this up. HHS does not certify products as HIPAA compliant. ISO does not issue certificates. The AICPA's own journal notes that "compliance" is a word SOC 2 examinations never use.

Official sources for this section:

Questions to ask a vendor

Ask in writing and keep the answers. Our printable list of vendor questions includes these four.

Want to see what each provider says about itself? The comparison pages list vendor claims with links to where each vendor says it.

  • Can you share your latest SOC 2 Type II report, and which products and dates does it cover?
  • Does your ISO/IEC 27001 certificate's scope include the exact product and plan we would use?
  • Will you sign a business associate agreement (BAA) for the plan we would use?
  • Will you sign a data processing agreement, and where will our data be stored or transferred?

Open the printable list of questions to ask any provider

This is not legal advice

This is not legal advice. This guide explains common words so you can ask better questions.

Consult your IT, security and/or privacy department before you decide. For legal questions, ask a qualified lawyer.

Official sources

Every fact above about a standard or a law comes from one of these pages.

Keep going