HIPAA-Compliant Vendor Risk Management for Addiction Medicine Telehealth Providers

Telehealth vendors can handle sensitive information about a patient’s substance use disorder (SUD) diagnosis, treatment, or referral. To manage that risk, you need to understand which privacy rules apply, map how vendors handle data, and confirm that contracts and safeguards match the services they provide.

Which telehealth vendors may be HIPAA business associates?

A vendor may be a HIPAA business associate when it performs a service for a covered provider that involves creating, receiving, maintaining, or transmitting protected health information (PHI). For telehealth, this can include a video platform that stores recordings, a cloud host for electronic health records, a patient-messaging app, a transcription service, or an IT contractor with access to systems containing electronic protected health information (ePHI). HHS’s business associate guidance lists comparable services and vendors.

Consider what the vendor actually does—not just what its product is called. A vendor that stores visit recordings or transcripts, handles patient scheduling on your behalf, or accesses ePHI while providing technical support may be a business associate. A cloud provider may also qualify even if it stores only encrypted data and cannot decrypt it. HHS cloud-computing guidance explains that encryption without a decryption key does not, by itself, remove business associate status.

Not every vendor needs a business associate agreement (BAA). A telecommunications provider that only transmits a call, with no more than transient access to PHI and no routine access to its contents, may act as a conduit rather than a business associate. A vendor that only sells software and does not access PHI may also fall outside the definition. Assess the actual data flow, storage, support access, and service relationship before deciding. HHS telehealth guidance describes the conduit exception and gives examples of when an app that stores session information requires a BAA.

When does 42 CFR Part 2 apply to vendor relationships?

42 CFR Part 2 applies to qualifying federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment. Addiction medicine providers should assess whether their program meets the definition of a Part 2 program; offering telehealth alone does not determine whether Part 2 applies. The current Part 2 regulations define program coverage and federal assistance, and HHS’s Part 2 overview explains which programs and records are covered.

When a Part 2 program uses a vendor to handle Part 2 records, the vendor relationship requires careful review. The regulations recognize qualified service organizations (QSOs), including certain service providers and, in specified circumstances, HIPAA business associates working for a Part 2 program that is also a covered entity. A QSO agreement must address the vendor’s Part 2 obligations, including acknowledging that it is bound by Part 2 when handling program records and agreeing, if necessary, to resist unauthorized efforts to obtain patient-identifying information. See the Part 2 definitions and applicability provisions.

Do not assume that a standard BAA automatically addresses every Part 2 requirement. If a vendor is both a business associate and a QSO, one written agreement may address both roles if it contains the terms required for each. If the provider relies on another permitted basis for disclosure, such as patient consent, assess that basis and any related vendor obligations instead. Have qualified counsel review the arrangement when Part 2 records will be shared. HHS’s Part 2 data-exchange guidance describes the QSO agreement and consent approaches.

The 2024 Part 2 final rule’s compliance date was February 16, 2026. Providers should assess vendor arrangements against the requirements now in effect, rather than treating the final rule as a proposal. HHS confirms the compliance date.

How should providers assess vendor privacy and security safeguards?

Start with an inventory of vendors and the information each one can access. Map ePHI and Part 2 records from collection through transmission, storage, support, backup, and deletion. Include less obvious data, such as appointment details, portal messages, medication information, intake forms, call recordings, and session transcripts.

Use your HIPAA Security Rule risk analysis to evaluate risks to the confidentiality, integrity, and availability of ePHI. Consider how a vendor’s systems, staff, subcontractors, and service locations could affect patient data, and document risks and planned corrective actions. HHS states that the risk analysis is required, must be documented, and should be updated as circumstances change; it does not prescribe one format or a single schedule for every organization. See HHS guidance on the HIPAA Security Rule risk analysis.

For addiction medicine, assess whether vendor access could expose a person’s connection to SUD services, diagnosis, treatment, or referral. Ask how the vendor handles secondary uses, analytics, AI features, customer support, and subcontractors. Confirm that contractual permissions, retention settings, and actual product configuration align with your privacy obligations and the purpose for which the vendor receives the information.

Use security audit reports and other evidence to inform—not replace—your own assessment. Review the report’s scope, testing period, system boundaries, exclusions, findings, and remediation status. HIPAA does not generally require a vendor to provide audit documentation or grant a customer audit access; HHS notes that customers may seek those assurances based on their own risk analysis and risk management. HHS cloud-computing guidance explains this distinction.

What safeguards should vendors use to protect telehealth data?

HIPAA requires reasonable and appropriate administrative, physical, and technical safeguards for ePHI, but it does not prescribe one technology stack for every provider. Evaluate safeguards in light of your risk analysis, the data involved, and the vendor’s role. HHS’s Security Rule summary describes the rule’s standards and its flexible, risk-based approach.

• Administrative safeguards: Review workforce training and access procedures, security-incident response, vendor oversight, contingency planning, and processes for managing subcontractors.
• Physical safeguards: Ask how the vendor controls access to facilities, devices, and systems that store or process ePHI, including equipment disposal and remote support.
• Technical safeguards: Look for unique user access, role-based permissions, authentication, audit logging, integrity protections, and safeguards for ePHI transmitted over networks.
• Data lifecycle protections: Confirm how the vendor handles backups, retention, export, secure return, and destruction when services end.

