{"id":2628,"date":"2013-09-17T00:00:00","date_gmt":"2013-09-17T00:00:00","guid":{"rendered":"http:\/\/otava.test\/sas-70-is-no-zombie\/"},"modified":"2013-09-17T00:00:00","modified_gmt":"2013-09-17T00:00:00","slug":"sas-70-is-no-zombie","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/","title":{"rendered":"Attn, Healthcare Industry: SAS 70 is No Zombie"},"content":{"rendered":"
\"SAS
SAS 70 is never coming back. Unlike this zombie. Source: wikiHow<\/figcaption><\/figure>\n

Although SAS 70<\/a> (Statement on Auditing Standards) has been dead for quite some time now, we\u2019ve found that those lagging in the health IT industry may still be confused about why SAS 70 is no longer the audit to look for when it comes to ensuring security with a cloud hosting provider<\/a>. In fact, false information about SAS 70 as a qualifier for cloud computing security supporting the healthcare industry is still an issue.<\/p>\n

Some suggest that SAS 70 is comparable to a HIPAA audit because they both check for an organization\u2019s security controls. However, SAS 70 was never designed to measure data center security, but instead to measure internal controls related to financial reporting.<\/p>\n

As major research firm Gartner stated, \u201cSAS 70 is being misused by many vendors, and often their customers and certified public accountants (CPAs), in the hosted-application, software as a service (SaaS) and cloud computing spaces.\u201d<\/p>\n

So what\u2019s better than SAS 70?<\/strong> Some say SSAE 16<\/a> (Statement on Standards for Attestation Engagements), which replaced the standard in 2011. But even an SSAE 16 report only reports on controls related to financial reporting, and not on controls directly related to data center privacy, security and availability.<\/p>\n

Here\u2019s where a SOC 2<\/a> (Service Organization Control) audit report comes in to save the day and confirm that your service provider has all of the best internal practices in place for these five controls: Security, Availability, Processing Integrity, Confidentiality and Privacy. Why choose a SOC 2 report over SOC 3<\/a>? A SOC 2 report is more detailed, and affects companies that host or store large amounts of data, such as cloud hosting and data center operators.<\/p>\n

So a SOC 2 report may suffice for most seeking an audit report that most accurately reflects a cloud hosting provider\u2019s internal security controls. But for those in the healthcare industry dealing with patient data, there\u2019s one step even further to ensure security with cloud hosting providers.<\/p>\n

Look for a HIPAA compliant hosting<\/a> provider that has a third-party independent audit report of their company\u2019s controls against the OCR (Office for Civil Rights) HIPAA Audit Protocol. Ask them which requirements they can fulfill to satisfy the IT side of the HIPAA standards.<\/p>\n

On the administrative side, ask them if and when they last completed HIPAA staff training as a business associate, and whether or not they will sign a business associate agreement (BAA) clarifying their role and responsibilities when it comes to your data security. This HIPAA Compliant Hosting white paper<\/a> explains the IT infrastructure and administrative sides completely.<\/p>\n

SAS 70 is so dead. And definitely needs to be laid to rest. Don\u2019t let it become an audit zombie. Just let it go and embrace the future of SOC 2 and independent HIPAA audits.<\/p>\n

\n

Update:<\/strong> SAS 70 reports only on controls related to financial reporting. If you need assurance of controls directly related to data centers, including privacy, security and availability, look for a SOC 2 report<\/a>.
\nSAS 70 was replaced by SSAE 16 in June 2011.<\/p>\n<\/div>\n

References:
\nGartner Says SAS 70 Is Not Proof of Security, Continuity or Privacy Compliance<\/a><\/p>\n

Related Articles:
\nSAS 70 is Dead \u2013 Long Live SOC 2 and SOC 3<\/a><\/em>
\nWe\u2019re in the final vigil for SAS 70. The oxygen has been brought out and the last rites are being given, and while a few data centers are scrambling to get a SAS 70 audit before the bell tolls, on \u2026 Continue reading \u2192<\/a><\/p>\n

SAS 70, SSAE 16, SOC 2 and SOC 3 Data Center Standards<\/a><\/em>
\nSOC 2 and SOC 3 provide much more stringent audit requirements with a stronger set of controls and requirements specifically designed around data center service organizations. Continue reading \u2192<\/a><\/p>\n

