HIPAA-Compliant Vendor Risk Management for Sober Living Home Operators

Which vendors may handle protected health information

Protected health information (PHI) is individually identifiable health information that a covered entity or business associate creates, receives, maintains, or transmits, subject to HIPAA’s definitions and exceptions. PHI can be in electronic, paper, or oral form. A vendor’s role depends on what it does with the information and on whose behalf—not simply on its industry or the label in its contract.

If your organization is a HIPAA covered entity, a vendor may be a business associate when it performs a service or function for you that involves PHI. Examples may include billing services, electronic health record or case-management platforms, cloud storage providers, managed IT services, transcription companies, and records-destruction vendors—when their work involves handling your PHI. HHS explains that covered entities must have a written business associate arrangement with business associates that handle PHI on their behalf in its guidance on covered entities and business associates.

Make an inventory of vendors that may receive, store, or access residents’ identifiable health or treatment information. Include vendors with access to records even if they do not routinely view them. Then assess each vendor’s actual role and the information involved before deciding whether a business associate agreement is required.

How to determine whether HIPAA applies to a sober living home

Start with a covered entity determination. HIPAA applies to health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a transaction for which HHS has adopted a standard. A provider does not become a covered entity merely by using email or keeping health-related records; the provider must meet the applicable definition and transaction criteria. See HHS’s Summary of the HIPAA Privacy Rule.

A sober living home that primarily provides housing or peer support is not automatically a HIPAA covered entity just because residents discuss recovery or the operator holds sensitive information. The analysis can change if the operator furnishes health care and meets the electronic-transaction criteria, or if it performs services involving PHI on behalf of a covered entity as a business associate. Consider the operator’s actual services, billing practices, contracts, and relationships with health care providers or plans.

HIPAA may not be the only applicable privacy law. Federal regulations at 42 CFR Part 2 may apply to a federally assisted program that provides substance use disorder diagnosis, treatment, or referral for treatment. Housing alone does not establish that a program is covered; assess the program’s functions and federal-assistance status separately. HHS states that the Part 2 compliance date was February 16, 2026, in its Part 2 overview. Ask qualified counsel to review uncertain or overlapping obligations.

What to include in a business associate agreement

If you are a covered entity and a vendor is your business associate, put a business associate agreement (BAA) in place before allowing the vendor to handle PHI. A BAA should fit the vendor’s actual services and limit information use to authorized purposes. It is not a substitute for reviewing the vendor’s safeguards or for your own compliance work.

At a minimum, address the required contract terms, including:

• Permitted and required uses and disclosures of PHI, and a restriction on other uses or disclosures.
• Appropriate safeguards for PHI, including applicable Security Rule requirements for electronic PHI.
• Prompt reporting of unauthorized uses or disclosures, security incidents, and breaches of unsecured PHI. Set a specific reporting deadline that allows you time to assess and meet any obligations.
• Requirements for the vendor to bind subcontractors that handle PHI to applicable privacy and security restrictions.
• Vendor cooperation with applicable access, amendment, accounting, and HHS review obligations.
• Return or destruction of PHI at termination, if feasible, and the steps to take if return or destruction is not feasible.
• Your right to terminate the arrangement for a material violation.

These are among the elements described in HHS’s sample business associate agreement provisions. The agreement should identify who will investigate an incident, preserve evidence, provide affected-person information, and handle notifications if the parties agree to delegate those tasks.

How to assess vendor security and privacy safeguards

Before sharing PHI, assess whether the vendor’s safeguards fit the sensitivity of the data, the service, and the risks of access, loss, or disclosure. For covered entities and business associates, the HIPAA Security Rule requires an accurate and thorough risk analysis for electronic PHI and reasonable and appropriate safeguards. HHS’s risk analysis guidance explains that the analysis should account for ePHI across systems and sources, including vendors.

