Computer-Assisted Coding Vendor Security Risk Assessment Checklist

Use this checklist to assess how a computer-assisted coding (CAC) vendor handles protected health information (PHI), including when the vendor’s software, support staff, or subcontractors can access it. Treat it as a practical risk-assessment aid—not as a substitute for your organization’s HIPAA Security Rule risk analysis, legal review, or security policies.

What data and systems does the CAC vendor access?

Map the PHI the vendor may create, receive, maintain, or transmit, and how it flows through the service. A CAC platform might process clinical notes, diagnoses, procedure details, patient identifiers, coding results, and related metadata. Confirm the actual data involved rather than relying on a general product description.

• List the data fields, document types, and patient populations the service can access.
• Trace data from your electronic health record (EHR) or other source systems through the CAC platform, interfaces, storage, support tools, and any return or export path.
• Identify hosting environments, data centers, backup locations, remote support channels, and any other systems that can store or expose PHI.
• Ask whether vendor staff or subcontractors can view production data, and under what circumstances, such as troubleshooting or implementation.
• Clarify whether the vendor uses PHI for analytics, product improvement, artificial-intelligence features, or other secondary purposes. Specify permitted uses in writing.
• Document how PHI is returned, retained, or securely destroyed when the service ends, subject to applicable legal and contractual requirements.

Determine whether the vendor meets the definition of a business associate based on the services it performs and its access to PHI. HHS explains that vendors providing certain services involving PHI may be business associates, and that the relationship generally requires a business associate agreement (BAA). Review HHS guidance on business associates.

How does the vendor protect PHI in transit and at rest?

Ask the vendor to describe its encryption controls for PHI in transit and at rest, including data moving between your systems and the vendor, within the service, and to backups. Request details on the protocols and configurations used, key management, and who can access or administer encryption keys.

• Confirm that network connections use appropriately protected encryption, including connections used for integrations and remote administration.
• Ask how PHI stored in databases, file systems, backups, caches, and portable media is protected.
• Clarify whether encryption keys are separated from the data they protect, how access is restricted, and how keys are rotated or revoked.
• Ask how the vendor handles data exports, temporary files, and PHI in lower environments used for testing or development.
• Check whether the vendor has a documented alternative safeguard if a particular encryption measure is not implemented.

The HIPAA Security Rule treats encryption specifications as addressable, not as a blanket, one-size-fits-all mandate. Addressable does not mean optional without analysis: the regulated organization must assess whether the measure is reasonable and appropriate, and document its decision and any equivalent alternative measure where applicable. See HHS guidance on encryption under the Security Rule.

What access controls and authentication safeguards are in place?

Evaluate how the vendor limits access to PHI for both its workforce and your users. Look for role-based access control that grants each user only the permissions needed for their job, along with processes for approving, reviewing, changing, and removing access.

• Confirm that each person has a unique user identity and that shared accounts are prohibited or tightly controlled.
• Review role definitions and permissions for coders, administrators, support staff, engineers, and subcontractors.
• Ask how the vendor approves privileged access, limits it to necessary tasks, and records its use.
• Check whether multifactor authentication is available and required for remote access, administrative accounts, and other higher-risk access.
• Ask how the vendor disables accounts promptly when a worker leaves or changes roles, and how it periodically reviews active accounts and permissions.
• Review session controls, failed-login protections, emergency access procedures, and logging of access to PHI.

HIPAA requires technical access controls and procedures to verify identity, but the safeguards selected must be appropriate to the organization’s risks. Multifactor authentication is a practical control to evaluate; do not assume that HIPAA expressly requires it for every system or user. HHS summarizes the Security Rule’s access-control and authentication standards in its HIPAA Security Rule guidance.

Coordinate vendor access with your own role assignments and minimum-necessary policies. HHS describes role-based access policies as a way to limit access according to workforce members’ job duties; review its minimum necessary guidance.

How are vulnerabilities, security incidents, and breaches managed?

Ask the vendor to explain how it identifies, prioritizes, and remediates vulnerabilities in the CAC application and the systems that support it. Review its processes for security testing, patching, risk acceptance, and communicating material issues that could affect your PHI.

• Request an overview of vulnerability scanning, penetration testing, remediation deadlines, and exception approvals.
• Ask how the vendor detects suspicious activity, investigates alerts, preserves evidence, and escalates incidents.
• Confirm that incident-response procedures cover the vendor’s subcontractors and relevant hosting or infrastructure providers.
• Check whether the vendor tests its response and recovery plans, including backups and restoration of service.
• Agree on how and when the vendor will report suspected security incidents, confirmed breaches, and material service disruptions.
• Ask what information the vendor will provide during an investigation, such as affected systems, dates, data categories, affected individuals when known, containment actions, and remediation.

Distinguish a security incident from a breach of unsecured PHI. A vendor should report and coordinate incidents under the BAA and your agreed procedures; not every incident necessarily constitutes a reportable breach. Under the HIPAA Breach Notification Rule, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is the federal outside limit, not a recommended target for every contract. Consider negotiating a shorter notice period that gives your organization time to investigate and meet its own obligations. See HHS breach notification guidance and the HHS audit protocol’s breach-notification provisions.

What evidence should you review during a vendor assessment?

Request evidence that helps you assess the specific service, systems, and PHI in scope. No single document proves that a vendor is secure or makes your organization compliant. Compare the vendor’s written policies and reports with the actual product, contract terms, access model, and risks you identified.

