HIPAA Compliance Checklist for Emergency Department Information System Vendors

An emergency department information system (EDIS) can handle patient identifiers, triage notes, diagnoses, orders, and other electronic protected health information (ePHI). If you provide, host, maintain, or support a system that handles a hospital’s ePHI, assess your role under HIPAA and document how your safeguards address the system’s risks.

Use this checklist to evaluate vendor responsibilities, contract terms, access, system safeguards, and incident readiness. HIPAA requires reasonable and appropriate safeguards; a checklist can help organize your review but does not, by itself, establish compliance. See the HHS Summary of the HIPAA Security Rule.

Determine whether your vendor is a HIPAA business associate

A vendor generally qualifies as a business associate when it performs a regulated function or service on behalf of a covered entity—such as a hospital—and the work involves creating, receiving, maintaining, or transmitting protected health information. For example, an EDIS vendor may qualify if it hosts patient data, provides system maintenance or support that requires ePHI access, or processes information for the hospital. The role depends on what the vendor actually does, not just what the contract calls it. See HHS guidance on business associates.

• Map the vendor’s services, systems, support activities, and data flows, including remote troubleshooting and backups.
• Determine whether the vendor creates, receives, maintains, or transmits the hospital’s ePHI, including through a hosting provider or other service partner.
• Identify subcontractors that handle ePHI on the vendor’s behalf and assess whether they also have business associate obligations.
• Document any claimed exception carefully. For example, HHS describes the conduit exception as limited to entities that transmit PHI and only temporarily store it; routine access to perform a service is different.

When a vendor is a business associate, it has direct obligations under applicable HIPAA Rules. The Security Rule applies to business associates as well as covered entities.

Document business associate and subcontractor agreements

Before a business associate handles ePHI for a covered entity, the parties generally need a written business associate agreement (BAA) that meets HIPAA requirements. The agreement should make the permitted uses and disclosures clear and require safeguards for ePHI. See the eCFR provision on business associate contracts and HHS sample BAA provisions.

• Define the vendor’s permitted and required uses and disclosures of PHI, and prohibit other uses or disclosures except as allowed by the agreement or law.
• Require appropriate safeguards, including applicable Security Rule requirements for ePHI.
• Set out how the vendor will report security incidents and impermissible uses or disclosures. Specify operational contacts and reporting procedures; the contract may require faster reporting than HIPAA’s outside deadline for breach notification.
• Require the vendor to bind subcontractors that handle ePHI to the applicable restrictions and conditions through written agreements.
• Address assistance with applicable patient requests and the covered entity’s compliance duties, as relevant to the services.
• Specify what happens to PHI when the agreement ends, including return or destruction when feasible, and address termination for a material breach.

Do not assume a vendor’s BAA automatically covers every downstream provider. HHS says a business associate must have an appropriate agreement with a subcontractor before disclosing PHI to that subcontractor for work on behalf of a covered entity. Review the vendor’s subcontractor chain and how changes to that chain will be communicated.

Assess ePHI risks and document risk-management actions

A Security Rule risk analysis must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. For an EDIS, consider the complete data path: intake and triage, clinical documentation, orders, interfaces, user support, hosting, backups, and eventual data disposal. The administrative safeguards regulation requires risk analysis and risk management; HHS risk analysis guidance describes documenting ePHI locations, threats, vulnerabilities, current safeguards, and corrective actions.

• Inventory where ePHI is stored, received, maintained, or transmitted, including endpoints, interfaces, cloud services, and portable media.
• Identify risks relevant to emergency department operations, such as unauthorized access, incorrect or altered records, outages, failed interfaces, ransomware, power loss, or unavailable support staff.
• Record existing safeguards and assess whether they are configured and used effectively.
• Document identified risks, their potential impact, chosen safeguards or alternative measures, responsible owners, and remediation status.
• Review the analysis when systems, vendors, workflows, or risks change, and use the results to guide ongoing risk management.

HIPAA does not prescribe one specific risk-analysis format or a single security solution for every vendor. Safeguards should be reasonable and appropriate to the organization’s circumstances and risks, and required documentation should be maintained. See HHS guidance on the Security Rule’s flexibility and documentation requirements.

Verify access controls and emergency access procedures

EDIS access should support fast clinical workflows without making patient records broadly available. The Security Rule requires technical access controls, person or entity authentication, and a unique user identification for tracking user identity. It also requires an emergency access procedure for obtaining necessary ePHI during an emergency. Review these requirements in 45 CFR § 164.312.

• Use role-based permissions so staff and vendor personnel receive access appropriate to their duties. Provide a process to approve, change, and promptly remove access.
• Support unique user identification for each user; avoid shared accounts that prevent reliable attribution of system activity.
• Define an emergency access procedure for authorized clinical access when ordinary access controls or systems are unavailable. Set out who may invoke it, how access is granted, and how use is reviewed afterward.
• Where the product supports emergency or “break-glass” access, consider requiring a reason, limiting scope and duration, and creating a reviewable record. These are practical design measures to support controlled access and accountability.
• Verify how vendor support access is authorized, authenticated, limited, monitored, and disabled when no longer needed.
• Evaluate automatic logoff and encryption against the organization’s circumstances and document the decision. These are addressable implementation specifications, not blanket “optional” controls; the regulation requires a reasonable, appropriate response and documentation where an alternative is used.