Use a consistent review process, such as a security questionnaire, document review, and discussion with the vendor’s security contact. Depending on the service, ask how the vendor:

• Limits access to authorized users and removes access when it is no longer needed.
• Protects data in transit and at rest, including how it manages encryption and authentication.
• Logs and reviews access, detects security incidents, and responds to suspected or confirmed incidents.
• Backs up data, tests recovery, and manages system outages or other disruptions.
• Trains relevant personnel and manages workforce access to PHI.
• Controls subcontractors, data locations, retention, and secure return or disposal of information.
• Tests or evaluates safeguards and addresses identified weaknesses.

Do not treat any single certificate, questionnaire, or security report as proof of HIPAA compliance. Evaluate the evidence in context, note gaps and compensating measures, and limit the PHI shared to what the vendor needs for its work. Encryption is an important control to consider, but HHS notes that encryption alone does not adequately safeguard ePHI in every respect in its cloud computing guidance.

How to document vendor due diligence and ongoing monitoring

Keep a vendor register showing each service, the data involved, the vendor’s access, the covered-entity or business-associate relationship, the BAA status, and the person responsible for oversight. Retain the assessment materials, contract and amendments, identified risks, decisions, remediation plans, and approval to share PHI.

Make monitoring proportionate to risk. Reassess when the vendor changes its services, subcontractors, data handling, or security controls; when your own systems or data flows change; and after a significant incident or identified control weakness. Track remediation commitments to completion, review whether the vendor still needs the data, and remove access when the service ends.

For regulated entities, the Security Rule requires documentation of specified policies, procedures, actions, activities, and assessments. HHS says the required documentation must generally be kept for six years from its creation or the date it was last in effect, whichever is later, and updated when relevant environmental or organizational changes occur. See the HHS Summary of the HIPAA Security Rule. Keep vendor oversight records in a way that supports your broader HIPAA Security Rule risk analysis and demonstrates how you addressed identified risks.

What to do after a vendor data breach

Use your incident-response process as soon as a vendor reports a suspected incident. Confirm what happened, when it was discovered, what systems and information were involved, whether the information was unsecured PHI, and which people may be affected. Ask the vendor to preserve relevant evidence, contain the incident, investigate its scope, and provide updates on a defined schedule. Document your decisions and coordinate with privacy, security, legal, and communications leads as appropriate.

Do not assume that every security incident is a reportable breach. Assess the facts under the applicable rule and document the conclusion. Under HIPAA, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery; the BAA can require a shorter deadline. HHS describes the business associate’s reporting duty and covered-entity notification duties in its Breach Notification Rule guidance.

If you are the covered entity, determine whether affected individuals, HHS, or the media must be notified and who will send each notice. For example, the HIPAA rule generally requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery; a breach affecting 500 or more residents of a state or jurisdiction also triggers media notice. Document any determination that notification is not required. If Part 2 applies, assess its separate breach notification requirements as well.

Effective vendor risk management starts with determining which rules apply, identifying vendors that handle protected information, and matching safeguards and contract terms to the risks. Keep oversight current, and respond promptly and methodically when a vendor reports an incident.

FAQs.

Does HIPAA apply to every sober living home?

No. HIPAA does not apply to every organization that holds health-related information. A sober living operator must assess whether it meets the definition of a covered entity or acts as a business associate. Separately, 42 CFR Part 2 may apply to qualifying federally assisted substance use disorder programs; housing alone does not determine coverage.

When does a sober living home operator need a business associate agreement?

A HIPAA covered entity generally needs a written BAA before a vendor handles PHI on its behalf as a business associate. An operator that is not a covered entity may itself need a BAA if it performs services involving PHI on behalf of a covered entity as a business associate. Determine the parties’ actual roles and functions before sharing information.

What vendor safeguards should operators review before sharing protected health information?

Review access controls, authentication, encryption, logging, incident response, backups and recovery, workforce practices, subcontractor oversight, data retention, and secure return or disposal. Tailor the review to the vendor’s role and the information involved, document identified risks, and confirm appropriate contractual terms where a BAA is required.

What should operators do if a vendor reports a breach?

Promptly confirm the incident’s scope, affected information and individuals, discovery date, containment, and investigation status. Preserve documentation, involve the appropriate privacy, security, and legal contacts, and assess notification duties under applicable law. If HIPAA applies, a business associate must notify its covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI; the BAA may set a shorter reporting deadline.