HIPAA Compliance Checklist for Computer-Assisted Coding Vendors

A computer-assisted coding vendor’s HIPAA responsibilities depend on how it handles protected health information (PHI), the services it provides, and its agreements with healthcare organizations. Use this checklist to identify the safeguards, records, and procedures your organization should review. It is practical guidance, not a certification or a substitute for legal advice.

Which vendors handle PHI and need business associate agreements?

A vendor generally acts as a business associate when it performs a service for a HIPAA-covered entity that involves creating, receiving, maintaining, or transmitting PHI on the entity’s behalf. A computer-assisted coding vendor may meet that definition if its platform hosts patient records, processes them for coding, or gives vendor staff access for support or troubleshooting. HHS guidance on software vendors and business associates explains that simply selling software does not create a business associate relationship when the vendor has no access to PHI.

Before disclosing PHI to a vendor that is a business associate, the covered entity generally needs a written Business associate agreement (BAA). The agreement should define permitted uses and disclosures, require appropriate safeguards, address reporting of incidents and breaches, cover subcontractors, and specify what happens to PHI when the services end. Vendors should review the BAA against their actual data flows and service practices rather than relying on a general product description. HHS sample business associate agreement provisions describe required contract elements.

If your company uses a subcontractor—such as a cloud provider or support service—to handle PHI on its behalf, assess whether that subcontractor is also a business associate and arrange the required written assurances before sharing PHI. A downstream agreement should carry forward relevant safeguards and reporting obligations. HHS business associate guidance explains the obligations for business associate subcontractors.

Keep an inventory of vendors and subcontractors, the PHI each can access, the services they provide, and the status and scope of their agreements. HIPAA does not expressly require a customer to audit every vendor’s security practices, but customers may seek documentation or audit rights through contracts as part of their own risk management. HHS guidance on cloud service provider documentation and audits clarifies this distinction.

How should vendors protect PHI in transit and at rest?

Start by mapping where electronic PHI is received, displayed, processed, stored, backed up, and transmitted—including coder workstations, servers, cloud environments, support tools, and exports. Then use appropriate administrative, physical, and technical access control safeguards to protect confidentiality, integrity, and availability. The Security Rule requires safeguards, while the specific measures should reflect the organization’s circumstances and risk analysis. HHS’s Security Rule overview summarizes these general requirements. Documenting these data flows can help clarify where PHI is handled.

Assess PHI encryption for both transmission and storage. Encryption is an addressable Security Rule implementation specification, not a blanket requirement to use a particular technology in every circumstance. The organization must assess whether encryption is reasonable and appropriate; if it is not, it must document that decision and implement an appropriate alternative when one is reasonable and appropriate. HHS guidance on encryption explains how addressable specifications work.

As practical safeguards, restrict access to approved users, use individual accounts and authentication, review access rights when roles change, and monitor system activity. Protect encryption keys separately from encrypted data where applicable, and control downloads, printing, copying, and exports. These measures should be selected and documented based on the vendor’s systems and risk assessment, rather than treated as a universal prescribed configuration.

Apply the minimum necessary standard where it governs a use or disclosure, and set access according to job responsibilities and the coding task. The standard has exceptions, including disclosures to or requests by healthcare providers for treatment purposes; whether an exception applies depends on the specific use or disclosure. HHS’s minimum necessary guidance explains the rule and its exceptions.

What security risk assessments and remediation records are required?

Conduct and document a HIPAA Security Rule risk analysis that covers the electronic PHI your organization creates, receives, maintains, or transmits. Identify where the data resides and moves, assess relevant threats and vulnerabilities, consider the likelihood and impact of risks, and evaluate existing safeguards. HHS explains that there is no single required risk-analysis format or method, but the analysis must be thorough and its documentation maintained. HHS guidance on risk analysis describes the scope and documentation expectations.

Follow the analysis with risk management: decide how to reduce identified risks to a reasonable and appropriate level, assign owners, set target dates, and track open items through remediation or documented acceptance. Reassess when meaningful changes—such as a new coding workflow, system, subcontractor, or security incident—could affect risk. HIPAA does not prescribe a universal annual schedule for risk analysis; the process should be ongoing and responsive to the organization’s circumstances. HHS guidance on risk analysis and risk management distinguishes assessment from mitigation.

Keep records that show what was assessed, what decisions were made, and whether corrective actions were completed. This can include the risk analysis, risk-management plans, implementation notes, security evaluations, and documented decisions about addressable specifications. Preserve the evidence needed to explain how identified risks were handled and how the safeguards are maintained.

Which HIPAA policies, officers, and training records should vendors maintain?

Business associates subject to the Security Rule should identify a responsible security official and document who is accountable for developing and implementing security policies. HIPAA requires the Security Rule security official for covered entities and business associates; this is distinct from a general recommendation to assign someone to coordinate privacy matters. HHS’s audit protocol for assigned security responsibility describes the requirement.