Review audit, integrity, and transmission safeguards

Audit controls must record and examine activity in information systems that contain or use ePHI. For an EDIS, logs can help investigate unusual access, changes to patient information, and vendor support activity. The Security Rule also requires safeguards for integrity and transmission security. See the technical safeguards regulation.

• Confirm the system records relevant actions, such as access to records, changes, administrative actions, and emergency-access events.
• Check that logs are protected against unauthorized alteration or deletion and can be reviewed by authorized personnel.
• Establish who reviews alerts and audit records, how suspicious activity is escalated, and how findings are documented.
• Assess integrity safeguards that help prevent or detect improper alteration or destruction of ePHI, including during interfaces and data exchange.
• Evaluate protections for ePHI transmitted across networks. Encryption is an addressable implementation specification under the Security Rule; determine whether it is reasonable and appropriate for the system and document the decision or any suitable alternative.
• Agree with the hospital on access to logs and incident evidence needed for investigations. HIPAA does not expressly require every vendor to let each customer audit its security practices, so specify any customer reporting, evidence, or audit rights in the BAA or other contract.

Apply administrative and physical safeguards to systems and facilities

Technical features are only part of the safeguards review. The Security Rule also addresses administrative safeguards and physical safeguards for systems, workstations, facilities, and media. Apply the requirements to the vendor’s own workforce and facilities, as well as to responsibilities shared with the hospital. See 45 CFR § 164.308 on administrative safeguards and 45 CFR § 164.310 on physical safeguards.

• Assign a security official responsible for developing and implementing required security policies and procedures.
• Train workforce members on applicable security policies and procedures, supervise access as appropriate, and apply sanctions for violations. Align vendor training with employer-specific policies where vendor staff work in or support a hospital environment.
• Use facility access controls, visitor procedures, and safeguards for workstations that can access ePHI.
• Control the receipt, movement, reuse, and disposal of devices and media containing ePHI. Remove ePHI before media are reused, and document disposal or other required actions.
• Periodically evaluate whether safeguards remain appropriate as technology, operations, or risks change.

Some Security Rule implementation specifications are labeled addressable. That does not make them automatically optional: determine whether each is reasonable and appropriate, implement it when appropriate, or document a reasonable alternative that achieves the standard’s purpose. See the HHS explanation of required and addressable specifications.

Prepare incident reporting, emergency operations, and data recovery procedures

Agree in advance how the vendor and hospital will respond to a suspected security incident, a breach involving unsecured PHI, or an EDIS outage. The Security Rule requires procedures to identify and respond to suspected or known security incidents, mitigate harmful effects where possible, and document incidents and outcomes. The agreement should make clear how the vendor escalates issues to the covered entity.

• Define incident contacts, escalation channels, information to preserve, investigation responsibilities, and coordination with the hospital.
• Set contractual timelines for reporting security incidents and suspected breaches. Under the Breach Notification Rule, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; the parties should not treat that maximum as a recommended operational response time. See the HHS Breach Notification Rule guidance.
• Prepare a contingency plan covering data backup, restoration, and continued protection of ePHI during emergency operations.
• Document how the hospital will continue critical emergency department workflows during a system outage, including the vendor’s role in recovery and the hospital’s role in clinical downtime procedures.
• Test backup restoration and recovery procedures, record results, and address gaps. Coordinate recovery priorities and communications with the hospital.
• Retain required policies, procedures, and Security Rule documentation for the applicable period; HHS summarizes a six-year documentation retention requirement.

In short, a sound vendor review connects the EDIS’s actual data flows to written agreements, a documented Security Rule risk analysis, role-appropriate access, system and facility safeguards, and tested incident and recovery procedures.

FAQs

When does an emergency department information system vendor qualify as a business associate?

A vendor generally qualifies when it performs a service for a covered hospital that involves creating, receiving, maintaining, or transmitting PHI—for example, hosting the EDIS, maintaining it with access to ePHI, or providing support that requires such access. Assess the actual service and data handling, not just the vendor’s label or whether staff routinely view patient records. See HHS business associate guidance.

What must a business associate agreement cover for ePHI?

A BAA must establish permitted and required uses and disclosures, require appropriate safeguards for ePHI, address reporting of impermissible uses and breaches, and require applicable protections for subcontractors. It also addresses matters such as cooperation with covered-entity duties, access to relevant records for HHS oversight, and the return or destruction of PHI when the agreement ends if feasible. Review HHS sample BAA provisions and the eCFR contract requirements.

Which access controls should vendors implement for emergency department systems?

Use unique user identification, access limited to authorized users, authentication, and audit controls. Establish an emergency access procedure for obtaining necessary ePHI during an emergency, then make emergency access reviewable. The specific safeguards should reflect the system’s risks and applicable Security Rule requirements; see 45 CFR § 164.312.

How should vendors prepare for ePHI incidents and service disruptions?

Maintain incident-response and escalation procedures, preserve relevant evidence, coordinate promptly with the covered entity, and document the incident and its outcome. Contractual procedures should support required breach reporting; a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. For service disruptions, maintain a contingency plan for backups, data restoration, and emergency-mode operations, and test recovery procedures. See the HHS Breach Notification Rule guidance and 45 CFR § 164.308.