RentServers.comBy the RentServers.com team · Updated
SOC 2 in one paragraph
A SOC 2 report is an independent auditor's opinion on a service organization's controls, measured against the AICPA Trust Services Criteria: security, plus optionally availability, processing integrity, confidentiality and privacy. A Type I report checks that controls are designed properly at a single date. A Type II report tests that they operated effectively over a period, usually 6 to 12 months. Ask for Type II.
Read the report, not the badge
- Scope. Which services, locations and systems are covered? A data center's SOC 2 usually covers physical security only, not the servers, hypervisor or network the provider runs on top.
- Carve-outs. Subservice organizations (the facility, a cloud underneath) may be carved out. You then need their reports too.
- Exceptions. Read the auditor's exceptions and management's responses.
- Dates. If the period ended months ago, ask for a bridge letter covering the gap.
- Complementary user entity controls. The report lists what you must do for the controls to work, such as managing your own users and keys.
HIPAA: there is no certificate
No government body certifies a host as "HIPAA compliant". A provider can be HIPAA-ready, meaning it runs safeguards that let you meet the Security Rule, and will sign a Business Associate Agreement.
Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information (PHI) for a covered entity is a business associate and needs a BAA. HHS guidance on cloud computing says a provider that stores PHI is a business associate even if the data is encrypted and the provider has no key. So if PHI reaches a GPU server, its disks, its logs or its backups, the host needs to sign a BAA.
What a BAA should cover
- Permitted uses and disclosures of PHI, and nothing else.
- Administrative, physical and technical safeguards under the Security Rule.
- Breach reporting to you without unreasonable delay; HIPAA's outer limit for a business associate is 60 days after discovery, and many contracts set much shorter windows.
- Flow-down to subcontractors who touch PHI.
- Return or destruction of PHI when the contract ends, with written confirmation.
GPU-specific questions
- Isolation. Bare metal or a dedicated GPU node isolates you best. Shared GPUs partitioned with features such as MIG, or time-sliced, need a written description of how memory is isolated and cleared between tenants.
- Where PHI lands. Prompts, embeddings, fine-tuning datasets, model checkpoints and inference logs can all contain PHI. Encrypt the disks they sit on and control the keys.
- Logging. Access logs for the servers and the management plane, retained per your policy.
- Remote hands. Who can touch the hardware, how they are vetted, and how a failed drive with PHI on it is destroyed.
- Model APIs. If a model endpoint sends data to a third party, that party needs a BAA too, or the data must stay on your servers.
How we handle it
Every quote request can be marked SOC 2 or HIPAA required, and only providers that can supply a current SOC 2 Type II report and sign a BAA are invited to bid. Our own Private LLM Hosting runs on SOC 2 and HIPAA-eligible servers, with a BAA available on request.
Questions
Is SOC 2 required for HIPAA?
No. HIPAA requires safeguards and a BAA, not a SOC 2 report. In practice a current SOC 2 Type II report is the most efficient evidence that a host's safeguards work, so most healthcare buyers ask for both.
Do I need a BAA if the GPU host only sees encrypted data?
HHS guidance says a provider that stores PHI is a business associate even when the data is encrypted and the provider has no key. If PHI is stored on the host's systems, get a BAA.
Can rented GPUs be HIPAA compliant?
The infrastructure can be HIPAA-ready, and the provider can sign a BAA. Compliance itself depends on how you configure and operate the workload, which is your responsibility under the shared model.