Why Vendor Management Is a HIPAA Requirement

Any third-party organization that creates, receives, maintains, or transmits PHI on your behalf is a Business Associate. HIPAA requires you to have a signed Business Associate Agreement (BAA) with every such vendor before they can access your patients' information. This includes your EHR vendor, billing company, cloud storage provider, IT managed services firm, transcription service, and many others.

Covered entities are legally responsible for the actions of their business associates. If a vendor suffers a breach and you do not have a BAA with them, you share liability — and you will have difficulty explaining the absence of a BAA to OCR.

Adding a Vendor

From the Privacy Officer dashboard, navigate to Vendors and click Add Vendor. For each vendor you will record:

Vendor name and website
Vendor type — EHR, billing, IT, cloud storage, etc.
Primary contact name and email — the person at the vendor responsible for compliance
Services provided — a brief description of what they do for you
PHI access level — view only, create/edit, store, transmit
BAA status — signed, pending, not started

Tracking BAA Status

The vendor list shows BAA status for each vendor with color coding: green for signed, yellow for pending, red for not started. The portal also tracks:

BAA execution date
BAA expiration date (if applicable)
Date of last review
Notes field for documenting vendor-specific compliance details

Important: BAAs do not expire in the same way contracts do — they remain in effect for as long as the vendor relationship exists. However, you should review BAAs whenever your vendor relationship changes significantly, when the vendor updates their privacy practices, or at minimum every 2–3 years. Set a review date for each BAA in the portal.

Using the Vendor Questionnaire

For new vendors or high-risk vendors, the portal includes a Vendor Security Questionnaire that you can send directly from the vendor profile. The questionnaire covers:

Data security certifications (SOC 2, ISO 27001, HITRUST)
Encryption practices
Subcontractor/subprocessor policies
Incident response and breach notification procedures
Employee training and access controls

Vendors complete the questionnaire in a secure web portal. Their responses are stored against their vendor profile and feed into the risk score calculation.

Understanding Risk Scores

The portal assigns each vendor a risk score from 1–10 based on the PHI access level they have been granted and their questionnaire responses. Vendors with high PHI access and poor security controls receive high risk scores. Use these scores to prioritize your vendor management attention — high-risk vendors warrant more frequent BAA reviews and closer monitoring.

Tip: Start by adding your top 5 vendors — the ones with the most access to PHI. You can add others over time. A partial vendor list that is actively maintained is far better than no vendor list at all.