Healthcare practices depend on vendors. HIPAA risk grows when vendors can access PHI but agreements, access controls, security expectations, and incident notification duties are unclear.
The agreement establishes required terms, but the operating relationship determines exposure. A useful dossier shows why the vendor is needed, what PHI it handles, how access works, which subcontractors participate, how incidents and outages are handled, and how the relationship ends.
Trigger reassessment after acquisition, hosting-region change, major subprocessor change, new AI or analytics function, new remote-support model, security incident, recurring outage, contract revision, integration expansion, or a change in the type or volume of PHI.
A vendor with broad ePHI access, privileged administration, irreplaceable clinical function, large data volume, or difficult recovery deserves deeper diligence and more frequent review than a low-volume service with narrow access and easy replacement.
A certification, report, or questionnaire for a parent company or unrelated product may not cover the environment handling your PHI. Confirm scope, period, exceptions, complementary customer responsibilities, subservice organizations, and the remediation status of relevant findings.
Request user and privileged-account structure, MFA and remote-support design, approval and termination process, representative session or access logs, service-account governance, and customer controls. Focus on the environment and support model used for your service.
Review incident-response roles, customer-notification workflow, evidence preservation, subcontractor coordination, exercises, and lessons from material events when available. Confirm contract timelines and the facts the vendor must supply for your breach analysis.
Review architecture, redundancy, backup scope, recovery objectives, restoration tests, dependency mapping, customer responsibilities, downtime communications, and recent availability issues. A generic continuity policy does not prove recovery of the purchased product.
Confirm entity, product, location, period, control scope, subservice organizations, exceptions, complementary customer controls, and management response. Track whether relevant findings are resolved and whether the report period leaves a material gap.
Document permitted uses, data location, retention, support copies, logs containing PHI, analytics, de-identification claims, AI use if any, individual-rights support, return or destruction, backups, and legal holds.
Many controls require customer action: MFA enforcement, role assignment, log review, secure integration, retention settings, backup choice, incident contacts, and user termination. Put these duties into the internal remediation register rather than assuming the vendor performs them.
When evidence is unavailable, document the limitation, risk implication, compensating safeguards, alternative evidence, contract leverage, decision owner, and review date. Lack of transparency can itself change the vendor’s risk tier.
Review EHR vendors, dental software vendors, billing companies, clearinghouses, cloud backup providers, IT support companies, MSPs, phone and messaging platforms, answering services, shredding providers, marketing vendors, consultants, accountants, attorneys, transcription services, and remote support tools when PHI may be involved.
The practice should know what each vendor can access, why they need it, how access is approved, how access is removed, and what happens if the vendor has an incident.
Use the HHS business associate materials to understand required relationships and contract provisions, then apply risk-based diligence to the actual service.
HHS explains business associate functions, contracts, permitted uses, safeguards, reporting, and subcontractor relationships. Review HHS guidance
HHS provides contract guidance and sample provisions for covered entities and business associates. Review sample BAA provisions
No. A BAA is important, but safeguards, access control, vendor review, and incident-response expectations are also needed.
Yes. Cloud services that store or process PHI should be reviewed for agreement coverage, security controls, access, retention, and incident notification.
If IT support can access systems containing PHI, the relationship should be reviewed for business associate obligations.
OC Security Audit can map PHI vendors, tier risk, examine access and evidence, review technical and operational gaps, and organize remediation and reassessment records.
IT Perfection can support implementation involving identity, remote access, Microsoft 365, endpoints, backup, servers, networks, monitoring, and vendor-transition projects.
We use essential technologies to operate and protect this website. With your permission, optional analytics and advertising technologies help us understand site use and measure outreach. You can accept optional cookies or manage your choices at any time.