SOC 2 and ISO 27001 claims on a supplier's page: what they cover, and what to ask for

As of 4 October 2026, a SOC 2 or ISO/IEC 27001 badge on a supplier's page is a claim, not the evidence. The evidence is a document: a SOC 2 report from a CPA firm, or an ISO/IEC 27001 certificate from a certification body.Source 3 Ask for it, then check whose name, which systems and which dates it covers.

The Journal of Accountancy wrote on 1 February 2026 that an AICPA SOC report "has become a badge of trust."Source 6On a supplier's website, the badge is all a buyer sees. This page sets out what each standard covers, what a caption alone does not tell you, and what to ask for, with what the 12 platforms in Clinic Partner Guide's Compounded Sourcing Platform IndexSource 12 publish on security.Source 1 What each publishes, not a verdict on any supplier.

What it is. SOC 2 is an examination of controls at a service organization relevant to "security, availability, processing integrity, confidentiality, or privacy".Source 4 ISO/IEC 27001 is a standard that sets requirements for an information security management system.Source 5

Who issues it. For SOC 2, a CPA firm: the AICPA describes SOC as "a suite of service offerings CPAs may provide".Source 3 For ISO/IEC 27001, a certification body. Accreditation bodies in the IAF agreement recognize certificates "issued by conformity assessment bodies accredited by all other signatories of the IAF MLA, with the appropriate scope".Source 7

What you receive. For SOC 2, a report. In the AICPA's words, customers and business partners "often request a SOC 2 report from the service organization".Source 4 For ISO/IEC 27001, a certificate.

The AICPA's illustrative documents refer to a SOC 2 Type 1 examinationSource 14 and a SOC 2 Type 2 examinationSource 16. Ask which type you are being sent, and for which dates.

The AICPA's SOC page, read 4 October 2026, carries a notice: "The AICPA is looking into allegations published anonymously about the business practices of a compliance vendor that offers Systems and Organization Control (SOC) services." It adds: "If auditors involved in these matters are found to have not performed audits in accordance with professional standards, not been enrolled in peer review, and/or are unlicensed, the AICPA will take action with respect to its members."Source 3

The notice names no vendor, and neither do we. The Journal of Accountancy's advice to organizations hiring a SOC 2 auditor includes: "Evaluate the firm's qualifications, experience, and peer review results."Source 6

Our reading for a buyer: the same question applies one step later. The firm that signed your supplier's report is part of the evidence.

On 4 October 2026, VitaRelay's home page showed badge images with the caption "ISO/IEC 27001:2022 certified · AICPA SOC 2 audited".Source 8 Its security page states: "Our infrastructure and processes are reviewed under AICPA SOC 2 standards."Source 9

As read that day, neither page named an audit firm or a certification body, gave a report period or a certificate number, or linked a report, a certificate or a way to request one. That describes the pages. It says nothing either way about the company's controls, its audit or its certification, which a web page cannot show.Source 9

Read with the six asks above, the caption is a list of documents to request. The same applies to any supplier's caption.

The administrative safeguards section of the HIPAA security standards, 45 CFR 164.308(b)(1), reads: "A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information."Source 10

That section, in the edition revised as of 1 October 2025 and read on 4 October 2026, does not mention SOC 2, ISO/IEC 27001 or certification.Source 10 Whether a supplier is a business associate of your clinic, and what assurances you need, are questions for your counsel. A badge does not answer them.

What a clinic can collect is the supplier's written position. The Banyan Network's record describes "a Business Associate Agreement executed before PHI is shared".Source 1 VitaRelay's security page lists "BAA support".Source 9

A SOC 2 report addresses security, availability, processing integrity, confidentiality or privacy.Source 4 Pharmacy licensing, what a pharmacy may compound and product quality sit outside those categories. For licensing, our state license checkSource 15 sets out the steps.

Date every document you file, and ask again when it is renewed.