SOC 1, SOC 2 & SOC 3 Report Comparison<\/a><\/em>
\nIn April 2010, the AICPA (American Institute of Certified Public Accountants) announced the replacement of SAS 70 by a new and refined auditing standard, the Statement on Standards for Attestation Engagements or SSAE 16. While SAS 70 was originally intended \u2026 Continue reading \u2192<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Although SAS 70 (Statement on Auditing Standards) has been dead for quite some time now, we\u2019ve found that those lagging in the health IT industry may still be confused about why SAS 70 is no longer the audit to look for when it comes to ensuring security with a cloud hosting provider. In fact, false information about SAS 70 as a qualifier for cloud computing security supporting the healthcare industry is still an issue. Some suggest that SAS 70 is comparable to a HIPAA audit because they both check for an organization\u2019s security controls. However, SAS 70 was never designed to measure data center security, but instead to measure internal controls related to financial reporting. As major research firm Gartner stated, \u201cSAS 70 is being misused by many vendors, and often their customers and certified public accountants (CPAs), in the hosted-application, software as a service (SaaS) and cloud computing spaces.\u201d So what\u2019s better than SAS 70? Some say SSAE 16 (Statement on Standards for Attestation Engagements), which replaced the standard in 2011. But even an SSAE 16 report only reports on controls related to financial reporting, and not on controls directly related to data center privacy, security and availability. Here\u2019s…<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"other_category":[],"class_list":["post-2628","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"acf":[],"yoast_head":"\nAttn, Healthcare Industry: SAS 70 is No Zombie | OTAVA<\/title>\n<meta name=\"description\" content=\"We\u2019ve found that those in the health IT industry may still be confused about why SAS 70 is no longer the audit to look for when it comes to ensuring security with a cloud hosting provider.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Attn, Healthcare Industry: SAS 70 is No Zombie\" \/>\n<meta property=\"og:description\" content=\"We\u2019ve found that those in the health IT industry may still be confused about why SAS 70 is no longer the audit to look for when it comes to ensuring security with a cloud hosting provider.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/\" \/>\n<meta property=\"og:site_name\" content=\"OTAVA\" \/>\n<meta property=\"article:published_time\" content=\"2013-09-17T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg\" \/>\n<meta name=\"author\" content=\"Irma Brillantes\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Irma Brillantes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/\"},\"author\":{\"name\":\"Irma Brillantes\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\"},\"headline\":\"Attn, Healthcare Industry: SAS 70 is No Zombie\",\"datePublished\":\"2013-09-17T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/\"},\"wordCount\":653,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/\",\"url\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/\",\"name\":\"Attn, Healthcare Industry: SAS 70 is No Zombie | OTAVA\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg\",\"datePublished\":\"2013-09-17T00:00:00+00:00\",\"description\":\"We\u2019ve found that those in the health IT industry may still be confused about why SAS 70 is no longer the audit to look for when it comes to ensuring security with a cloud hosting provider.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#primaryimage\",\"url\":\"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg\",\"contentUrl\":\"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.otava.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Attn, Healthcare Industry: SAS 70 is No Zombie\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.otava.com\/#website\",\"url\":\"https:\/\/www.otava.com\/\",\"name\":\"OTAVA\u00ae\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.otava.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.otava.com\/#organization\",\"name\":\"OTAVA\u00ae\",\"url\":\"https:\/\/www.otava.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"contentUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"caption\":\"OTAVA\u00ae\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\",\"name\":\"Irma Brillantes\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"caption\":\"Irma Brillantes\"},\"url\":\"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Attn, Healthcare Industry: SAS 70 is No Zombie | OTAVA","description":"We\u2019ve found that those in the health IT industry may still be confused about why SAS 70 is no longer the audit to look for when it comes to ensuring security with a cloud hosting provider.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/","og_locale":"en_US","og_type":"article","og_title":"Attn, Healthcare Industry: SAS 70 is No Zombie","og_description":"We\u2019ve found that those in the health IT industry may still be confused about why SAS 70 is no longer the audit to look for when it comes to ensuring security with a cloud hosting provider.","og_url":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/","og_site_name":"OTAVA","article_published_time":"2013-09-17T00:00:00+00:00","og_image":[{"url":"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg","type":"","width":"","height":""}],"author":"Irma Brillantes","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Irma Brillantes","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#article","isPartOf":{"@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/"},"author":{"name":"Irma Brillantes","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263"},"headline":"Attn, Healthcare Industry: SAS 70 is No Zombie","datePublished":"2013-09-17T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/"},"wordCount":653,"commentCount":0,"publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"image":{"@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#primaryimage"},"thumbnailUrl":"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg","inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/","url":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/","name":"Attn, Healthcare Industry: SAS 70 is No Zombie | OTAVA","isPartOf":{"@id":"https:\/\/www.otava.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#primaryimage"},"image":{"@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#primaryimage"},"thumbnailUrl":"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg","datePublished":"2013-09-17T00:00:00+00:00","description":"We\u2019ve found that those in the health IT industry may still be confused about why SAS 70 is no longer the audit to look for when it comes to ensuring security with a cloud hosting provider.","breadcrumb":{"@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#primaryimage","url":"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg","contentUrl":"https:\/\/pad2.whstatic.com\/images\/thumb\/9\/90\/163-zombie-shuffle-2009.jpg\/629px-163-zombie-shuffle-2009.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.otava.com\/blog\/sas-70-is-no-zombie\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.otava.com\/"},{"@type":"ListItem","position":2,"name":"Attn, Healthcare Industry: SAS 70 is No Zombie"}]},{"@type":"WebSite","@id":"https:\/\/www.otava.com\/#website","url":"https:\/\/www.otava.com\/","name":"OTAVA\u00ae","description":"","publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.otava.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.otava.com\/#organization","name":"OTAVA\u00ae","url":"https:\/\/www.otava.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","contentUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","caption":"OTAVA\u00ae"},"image":{"@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263","name":"Irma Brillantes","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","caption":"Irma Brillantes"},"url":"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/"}]}},"_links":{"self":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/2628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/comments?post=2628"}],"version-history":[{"count":0,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/2628\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/media?parent=2628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/categories?post=2628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/tags?post=2628"},{"taxonomy":"other_category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/other_category?post=2628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}