The problem
A digital health company may be a HIPAA business associate for some clients, hold substance use disorder records covered by 42 CFR Part 2, collect consumer health data subject to CCPA/CPRA, and owe its enterprise customers a SOC 2 report. Teams often build four programs with four policy sets, and the audit burden multiplies.
Start with the data map
Every unified program starts with a classification of data at intake: PHI, Part 2 records, consumer personal information, and confidential business data. Each class is assigned to approved systems and roles. Once the map exists, each regime's requirements attach to a data class rather than to a department.
One control, many criteria
A quarterly access review satisfies the HIPAA Security Rule's access control standard, SOC 2 logical access criteria, and ISO/IEC 27001 access control. A vendor assessment with a signed BAA and data processing terms covers HIPAA, CCPA/CPRA service-provider requirements, and SOC 2 vendor management. HSK maintains a control matrix that records each mapping, so one piece of evidence is filed once and cited many times.
Where Part 2 differs
Part 2 records require consent forms with specific content, carry a redisclosure notice, and must be segmented so they do not flow into general records without authorization. HSK labels and segments these records in the EHR and repository layer and adds Part 2 checks to the release-of-information workflow.
This briefing is general information, not legal advice. Requirements vary by state and by the facts of each organization.