Maintain written, current procedures for security management, access authorization, workforce security, security awareness and training, incident response, contingency planning, and documentation. Keep relevant BAA and subcontractor records, too. The Privacy Rule’s requirements do not apply to business associates in precisely the same way they apply to covered entities; business associate obligations include direct requirements under HIPAA and duties established by their agreements. HHS contract guidance explains how agreements set permitted uses and related obligations.

Provide Security Rule awareness and training to your workforce, including management, and retain records showing what training was delivered and completed. Address employer-specific policies, coding workflows, secure handling of PHI, access rules, and how to report suspected incidents. HIPAA does not establish a universal annual certificate-renewal requirement; training should be appropriate to the organization and responsive to changes in its environment and operations. HHS’s Security Rule materials cover workforce training and related administrative safeguards.

How should vendors manage incidents, breaches, and recovery plans?

Maintain written procedures for identifying, reporting, responding to, mitigating, and documenting security incidents. Make sure staff know how to escalate suspected events, including misdirected records, compromised credentials, unauthorized access, lost devices, or unexpected PHI exposure. A business associate’s agreement must address reporting security incidents to its covered entity or business associate customer; the parties can specify operational details and faster reporting deadlines in the agreement. HHS guidance on security-incident reporting explains these obligations.

Assess whether an impermissible use or disclosure of unsecured PHI constitutes a breach, document the basis for the decision, and follow the applicable breach notification procedures. A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; the BAA may require earlier notice. The covered entity generally handles notifications to affected individuals and government agencies, unless the agreement assigns relevant responsibilities differently. HHS’s Breach Notification Rule guidance describes the requirements.

Prepare and test a disaster recovery plan as part of a broader contingency plan. Consider retrievable backups, restoration priorities, emergency operations, and procedures for continuing authorized access to ePHI during system outages or disasters. Encryption alone does not ensure that data remains available or intact, so recovery planning and testing should address those risks as well. HHS guidance on HIPAA and cloud computing explains why encryption does not replace contingency planning.

How can computer-assisted coding applications support HIPAA compliance?

A computer-assisted coding application can support an organization’s safeguards when it provides controls that can be configured to its workflows. Depending on the product, useful capabilities may include role-based permissions, user authentication, audit logs, secure data transfer, configurable retention, and controls for exports. Evaluate each feature in the actual deployment; a feature’s presence does not prove it is enabled, appropriate, or sufficient for HIPAA compliance.

Before implementation, map how the application receives records, what information it processes, where it stores data, which users and subcontractors can access it, and how information is returned or deleted when the service ends. Confirm that the BAA and service terms match those data flows. Include the application and related interfaces, devices, and support processes in the organization’s HIPAA Security Rule risk analysis.

Do not download patient records to coder computers by default. Prefer an approved workflow that limits local storage when feasible. If downloading is necessary and authorized, document the business need and apply appropriate safeguards—such as controlled access, encryption where reasonable and appropriate, secure storage, and deletion procedures—consistent with the organization’s risk analysis and policies.

Ultimately, software can help implement safeguards and produce useful evidence, but it cannot by itself make a vendor HIPAA compliant. The vendor remains responsible for its applicable obligations, workforce practices, agreements, risk management, and incident response. A useful checklist ties each control to a named owner, supporting documentation, and a process for review and improvement.

FAQs

When does a computer-assisted coding vendor need a business associate agreement?

A vendor generally needs a BAA before a covered entity discloses PHI to it when the vendor provides a service involving PHI on the entity’s behalf. Hosting patient records or accessing them for coding, support, or troubleshooting can create a business associate relationship. Merely selling software without access to PHI does not by itself create that relationship. HHS guidance on software vendors provides examples.

How should a coding vendor assess risks to PHI?

Inventory the electronic PHI the vendor creates, receives, maintains, or transmits; identify where it is stored and accessed; assess threats, vulnerabilities, and existing safeguards; and document risk-management decisions and remediation. Include the coding application, connected systems, endpoints, support access, and subcontractors in scope. HHS risk-analysis guidance explains the required scope and documentation.

Should patient records be downloaded to coder computers?

Not by default. Use an approved workflow that avoids local copies when practical. If a download is necessary and authorized, limit access and protect, retain, and securely dispose of the records according to the vendor’s policies, agreement, and risk analysis. HIPAA does not make every local download categorically prohibited, but the organization must safeguard the PHI.

What incident and breach response procedures should a coding vendor maintain?

Maintain procedures to identify, report, investigate, contain, mitigate, and document security incidents. Define escalation contacts and reporting timelines in the BAA and internal procedures. Assess suspected breaches of unsecured PHI, document the conclusion, and notify the covered entity without unreasonable delay and no later than 60 days after discovery when the Breach Notification Rule requires it. HHS breach-notification guidance provides further detail.