HIPAA-Compliant Vendor Risk Management for Hospitalist Management Companies

Hospitalist management companies may rely on vendors for billing, clinical technology, IT support, transcription, analytics, and other services. When those services involve protected health information (PHI), managing the relationship means more than signing a contract: you need to understand the vendor’s role, assess security risks, limit access, and plan for incidents and contract termination.

Start by identifying whether your company is acting as a covered entity, a business associate, or both in a particular relationship. The roles depend on the services and PHI involved, so do not assume every hospitalist company or vendor has the same HIPAA status. HHS explains that covered providers and business associates have different responsibilities and that a covered entity’s business associate must be covered by a written agreement. See HHS guidance on covered entities and business associates.

Which vendors may qualify as HIPAA business associates?

A vendor may be a business associate when, on behalf of a covered entity or another business associate, it performs a function or service involving PHI. The service—not simply the vendor’s label or the fact that it has a contract—determines whether a business associate relationship exists.

For a hospitalist company, potential business associates may include billing and claims processors, coding services, EHR or cloud-hosting providers, IT support vendors, transcription services, analytics firms, and consultants who access PHI while performing contracted work. HHS identifies billing, claims processing, practice management, cloud services, and IT support as examples when the work involves PHI. Review HHS’s business associate examples and guidance.

A vendor that sells software but cannot access PHI may not be a business associate on that basis alone. Conversely, a vendor that hosts patient information or accesses it while troubleshooting may qualify. A narrow exception applies to transmission-only conduits with only transient access; a cloud provider that stores ePHI generally is not treated as a mere conduit. See HHS’s software-vendor FAQ and HHS’s cloud-conduit guidance.

Map the flow of PHI through your organization and its vendors, including subcontractors. If your company is a business associate to a hospital, a vendor handling PHI on your company’s behalf may be a business associate subcontractor. The contract chain should reflect the actual data flow and responsibilities.

How should hospitalist companies assess vendor security risks before onboarding?

Before a vendor receives, maintains, or can access PHI, document what information it will handle, why it needs it, where it will be stored or transmitted, who can access it, and which subcontractors support the service. Consider whether the vendor’s service could affect patient care, the availability of records, or your company’s ability to meet its obligations to a hospital or other covered entity.

HIPAA requires covered entities and business associates to conduct an accurate and thorough risk analysis of threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI, and to manage identified risks. A vendor questionnaire can inform your review, but it does not replace your own risk analysis. See 45 CFR § 164.308 and HHS guidance on risk analysis.

As part of your vendor security risk assessment, request evidence proportionate to the vendor’s access and the sensitivity of the PHI. This may include a summary of the vendor’s risk analysis, security policies, incident response procedures, access-control practices, recent independent assessment results, and testing or remediation summaries. These are practical due-diligence examples, not a federally prescribed checklist. A vendor’s certification or assessment does not replace a required business associate agreement or your organization’s own HIPAA responsibilities; HHS requires the written arrangement specified by the rules. See HHS guidance on business associate certification.

Record the decision, unresolved risks, required safeguards, and who approved the relationship. If important evidence is unavailable or a material risk remains unaddressed, consider delaying PHI access, requiring corrective actions, narrowing the service, or choosing another vendor.

What should a business associate agreement include?

A HIPAA business associate agreement (BAA) must establish the vendor’s permitted and required uses and disclosures of PHI and restrict other uses or disclosures. It must also require appropriate safeguards and, where applicable, compliance with Security Rule requirements for ePHI.

Address the operational details in the agreement, including:

• What PHI the vendor may use or disclose, and for which services and purposes.
• Required safeguards, including the vendor’s responsibilities for workforce access and security incidents.
• How and when the vendor must report unauthorized uses or disclosures, security incidents, and breaches of unsecured PHI.
• How the vendor will ensure that business associate subcontractors accept the required restrictions and protections.
• How the vendor will support access, amendment, and accounting obligations when the information it holds is needed for those purposes.
• What happens to PHI at termination, and what protections apply if return or destruction is infeasible.
• The covered entity’s right to terminate when the business associate materially violates the agreement.

These requirements are set out in 45 CFR § 164.504(e). A business associate must also ensure that subcontractors handling PHI agree to the same applicable restrictions and conditions. The BAA should work alongside the services contract: define responsibilities clearly, set practical reporting timelines, and avoid language that conflicts with how the service actually operates.

How can vendor access to protected health information be controlled?

Limit vendor access to the systems, records, and data needed for the contracted service. Apply the minimum necessary standard where it applies, and align the vendor’s permitted uses and disclosures with the covered entity’s policies. The standard generally calls for reasonable limits on PHI use, disclosure, and requests; it does not apply to disclosures to or requests by a health care provider for treatment purposes. See HHS guidance on the minimum necessary standard.

