HIPAA requires covered entities to assess the security posture of every vendor who touches Protected Health Information before sharing data. An informal email or a signed BAA alone is not sufficient — OCR expects documented evidence that you evaluated the vendor's safeguards.
Any vendor that creates, receives, maintains, or transmits PHI on your behalf is a Business Associate under HIPAA. These four categories cover most of the vendors that health-tech companies and healthcare providers use.
Any SaaS platform that stores patient records, appointment data, or billing information containing PHI. This includes EHR vendors, practice management software, cloud storage services, and data warehouses that process health data.
Highest inherent risk — assess before onboardingManaged service providers, data centre operators, hosting companies, and IT support contractors who may access systems containing PHI. Even if their primary service is not health data, system-level access creates HIPAA exposure.
Assess based on system access scopeMedical billing companies, clearinghouses, and revenue cycle management providers handle sensitive financial and clinical data. They are explicitly defined as Business Associates under 45 CFR §160.103 and require the same safeguard assessment.
Mandatory BAA + security assessmentData analytics platforms, AI/ML model providers, and population health vendors that process de-identified or identified patient data. If re-identification risk exists, full HIPAA obligations apply regardless of how the vendor classifies the data.
Assess data classification + re-identification riskOCR enforcement actions consistently cite failures in these six areas. A thorough vendor assessment documents your evaluation of each one before PHI is shared.
How does the vendor restrict access to PHI? Are unique user IDs enforced? Is multi-factor authentication required for staff who access health data? Workforce access should be limited to the minimum necessary to perform the job — document how the vendor enforces this.
Key documents: access control policy, MFA configuration evidenceHIPAA's technical safeguards require encryption as an addressable specification — meaning the vendor must either implement it or document a justified alternative. In practice, any vendor that does not encrypt PHI at rest and in transit represents an unacceptable residual risk. Verify encryption standards (AES-256, TLS 1.2+) explicitly.
Ask for: encryption policy, data flow diagrams showing where PHI is encryptedHIPAA requires Business Associates to notify covered entities of breaches within 60 days of discovery. Verify that the vendor has a documented breach response procedure, knows their obligation to notify you, and has a contact for breach reporting. Test this by asking when they last notified a covered entity.
Your BAA must flow down to the vendor's sub-processors. Ask for a list of sub-processors who may access PHI, and verify that they have equivalent BAAs and safeguards in place. Many breaches occur at the sub-processor level because this chain is not properly documented or enforced.
Red flag: vendors who refuse to disclose sub-processors or cannot provide their BAA chainThe HIPAA Security Rule requires Business Associates to train their workforce on security policies and procedures. Ask for evidence of HIPAA-specific training — completion certificates, training schedule, or confirmation that new hires receive training before accessing PHI.
Vendors who hold PHI must have documented data backup and contingency plans. In the event of a ransomware attack or system failure, how quickly can they restore access to PHI? Ask for their Recovery Time Objective (RTO) and Recovery Point Objective (RPO) and verify these are tested regularly.
OCR looks for: documented BCP, tested recovery procedures, last test dateMost health-tech companies start with a manual approach — email questionnaires, shared drives, spreadsheets. Here is how that compares to a structured vendor risk assessment platform.
VendorAuditly covers the complete HIPAA vendor assessment lifecycle — from pre-onboarding questionnaires to certificate tracking and audit evidence export.
Create a vendor entry for each Business Associate, categorising them by data access scope (PHI volume, sensitivity) and operational criticality. VendorAuditly uses this to set inherent risk and determine which assessment template to send.
Use the pre-built HIPAA security questionnaire template covering all six assessment areas above. Vendors complete the form via a unique link — no login required. Automatic reminders chase non-responders so you don't have to.
Attach the signed BAA to the vendor record alongside any SOC2 Type II or HITRUST certifications. VendorAuditly tracks expiry dates and alerts you before certificates lapse — preventing gaps that regulators interpret as failures in oversight.
After each assessment, VendorAuditly calculates a risk rating for each Business Associate based on questionnaire responses, certification status, and document completeness. Vendors with gaps appear clearly flagged in the dashboard with the specific items outstanding.
When OCR requests evidence of your Business Associate oversight programme, export the complete evidence pack: questionnaire responses with dates, BAA records, certification status, and risk assessments for every vendor. This is the documentation that demonstrates due diligence.
Pre-built HIPAA questionnaire templates. Automated BAA tracking. Evidence packs ready for OCR audits. VendorAuditly gives health-tech and healthcare teams the structured vendor oversight that HIPAA requires — without the enterprise price tag.