• A current SOC 2 Type II report, including its system description, reporting period, auditor’s opinion, exceptions, and any complementary user-entity controls that your organization must perform.
• A security overview or recent risk-assessment summary that covers the service and systems used to handle your PHI.
• Summaries of recent vulnerability assessments or penetration tests, along with remediation status for significant findings.
• Policies or summaries covering encryption, identity and access management, workforce training, incident response, business continuity, backups, and secure disposal.
• A list of relevant subcontractors and hosting providers, with an explanation of their roles and how they are contractually required to protect PHI.
• Incident history and corrective-action summaries relevant to the service, subject to reasonable confidentiality protections.
• Evidence that the vendor tests recovery and incident-response plans and tracks remediation through completion.

A SOC 2 Type II report can provide useful independent information about controls within its stated scope and reporting period, but it is not a HIPAA certification and should not replace your own assessment. Review the system description, included services, exceptions, and any controls assigned to you. The AICPA SOC resources describe SOC 2 reporting in relation to service-organization controls and trust services criteria.

HIPAA does not expressly require every business associate to provide customers with security documentation or permit customer audits. HHS notes that organizations may seek additional assurances, such as security documentation or audit rights, through the BAA, service-level agreement, or other documentation based on their risk analysis. See HHS guidance on documentation and audits of cloud service providers.

What contractual and regulatory obligations apply?

If the CAC vendor is your business associate, put the required terms in a written business associate agreement before allowing it to handle PHI. The BAA should align with the service agreement and spell out how the vendor may use and disclose PHI, how it safeguards PHI, and how it supports your compliance responsibilities.

• Define the services, permitted uses and disclosures of PHI, and limits on any other uses.
• Require the vendor to apply appropriate safeguards and to ensure that relevant subcontractors agree to applicable protections.
• Set incident and breach reporting procedures, including points of contact, the information to be supplied, and a contractual notice timeline.
• Specify how the vendor will support access, amendment, and accounting obligations when PHI it holds is needed to fulfill your responsibilities.
• Address return or destruction of PHI at termination, including what happens if destruction is infeasible.
• Establish cooperation, evidence-sharing, and escalation processes for investigations, audits, and material security issues.
• Check that retention, data location, and other service terms are consistent with your organization’s policies and legal obligations.

A BAA does not by itself establish that your organization or the vendor meets every HIPAA obligation. Covered entities and business associates have responsibilities under the HIPAA Security Rule, and the agreement should support—not replace—risk analysis and risk management. HHS describes core BAA terms and the business associate relationship in its business associate guidance and Security Rule summary.

How should risks be documented and reassessed?

Record your assessment so decision-makers can understand the vendor’s role, the evidence reviewed, identified risks, and the basis for accepting or treating those risks. Connect the vendor assessment to your organization’s broader HIPAA Security Rule risk analysis and risk-management process.

• Document the service and data flows, including the PHI involved, systems connected, and vendor or subcontractor access.
• For each finding, record the affected asset or process, potential impact, likelihood, existing safeguards, and any evidence or assumptions used.
• Assign an owner, treatment decision, target date, and follow-up evidence for each action item.
• Record residual risks and who approved their acceptance, together with any contractual conditions or compensating safeguards.
• Set a review schedule appropriate to the sensitivity of the data, the vendor’s access, and your organization’s risk-management practices.
• Reassess when significant changes occur, such as a new integration, expanded PHI use, change in hosting or subcontractors, major security incident, or material change in the vendor’s controls.

HIPAA requires an accurate and thorough risk analysis of risks and vulnerabilities to electronic PHI, along with risk management and periodic evaluation; it does not establish one universal annual vendor-assessment interval. HHS advises organizations to consider changes in the environment or operations when evaluating safeguards. Review HHS guidance on risk analysis and the HIPAA Security Rule summary.

In short, base your CAC vendor decision on documented data flows, appropriate technical and contractual safeguards, evidence that matches the service in scope, and a plan to address and revisit identified risks.

FAQs

What security documents should a CAC vendor provide?

Request documents that help you evaluate the service in scope, such as a SOC 2 Type II report, security and risk-assessment summaries, penetration-test or vulnerability-remediation summaries, incident-response and recovery procedures, encryption and access-control descriptions, and a list of relevant subcontractors. Review each document’s scope, date, exceptions, and relevance to your use of the service. HIPAA does not expressly require every vendor to provide these documents, so set reasonable evidence-sharing terms in your agreement based on your risk analysis. See HHS guidance on vendor documentation and audits.

How should a CAC vendor’s access to PHI be limited?

Limit access to the PHI and systems needed to provide the contracted service. Use role-based access control, unique accounts, restricted privileged access, timely account removal, and periodic access reviews. Require the vendor to explain and document support or emergency access, and use safeguards such as multifactor authentication where appropriate to the risk. Align those controls with your organization’s minimum-necessary policies and the vendor’s BAA.

What should a CAC vendor breach notification process include?

Set out how the vendor will promptly report suspected incidents and breaches, whom it will contact, and what information it will provide as the investigation develops. Include procedures for containment, evidence preservation, cooperation, updates, remediation, and identifying affected individuals where possible. HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery; your contract can set a shorter deadline. See HHS breach notification guidance.

How often should a CAC vendor security assessment be repeated?

Choose a review schedule based on your risk analysis rather than assuming HIPAA sets a universal annual vendor-assessment rule. Revisit the assessment periodically and when material changes could affect PHI, access, systems, subcontractors, or safeguards, or after a significant incident. Document the review and any resulting risk-treatment decisions. HHS guidance explains that risk analysis and safeguards should account for changing threats, technology, and operational conditions.