Use individual accounts rather than shared credentials, assign access by role, restrict administrative privileges, and remove or change access when a vendor worker’s role changes or the work ends. HIPAA’s technical safeguards include access controls, unique user identification, audit controls, and person or entity authentication. See 45 CFR § 164.312.

Multifactor authentication can strengthen access to remote, privileged, or otherwise sensitive systems. Treat it as a risk-based safeguard to evaluate and document—not as a universally named, standalone HIPAA requirement. Decide which safeguards are reasonable and appropriate for the particular systems and risks, then capture them in your security requirements and vendor agreement.

How should companies monitor vendors and track remediation?

Vendor oversight should continue after onboarding. Set a documented, risk-based review schedule and identify events that trigger an earlier reassessment, such as a new subcontractor, a major technology change, a new PHI use, a security incident, or a material change in the vendor’s controls. HIPAA does not prescribe one universal reassessment interval for every vendor.

Monitor whether agreed safeguards remain in place. Depending on the vendor’s risk tier, this may include reviewing updated security evidence, confirming access lists, checking incident and audit information, and following up on open findings. HIPAA requires regular review of information-system activity, such as audit logs and access reports, as part of the Security Rule’s security management process. See 45 CFR § 164.308(a)(1).

Track each identified gap with an owner, risk rating, corrective action, due date, and closure evidence. If you know of a pattern of activity or practice that materially violates a business associate’s obligations, take reasonable steps to cure the problem or end the violation. If those steps fail, the regulation calls for termination when feasible. See 45 CFR § 164.504(e)(1).

What steps should follow a vendor breach or significant security change?

Use the response process in your agreement and incident plan. Ask the vendor to report promptly, preserve relevant evidence, contain the incident, and provide enough detail for your team to assess what happened. Identify the systems and PHI involved, the individuals potentially affected, the date of discovery, the safeguards in place, and any subcontractors involved. A significant security change should also prompt a review of the vendor’s risk, access, and contractual obligations.

A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is an outside federal deadline, not a recommended target for your contract: parties can agree to a shorter reporting period so the covered entity has time to investigate and meet its own responsibilities. See HHS’s Breach Notification Rule guidance.

Coordinate the assessment with your privacy, security, legal, and operational leads, and with the covered entity when your company is acting as its business associate. Document containment, risk assessment, mitigation, decisions about notification, and corrective actions. A vendor’s initial report does not by itself determine whether notifications are legally required; assess the facts under the applicable HIPAA requirements and your organization’s role.

How should protected health information be returned or deleted when a contract ends?

Plan for termination before onboarding. The BAA should specify how the vendor will return or destroy PHI, the format and timing of any return, how deletion will be verified, and how access will be revoked. Include data held by subcontractors and consider copies in backups, support systems, and other storage locations.

At termination, return or destroy PHI if feasible. If that is infeasible, the BAA must extend its protections to the retained information and limit further uses and disclosures to the purposes that make return or destruction infeasible. The HIPAA Rules generally do not require a business associate to keep ePHI after its services end. See 45 CFR § 164.504(e)(2)(ii)(J) and HHS guidance on ePHI after services end. Other legal or contractual retention duties may still apply.

Confirm the company has regained the PHI it needs for its operations and obligations, disable vendor accounts and credentials, and retain documentation of return, destruction, or any justified retention. A sound vendor risk program connects these steps: identify the relationship, assess and limit risk, put obligations in writing, monitor performance, and manage incidents and termination.

FAQs

When does a hospitalist company need a business associate agreement with a vendor?

When the vendor performs a service on behalf of a covered entity or business associate that involves PHI, and the vendor is not part of the covered entity’s workforce or otherwise exempt. Have the agreement in place before allowing the vendor access to PHI. The specific relationship depends on the service and data flow. See HHS business associate guidance.

What security evidence should a vendor provide before onboarding?

Request evidence appropriate to the vendor’s access and risk, such as a risk-analysis summary, security policies, access-control practices, incident response procedures, and relevant independent assessment or testing results. HIPAA does not prescribe one universal evidence packet, and a certification does not replace the BAA or your own risk analysis.

How often should vendors with access to protected health information be reassessed?

HIPAA does not set one fixed reassessment interval for all vendors. Establish and document a risk-based schedule, with more frequent review where the vendor has extensive or sensitive access, and reassess sooner after a major service, system, subcontractor, or security change.

What should the company do when a vendor relationship ends?

Follow the BAA to arrange return or destruction of PHI, verify completion where feasible, address any data that cannot feasibly be returned or destroyed, and revoke the vendor’s access. Document the transition and confirm that your company retains the PHI needed to meet its own obligations.