Clinia renews SOC 2 Type II and completes HIPAA and GDPR assessments

Clinia has renewed its SOC 2 Type II report with a clean result. The auditors found no exceptions, meaning none of our controls failed when tested, and issued an unqualified opinion, meaning they signed off without reservations. We have also completed an independent assessment against the HIPAA Security and Breach Notification Rules, and our 2026 GDPR assessment came back with the same clean result.

As healthcare organizations bring AI agents into their workflows, those agents need to act on patient data. The Clinia Context Engine sits between data sources and agents, reconciling patient data into a patient story that agents can reason over. That role means we have to meet the highest standards for security and privacy. These three independent reviews put those standards to the test, each from a different angle.

SOC 2 Type II: twelve months of independently tested controls

SOC 2 is an independent audit of how a company protects the data it handles. A Type I report checks that controls are well designed at a single point in time. A Type II report goes further and tests whether those controls actually worked as intended over a period of months. Our report covered a full 12 months and four criteria (Security, Availability, Confidentiality and Privacy), and the auditors found no exceptions.

For a platform that sits between clinical data sources and the AI agents that rely on them, that difference matters. The Context Engine handles patient data every day, so the controls around it need to work every day as well. That includes access management, system monitoring, software releases, incident response and vendor reviews.

HIPAA: safeguards for protected health information

While SOC 2 covers how Clinia operates overall, the HIPAA assessment focuses specifically on protected health information. It reviewed our safeguards against the HIPAA Security Rule and Breach Notification Rule, including how access is controlled, how risks are identified and managed, how systems and data are protected, and how we would respond if protected health information were compromised. For organizations whose AI agents work with patient records, these are the safeguards that matter most.

GDPR: data protection across jurisdictions

Organizations using the Context Engine work under different privacy rules depending on where they operate. Our 2026 GDPR assessment adds that view. We build on one set of foundations designed to hold up across those environments, rather than a different version of the platform for each jurisdiction.

They show that the layer between patient data and AI agents is held to the standard that data requires, and we will keep doing that work as the Context Engine evolves. Making health data more useful only matters if it stays trustworthy.