SOC Type 1 assesses the design of an AI service provider's controls related to data security, privacy, and system integrity at a specific point in time. It reviews the existence of controls for handling data securely but does not test their effectiveness over a prolonged period. This report is useful for organizations that need to establish baseline controls for their AI systems.

SOC Type 2 evaluates the operational effectiveness of an AI service provider's controls related to data security, privacy, and system processing over time. The audit reviews how these controls perform over a period (e.g., 6-12 months), verifying that they consistently meet compliance and performance standards. It is ideal for organizations that need to demonstrate ongoing control reliability.

HIPAA requires safeguards for ePHI (electronic protected health information), including access control, data integrity, and transmission security. AI systems using ePHI  must limit access and use de-identified data