Encryption is an important safeguard to evaluate for transmissions and stored records, including recordings and transcripts. However, the HIPAA Security Rule treats encryption as an addressable implementation specification rather than an unconditional requirement in every case. An organization must assess whether it is reasonable and appropriate; if it is not, the organization must document its decision and consider an equivalent alternative measure where appropriate. See HHS’s explanation of encryption under the Security Rule.

Consider penetration testing and vulnerability management as part of vendor due diligence when appropriate to the service’s risk. HIPAA does not name penetration testing as a universal, standalone requirement. Ask for a recent testing summary, the scope and date of testing, high-level findings, and evidence that material issues were addressed. HHS telehealth guidance specifically identifies risks such as intercepted transmissions and unauthorized access to recordings or transcripts as matters to assess. HHS guidance on remote communication technologies provides examples.

Which agreements and validation documents should providers review?

For a business associate, review a BAA that clearly defines permitted and required uses of PHI, requires appropriate safeguards, addresses subcontractors, and sets out incident and breach reporting duties. It should also cover the return or destruction of PHI when the relationship ends, where feasible. HHS summarizes the required BAA elements in its business associate guidance.

If Part 2 applies, determine whether the vendor’s role requires QSO terms or another permitted basis for disclosure. Ensure that the written agreement includes applicable Part 2 commitments as well as HIPAA terms when the vendor has both roles. Review provisions for subcontractors, access to records, permitted disclosures, incident reporting, and the handling of records at termination. The Part 2 regulations set out the applicable QSO definition and related rules.

Request evidence that helps you evaluate the vendor’s controls, such as a current security audit report, a penetration-testing summary, policies relevant to the service, a security-incident response overview, and information about material subcontractors. These documents are due-diligence tools; a particular report or certification is not a substitute for the required BAA or for your own risk analysis. HHS states that HIPAA does not generally require a vendor to provide audit documentation, while allowing customers to seek additional assurances based on risk. See HHS guidance on cloud vendors and security documentation.

Check that each document covers the exact service, product configuration, and data involved. A report may exclude the relevant product, a subcontractor, or the period you need to evaluate. Record what evidence you reviewed, what gaps remain, and who is responsible for addressing them.

How can providers verify vendor compliance and address security risks?

Verify vendor assurances against the service you will use. Confirm where data is stored, which vendor personnel can access it, whether the service creates recordings or transcripts, how support sessions are handled, and whether the vendor uses subcontractors. Check that the contract, security documentation, and configuration describe the same data flows and protections.

Assess reports for their coverage dates, control scope, exceptions, and unresolved findings. Ask the vendor to explain gaps that affect your use case and provide a corrective-action plan with owners and target dates. A report or vendor statement can support your decision, but it does not establish that your own HIPAA obligations have been met. HHS describes compliance as an ongoing process that includes risk analysis, safeguards, documentation, and periodic evaluation. See HHS’s Security Rule compliance guidance.

After onboarding, monitor changes that could alter risk: new features, subcontractors, hosting locations, data uses, incidents, or changes to retention and support practices. Set a process for reporting and responding to security incidents, reviewing vendor evidence periodically, and reassessing risk when the service or your environment changes. If a vendor cannot meet an important safeguard or agreement term, document the risk decision and consider limiting data access, applying compensating controls, pausing the service, or selecting another vendor.

Effective vendor risk management connects the right agreements to verified safeguards and ongoing oversight, with additional care for Part 2 records. Use your risk analysis to guide decisions, keep evidence current, and act on identified gaps.

FAQs.

Does every telehealth vendor need a business associate agreement?

No. A BAA is generally required when a vendor is a business associate—such as when it creates, receives, maintains, or transmits PHI on behalf of a covered provider. A telecommunications provider that only transmits a call with transient access may qualify for the conduit exception, and a software vendor that does not access PHI may not be a business associate. Assess the vendor’s actual services and data access. HHS explains when telehealth vendors need a BAA.

When does a telehealth vendor need a Part 2 qualified service organization agreement?

When a vendor provides services to a Part 2 program and handles Part 2 records, assess whether the vendor qualifies as a QSO and whether a QSO agreement or another permitted basis for disclosure applies. The agreement must address the QSO’s Part 2 obligations. A vendor may also be a HIPAA business associate; if so, ensure the written arrangement addresses both sets of applicable requirements. The Part 2 regulations define QSOs and the circumstances in which their services may involve Part 2 records.

What security documents should addiction medicine providers request from vendors?

Request documents that help you assess the vendor’s actual service and risk, such as a security audit report, a penetration-testing summary, information about incident response and subcontractors, and relevant security policies or attestations. Check each document’s date, scope, exclusions, and remediation status. HIPAA does not generally require vendors to provide audit documentation, and no report replaces your risk analysis or required agreements. HHS discusses customer requests for vendor security assurances.

Do HIPAA requirements apply to electronic protected health information sent through telehealth?

Yes. The HIPAA Security Rule applies to ePHI that a covered entity or business associate creates, receives, maintains, or transmits, including ePHI involved in telehealth. Providers must apply reasonable and appropriate safeguards and address relevant transmission risks in their risk analysis. HHS’s Security Rule summary describes these protections, and HHS telehealth guidance discusses risks involving transmissions, recordings, and transcripts.