SOX vs HIPAA

SOX Section 404 reaches the company's own financial reporting, not its whole technology estate. Management must assess internal control over financial reporting each year, and for accelerated and large accelerated filers that are not emerging growth companies, an external auditor attests to that assessment (15 U.S.C. 7262). SEC Release 33-8810 says the IT general controls relevant to that evaluation vary with each company's facts and circumstances, and it does not publish a fixed list. In practice, the question for a health system or insurer is which systems feed the general ledger, claims payment, revenue cycle or financial close, and which of their access, change and computer operations controls keep those automated controls reliable. Confirm your filer status and emerging growth company status with counsel before scoping, because they determine whether the auditor attestation applies at all.

HIPAA's Security Rule reaches covered entities and business associates that create, receive, maintain or transmit electronic protected health information. Covered entities include health plans, health care clearinghouses and covered health care providers, and business associates are bound through their relationship with them (45 CFR 164.302). A publicly traded health system or insurer will usually be a covered entity, so it may carry both duties over the same ePHI-bearing systems. A listed health tech vendor may carry HIPAA only through business associate status, which depends on the services it performs and the data it touches, and that status is often set by contract. Map each product line and data flow to one of these roles before deciding which systems fall under both regimes.

Ask counsel and the compliance lead to confirm three things in writing: the company's SEC filer category, whether it is an emerging growth company, and the HIPAA role of each legal entity and service line. Record which systems sit inside ICFR scope, which handle ePHI, and which sit in both, because the overlap determines where one set of access and change evidence can serve two audiences. Where a business associate agreement or a subcontract is unclear, treat that as an open item for legal review rather than an assumption about who is responsible.

A clean Section 404 result tells the market that management's assessment and the auditor's attestation found no material weakness in internal control over financial reporting. It does not tell you that electronic protected health information is protected. The auditor samples only the controls the company identified as relevant to financial reporting, and the Security Rule applies to a different population of systems. Under 45 CFR 164.302, covered entities and business associates must comply for every system that creates, receives, maintains or transmits ePHI, and the sampled ITGC population will rarely match that set. Start by comparing your ePHI inventory with the list of in-scope ITGC systems.

SEC guidance in Release 33-8810 says management only needs to evaluate the IT general controls necessary for the proper and consistent operation of controls that address financial reporting risks, and need not evaluate IT general controls that only affect operational efficiency. A clinical scheduling or order-entry system that holds ePHI but feeds no general ledger entry can sit outside the ITGC scope while remaining fully inside HIPAA scope. The Security Rule expects a documented risk analysis, a decision for each addressable implementation specification documented under 45 CFR 164.306(d), policies and documentation under 164.316, and safeguards for that system. Ask who owns those decisions for each system outside the ITGC scope.

Illustrative example: a hospital's SOX program tests access and change controls on its general ledger and ERP. Its clinical documentation system stores patient notes, but no financial reporting control depends on it, so the auditor never samples it. An audit that passes on the ERP says nothing about whether that system has audit logging, role-based access reviews, encryption decisions or a documented contingency plan. Confirm the scope boundary in writing with your external auditor and your HIPAA privacy and security officers, and treat any system left out of ITGC testing as a separate HIPAA workstream with its own evidence.

The cost of running SOX ITGC and HIPAA Security Rule work is mostly people's time, and the two programs spend it differently. Under SOX, management carries the internal effort of scoping IT general controls, gathering evidence for access, change and computer operations controls, and remediating deficiencies, while the external auditor's fees for the Section 404(b) attestation are paid by the issuer. The SEC estimated in 2020 that an issuer newly exempt from the 404(b) attestation would save about $210,000 per year on average, roughly $110,000 in audit fees and $100,000 in other costs (Release 34-88365). That figure is a regulatory estimate for a specific rule change, not a benchmark for what your audit will cost, so do not budget from it.

HIPAA work is paid for differently. The largest one-time items are the initial risk analysis and the first pass at policies, procedures and documentation under 45 CFR 164.316, plus any remediation those analyses reveal. The recurring items are periodic risk analysis, policy upkeep, workforce training and retention of Security Rule documentation for 6 years under 45 CFR 164.316(b)(2)(i), which adds storage and maintenance effort every year. Addressable implementation specifications add decision work: each one needs a documented reasonableness assessment and, where a measure is not adopted, an equivalent alternative. Ask whether a quote includes the cost of keeping that documentation current, not only the cost of producing it once.

Before you accept any quote for either program, request four things in writing: the systems in scope, including the applications, databases, identity sources and cloud accounts that touch financial reporting or ePHI; the number of controls to be designed, tested or evidenced, with the control owners named; the period of evidence to be retained and where it will be stored; and which costs are one-time and which recur each year, such as retesting, retention and remediation support. A fixed-scope quote from DeployOpen follows from that written scope, so the same list is the basis for comparing any proposal, including ones from your external auditor or other providers.