HIPAA Vendor Due Diligence Checklist

Evaluate Healthcare Vendors Before Signing Business Associate Agreements

Quick Answer

Effective vendor due diligence requires comprehensive evaluation of security controls, BAA requirements, SOC 2 certification, encryption standards, and breach notification procedures. Organizations must document vendor risk assessments before establishing any business relationships involving PHI.

Pre-Evaluation Requirements

Vendor Type Classification +

Classify vendor as Business Associate (handles PHI) or non-BA. BAs require BAAs; non-BAs need alternative safeguards. Document classification rationale with legal review.

Compliance History Investigation +

Research vendor's compliance history: HHS OCR enforcement actions, HIPAA complaints, breach notifications. Check SEC filings for publicly traded vendors.

Financial Stability Review +

Evaluate vendor financial stability and viability. Assess bankruptcy risk, acquisition potential, and continuation of services if vendor fails.

Security Questionnaire Requirements

Access Control Questions

Verify multi-factor authentication, role-based access controls, audit logging, password policies, and termination procedures.

Data Protection Measures

Confirm encryption at rest (AES-256), in transit (TLS 1.2+), tokenization, de-identification capabilities, and key management.

Physical Safeguards

Ask about facility access controls, video surveillance, badge systems, clean desk policies, and media destruction procedures.

Incident Response

Require incident response plan, breach notification timelines, forensics capabilities, and communication procedures.

Vulnerability Management

Assess penetration testing frequency, vulnerability scanning, patch management, and third-party risk management programs.

Backup & Disaster Recovery

Verify backup frequency, recovery time objectives, redundancy, encryption of backups, and disaster recovery testing.

Certification & Compliance Verification

SOC 2 Type II - Verify current certification (Type II required for security controls validation over time)

ISO 27001 - Information security management system certification

HIPAA Compliance Statement - Written attestation of HIPAA compliance

FedRAMP Authorization - If cloud provider (Authority to Operate)

PCI DSS Certification - If handling payment card data

State Privacy Law Compliance - CCPA, HIPAA Omnibus Rule requirements

Business Associate Agreement (BAA) Essentials

Required BA Obligations +

Administrative, physical, and technical safeguards
Subcontractor management and downstream BAAs
Audit controls and access restrictions
Breach notification timelines (60 days minimum)
Data return or destruction upon contract termination

Covered Entity Rights in BAA +

Right to audit and compliance monitoring
Right to inspect vendor systems and records
Right to remediate non-compliance
Right to terminate for material breach
Indemnification for vendor breaches

Permitted Uses and Disclosures +

Clearly define permitted uses: operations, legal compliance, management. Prohibit uses for marketing, research, or other purposes without explicit authorization.

SOC 2 Assessment Checklist

Security Principle - System protects against unauthorized access

Availability Principle - System remains available and performs as intended

Processing Integrity Principle - System processes complete, accurate data

Confidentiality Principle - Confidential information is protected

Privacy Principle - Personal information is handled per privacy commitments

Report Scope Definition - Verify services covered by SOC 2 audit

Technical Infrastructure Review

Network Security

Firewall configuration, intrusion detection/prevention systems, VPN requirements for access, network segmentation, DDoS protection.

Data Storage

Database encryption, field-level encryption, secure deletion, data retention policies, backup strategies.

Application Security

OWASP top 10 protections, API security, authentication mechanisms, session management, code review processes.

Logging & Monitoring

Event logging duration, SIEM implementation, real-time monitoring, alert thresholds, log retention.

Vulnerability Management

Scanning frequency, patching timelines, vulnerability severity ratings, disclosure procedures.

Third-Party Risk

Vendor management program, component assessment, known vulnerability tracking, dependency management.

Vendor Interview Checklist

Security Leadership Questions +

Who is Chief Information Security Officer?
What is security budget percentage?
How are security incidents escalated?
What training do employees receive?

Operational Continuity +

What is recovery time objective (RTO)?
What is recovery point objective (RPO)?
How frequently is disaster recovery tested?
Where are backups stored geographically?

Breach & Incident Response +

What is breach notification timeline?
Who are incident response contacts?
Can vendor provide forensic reports?
How are affected customers notified?

Documentation & Approval Process

Vendor Risk Assessment - Document evaluation results and risk rating

Executive Approval - CISO/CIO sign-off on vendor relationship

Legal Review - Attorney review of BAA and contract terms

Compliance Verification - Compliance officer confirmation of safeguards

Ongoing Monitoring Plan - Establish schedule for annual re-assessment

Key Takeaways

Due diligence is mandatory before establishing vendor relationships involving PHI
BAAs must include all required security obligations and breach notification terms
SOC 2 Type II certification provides strong validation of security controls over time
Security questionnaires must be comprehensive and vendor-specific
Document all assessment results for regulatory audit readiness