HIPAA Readiness
Organize HIPAA business associate agreement so control statements, operating practice, ownership, and current evidence can be reviewed together without losing context.
CISO-led guidance from Ali Hassani, backed by 25+ years of IT, cybersecurity, compliance, and infrastructure experience.
A focused video briefing for leaders and IT teams working through this page.
HIPAA Compliance Video Series · Episode 03
Use this concise briefing alongside the guidance on this page to connect hipaa applicability with clear evidence, accountable ownership, and a practical next action.
The agreement establishes required terms, but the operating relationship determines exposure. A useful dossier shows why the vendor is needed, what PHI it handles, how access works, which subcontractors participate, how incidents and outages are handled, and how the relationship ends.
Trigger reassessment after acquisition, hosting-region change, major subprocessor change, new AI or analytics function, new remote-support model, security incident, recurring outage, contract revision, integration expansion, or a change in the type or volume of PHI.
A vendor with broad ePHI access, privileged administration, irreplaceable clinical function, large data volume, or difficult recovery deserves deeper diligence and more frequent review than a low-volume service with narrow access and easy replacement.
A certification, report, or questionnaire for a parent company or unrelated product may not cover the environment handling your PHI. Confirm scope, period, exceptions, complementary customer responsibilities, subservice organizations, and the remediation status of relevant findings.
A focused video briefing for leaders and IT teams working through this page.
HIPAA Compliance Video Series · Episode 07
Use this concise briefing alongside the guidance on this page to connect ephi inventory with clear evidence, accountable ownership, and a practical next action.
Request user and privileged-account structure, MFA and remote-support design, approval and termination process, representative session or access logs, service-account governance, and customer controls. Focus on the environment and support model used for your service.
Review incident-response roles, customer-notification workflow, evidence preservation, subcontractor coordination, exercises, and lessons from material events when available. Confirm contract timelines and the facts the vendor must supply for your breach analysis.
Review architecture, redundancy, backup scope, recovery objectives, restoration tests, dependency mapping, customer responsibilities, downtime communications, and recent availability issues. A generic continuity policy does not prove recovery of the purchased product.
Confirm entity, product, location, period, control scope, subservice organizations, exceptions, complementary customer controls, and management response. Track whether relevant findings are resolved and whether the report period leaves a material gap.
Document permitted uses, data location, retention, support copies, logs containing PHI, analytics, de-identification claims, AI use if any, individual-rights support, return or destruction, backups, and legal holds.
Many controls require customer action: MFA enforcement, role assignment, log review, secure integration, retention settings, backup choice, incident contacts, and user termination. Put these duties into the internal remediation register rather than assuming the vendor performs them.
When evidence is unavailable, document the limitation, risk implication, compensating safeguards, alternative evidence, contract leverage, decision owner, and review date. Lack of transparency can itself change the vendor’s risk tier.
Review EHR vendors, dental software vendors, billing companies, clearinghouses, cloud backup providers, IT support companies, MSPs, phone and messaging platforms, answering services, shredding providers, marketing vendors, consultants, accountants, attorneys, transcription services, and remote support tools when PHI may be involved.
The practice should know what each vendor can access, why they need it, how access is approved, how access is removed, and what happens if the vendor has an incident.
Use the HHS business associate materials to understand required relationships and contract provisions, then apply risk-based diligence to the actual service.
HHS explains business associate functions, contracts, permitted uses, safeguards, reporting, and subcontractor relationships. Review HHS guidance
HHS provides contract guidance and sample provisions for covered entities and business associates. Review sample BAA provisions
No. A BAA is important, but safeguards, access control, vendor review, and incident-response expectations are also needed.
Yes. Cloud services that store or process PHI should be reviewed for agreement coverage, security controls, access, retention, and incident notification.
If IT support can access systems containing PHI, the relationship should be reviewed for business associate obligations.
OC Security Audit can map PHI vendors, tier risk, examine access and evidence, review technical and operational gaps, and organize remediation and reassessment records.
IT Perfection can support implementation involving identity, remote access, Microsoft 365, endpoints, backup, servers, networks, monitoring, and vendor-transition projects.
A focused video briefing for leaders and IT teams working through this page.
HIPAA Compliance Video Series · Episode 13
Use this concise briefing alongside the guidance on this page to connect hipaa evidence readiness with clear evidence, accountable ownership, and a practical next action.
