Compliance acronyms have a way of blurring together until they all feel like the same vague obligation to “be secure.” HIPAA, CMMC, FTC Safeguards, SOC 2. They get name-dropped in sales calls and contract clauses as if they are interchangeable, and they are not. Each one applies to a different kind of business and protects a different kind of information. The good news is that figuring out which ones reach you is mostly a matter of asking what data you handle and who you do business with. Let’s sort them out.
The fastest way to tell them apart
Before the details, here is the one-line version of who each one is for:
- HIPAA applies if you handle health information as a healthcare provider, plan, or one of their vendors.
- CMMC applies if you handle Defense Department contract information, even as a subcontractor down the chain.
- The FTC Safeguards Rule applies if you handle customers’ financial information as a “financial institution,” which includes far more businesses than banks.
- SOC 2 is not a law at all. It is a voluntary audit you pursue when your customers want proof you protect their data.
The first three are legal requirements triggered by the type of data you touch. The fourth is a market expectation you choose to meet. Keep that distinction in mind and the rest gets much clearer.
HIPAA: health information
HIPAA applies to “covered entities,” which are healthcare providers who bill electronically, health plans, and clearinghouses, and to their “business associates,” the vendors who handle health information on their behalf. The U.S. Department of Health and Human Services keeps the definitions on its covered entities page.
If you run a medical, dental, behavioral health, or similar practice and you bill insurance electronically, HIPAA almost certainly applies, regardless of how small you are. It also reaches the IT companies, billing services, and backup providers those practices use. We go deeper on this in whether HIPAA applies to your small practice. The data at stake is protected health information: anything that ties a person to their health, in your systems.
CMMC: defense contract information
CMMC is the Defense Department’s certification program for companies in its supply chain, verifying that they protect Federal Contract Information and Controlled Unclassified Information. The official details live on the DoD’s CMMC program page.
The trap here is flow-down. You may have no direct DoD contract and still be pulled in, because a prime contractor’s cybersecurity obligations pass down to the subcontractors who help perform the work. If defense-related FCI or CUI reaches your systems through any client relationship, CMMC likely reaches you too. We unpack the levels and the subcontractor flow-down in what CMMC is and whether you need it. If no defense contract data ever touches your business, CMMC does not apply, and nobody should sell it to you as if it does.
FTC Safeguards Rule: customer financial information
The Safeguards Rule, under the Gramm-Leach-Bliley Act, applies to “financial institutions” subject to the FTC’s jurisdiction, and that term is much broader than it sounds. The FTC’s Safeguards Rule guidance lists tax preparers and accountants among covered businesses, alongside mortgage brokers, auto dealers that arrange financing, and similar firms.
So if your business handles customers’ nonpublic financial information as part of providing a financial product or service, the rule likely applies. For accounting and tax firms specifically, we cover this in whether the FTC Safeguards Rule applies to your firm. The rule’s centerpiece is a written information security program, often called a WISP.
SOC 2: proof for your customers
SOC 2 is the different one. It is not a government rule and nobody can force you into it. It is an independent audit, performed by a CPA firm against criteria published by the American Institute of CPAs, that results in a report attesting to how well you protect customer data. Businesses pursue SOC 2 when their own customers, usually other businesses, demand evidence before trusting them with data, common for software companies and service providers.
You don’t “have to” do SOC 2 the way you have to follow HIPAA. You do it because a sales deal or a vendor review depends on it. If your customers have never asked for a SOC 2 report, you probably don’t need one. If they keep asking, that’s your signal.
How to figure out which ones reach you
Work through your business one question at a time:
- Do you handle health information for patients, or for a healthcare client? If yes, look hard at HIPAA.
- Does any work you do involve Defense Department contract data, directly or as a subcontractor? If yes, look hard at CMMC.
- Do you handle customers’ financial information as part of a financial service, like tax prep or accounting? If yes, look hard at FTC Safeguards.
- Are business customers asking you to prove your security with a formal report? If yes, consider SOC 2.
It is entirely normal to land in more than one. A dental practice that does business with the VA could face both HIPAA and CMMC. The reassuring part is that these frameworks overlap heavily in what they actually ask for: access controls, encryption, multi-factor authentication, monitoring, tested backups, training, and a written response plan. That common core is exactly the layered approach behind our People+ Framework, which means satisfying one framework gets you most of the way toward the others.
One honest caveat across all of them: an IT provider can build and run the technical controls and assemble the evidence, but the legal responsibility stays with your business. We explain that boundary in whether an MSP can make you compliant.
Where to start
If you’re staring at a contract clause or a vendor questionnaire and can’t tell which framework it’s invoking, start by mapping your data and your client relationships against the four questions above. That alone usually answers most of it. For the rest, you can read more on our compliance hub, or sit down with us. We’re local, we work with regulated businesses across Alaska and Hawaii, and we’ll give you a plain read on which rules actually reach you and which ones don’t.