Healthcare organizations depend on vendors for nearly everything: electronic health records, billing and claims processing, cloud hosting, telehealth, transcription, and IT support. Under HIPAA, many of those vendors are business associates, and the covered entity remains accountable for protecting patient data no matter who handles it.
This guide explains what HIPAA requires for vendor risk management, why a signed business associate agreement is not enough, and how to build a practical program for assessing and monitoring business associates.
Why HIPAA Vendor Risk Management Matters More Than Ever
The 2024 ransomware attack on Change Healthcare, a claims clearinghouse used across the industry, affected the health information of roughly 190 million people and disrupted payments to providers nationwide. It is the clearest example of how a single third party can become a single point of failure for thousands of healthcare organizations.
Regulators have taken note. Business associates have been directly liable for HIPAA Security Rule compliance since the 2013 Omnibus Rule, and HHS has proposed significantly stronger vendor oversight requirements (more on that below).
What Is a HIPAA Business Associate?
A business associate is a person or organization that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity. Common examples include:
- EHR and practice management software vendors
- Billing, coding, and claims processing companies
- Cloud hosting and data backup providers
- Managed IT and cybersecurity service providers
- Transcription, telehealth, and patient communication platforms
- Law firms, accountants, and consultants with access to PHI
Subcontractors of business associates that handle PHI are business associates too, and your business associates must have their own agreements with them.
What HIPAA Requires for Vendor Management Today
- Business associate agreements (BAAs). Covered entities must obtain satisfactory written assurances that a business associate will appropriately safeguard PHI before sharing it (45 CFR 164.308(b) and 164.502(e)). The required contents of a BAA are set out in 45 CFR 164.504(e) and 164.314(a).
- Risk analysis that includes vendors. The Security Rule requires an accurate and thorough assessment of risks to electronic PHI (45 CFR 164.308(a)(1)). Where ePHI lives with a vendor, that risk belongs in your analysis.
- Breach notification. Business associates must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery (45 CFR 164.410).
- Action on known violations. If a covered entity knows of a pattern of activity or practice by a business associate that materially breaches the BAA, it must take reasonable steps to cure the breach or end the violation.
Why a Signed BAA Is Not Vendor Due Diligence
Many healthcare organizations treat the BAA as the end of vendor oversight. It isn’t. A BAA is a contractual promise. It tells you nothing about whether the vendor actually encrypts data, enforces multi-factor authentication, tests its backups, or trains its staff. When a business associate is breached, “we had a BAA” does not demonstrate that you managed the risk.
Effective HIPAA vendor risk management verifies what the BAA promises through security questionnaires, independent audit reports such as SOC 2 Type II or HITRUST certification, and, for the most critical vendors, on-site assessments.
Proposed HIPAA Security Rule Changes for Business Associates
In January 2025, HHS published a proposed update to the HIPAA Security Rule, the first major revision in more than a decade. For vendor oversight, key proposals include:
- Annual written verification from business associates that they have implemented required technical safeguards, supported by an analysis from a qualified cybersecurity professional.
- 24-hour notification to covered entities when a business associate activates its contingency plan due to an emergency or other occurrence.
- More rigorous documentation of risk analyses, asset inventories, and security controls.
As of mid-2026, the rule had not been finalized, and HHS’s regulatory agenda pointed to a later final action date. However, the direction is clear, and organizations that begin verifying business associate safeguards now will be far better prepared. The current requirements above remain fully in force.
How to Build a HIPAA Vendor Risk Management Program
Step 1: Map where PHI goes
Identify every vendor that creates, receives, maintains, or transmits PHI, including vendors that only have remote system access. This inventory is the foundation of your program and your Security Rule risk analysis.
Step 2: Tier business associates by risk
A vendor hosting your entire patient database carries far more risk than a shredding company. Tier vendors by the volume and sensitivity of PHI they handle and how critical they are to patient care and revenue.
Step 3: Verify safeguards before sharing PHI
For high-risk business associates, review SOC 2 or HITRUST reports, security policies, incident response and contingency plans, and evidence of encryption, access controls, and workforce training.
Step 4: Execute and maintain strong BAAs
Beyond required terms, consider specifying notification timelines shorter than 60 days, subcontractor disclosure, audit rights, and the return or destruction of PHI at termination. Track BAA status in your vendor inventory.
Step 5: Monitor continuously
Reassess critical business associates at least annually, track remediation of findings, and monitor for breaches, financial instability, and service changes. A vendor that fails financially can disrupt care just as a cyberattack can, which is why financial health reviews belong in your program.
Step 6: Offboard securely
When a relationship ends, obtain written confirmation that PHI has been returned or destroyed and that all access has been revoked.
Frequently Asked Questions About HIPAA Vendor Risk Management
Is a business associate agreement enough for HIPAA compliance?
A BAA is required, but it is not sufficient on its own. Covered entities should also assess vendor risk as part of their Security Rule risk analysis and verify that business associates are actually safeguarding PHI.
Are business associates directly liable under HIPAA?
Yes. Since the 2013 Omnibus Rule, business associates are directly liable for compliance with the HIPAA Security Rule and certain Privacy Rule and Breach Notification Rule provisions.
How often should business associates be assessed?
High-risk business associates should be assessed at least annually. The proposed Security Rule update would formalize annual written verification of technical safeguards.
What should I request from a business associate during due diligence?
Common requests include a SOC 2 Type II report or HITRUST certification, a completed security questionnaire, the vendor’s HIPAA risk analysis summary, incident response and contingency plans, and proof of cyber insurance.
Has the new HIPAA Security Rule been finalized?
As of mid-2026, no. The proposed rule published in January 2025 was still pending. Check HHS for the latest status before making compliance decisions.
Strengthen Oversight of Your Business Associates
Continuiti Solutions helps healthcare organizations assess, document, and monitor business associates without adding staff. Our analysts perform due diligence, review SOC and HITRUST reports, and maintain your vendor records in our GRC Pro portal, included at no additional cost. Contact us to get started.
New to vendor risk? Start with our guide to third-party risk management for small and mid-sized businesses.
This article is for general information and is not legal advice. Consult your privacy officer or counsel about your organization’s specific HIPAA obligations.
