HIPAA Vendor Risk Management for Newly Acquired Physician Practices

Acquiring a physician practice means taking a fresh look at how its vendors handle patient information. A complete HIPAA vendor risk management process helps you identify which relationships require business associate agreements, assess risks to protected health information (PHI), and address gaps as the practice joins your organization.

Which vendors qualify as business associates under HIPAA?

A vendor’s role—not its industry label—determines whether it is a business associate. Generally, a vendor qualifies as a business associate when it performs a service on behalf of a covered entity that involves creating, receiving, maintaining, or transmitting PHI. A vendor can also qualify if its service involves disclosing PHI to the vendor.

Common examples include billing and practice-management companies, EHR hosts, IT support providers with access to electronic PHI, medical transcription services, and cloud service providers that store or process PHI. A business associate’s subcontractor may also qualify if it handles PHI on the business associate’s behalf. In that case, the business associate—not typically the physician practice—must obtain the subcontractor’s written assurances. See HHS guidance on business associates.

Review what each vendor actually does and what information it can access. A company’s statement that it is “HIPAA compliant” does not determine its legal status or replace a required agreement.

How should vendor relationships be reviewed during acquisition diligence?

Start with a complete inventory of vendors and the services they provide. Compare the list against contracts, invoices, system records, and interviews with practice staff; informal tools or support arrangements may not appear in a central contract file.

For each relationship, document what PHI the vendor handles, why it needs the information, whether it can access systems remotely, and which subcontractors may be involved. Collect applicable business associate agreements (BAAs), service contracts, security assessments or other available security evidence, incident records, and any open vendor corrective action plans. These are useful diligence records, not a HIPAA-prescribed document checklist.

Review agreement terms for duration, renewal, assignment or change-of-control provisions, permitted uses, security responsibilities, breach notification obligations, data retention, and PHI return or destruction when services end. Confirm with transaction counsel which legal entity will operate the practice after closing and whether agreements need to be updated or replaced. HIPAA does not make the acquisition itself a substitute for an appropriate written arrangement with a business associate.

What must a HIPAA-compliant business associate agreement include?

HIPAA requires a written contract or other qualifying arrangement that sets limits and obligations for the business associate’s handling of PHI. The agreement should clearly identify the services covered and describe the permitted and required uses and disclosures of PHI. The required provisions are set out in 45 CFR § 164.504(e).

Among other requirements, a BAA must address the business associate’s obligation to:

• Use appropriate safeguards and comply with applicable Security Rule requirements for electronic PHI.
• Report impermissible uses or disclosures, security incidents, and breaches as required by HIPAA and the agreement.
• Ensure that a business associate subcontractor handling PHI agrees in writing to applicable restrictions and conditions.
• Support applicable individual rights, including access, amendment, and accounting of disclosures, and make relevant records available to HHS.
• Return or destroy PHI at termination when feasible; if that is infeasible, continue protecting it and limit further use or disclosure.

The agreement must authorize termination if the covered entity determines that the business associate violated a material term. Set practical reporting deadlines and cooperation procedures in the contract so the practice can investigate an incident and meet its own obligations. HHS explains the required BAA elements and related subcontractor responsibilities in its business associate guidance.

How can organizations assess vendor security risks after an acquisition?

Reassess the practice’s HIPAA Security Rule risk analysis to account for the acquired systems, vendors, data flows, and business operations. The Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI. HHS notes that a change in ownership is an example of a circumstance that can prompt reassessment; HIPAA does not set one universal schedule for repeating the analysis. See HHS guidance on risk analysis and 45 CFR § 164.308.

Assess the vendor relationship in context: what PHI is involved, how it moves between systems, who can access it, and what could happen if confidentiality, integrity, or availability were compromised. Review available evidence about access controls, authentication, security monitoring, backups, incident response, recovery, and subcontractors. Ask about unresolved incidents and remediation, and compare the answers with your own risk analysis rather than treating a questionnaire or certification as proof of HIPAA compliance.

Document identified risks, their likelihood and potential impact, and the safeguards or corrective actions selected. Give closer attention to vendors with broad or privileged access, large amounts of PHI, critical operational roles, or unresolved security concerns.

How should vendor gaps be addressed during post-acquisition integration?

Prioritize gaps that create immediate exposure, such as a vendor accessing PHI without a required BAA, unapproved accounts that remain active, or a serious security weakness. Where appropriate, restrict or suspend access while you put interim safeguards in place and confirm a safe way to maintain patient care and essential operations.

For each remaining issue, create a vendor corrective action plan with a named owner, specific tasks, target dates, evidence of completion, and a follow-up review. Update agreements and vendor records, remove unnecessary access, and document risk decisions. If a known pattern of activity constitutes a material breach or violation, HIPAA calls for reasonable steps to cure the breach or end the violation and, if those steps fail, termination when feasible. See HHS guidance on business associate contract enforcement.

Align vendor incident procedures with the practice’s response process. A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; contract terms can set a shorter reporting deadline to give the practice time to investigate and meet its obligations. HHS describes these breach notification obligations.

When does a software vendor not qualify as a business associate?

Selling or licensing software alone does not make a company a business associate if the vendor does not access the practice’s PHI. For example, a vendor may provide software that the practice installs and operates itself, with no vendor access to the information.

The answer can change if the vendor hosts data, provides troubleshooting that involves PHI access, or delivers support that requires access to systems containing PHI. In those circumstances, the vendor may be a business associate, and a BAA may be required before it receives access. HHS distinguishes software sales without PHI access from hosting or support that involves PHI in its software vendor FAQ.

A narrow exception may apply to a person or service that acts only as a conduit for PHI transmission, with temporary storage incidental to that transmission. It generally does not cover a service that routinely accesses or stores PHI to perform work for the practice. For an acquisition, the practical test is what the vendor can access and what service it performs—not simply whether it supplies software.

In summary, effective HIPAA vendor risk management after an acquisition combines accurate vendor classification, current written agreements, a documented risk analysis, and tracked remediation. Revisit the assessment when ownership, systems, vendor services, or PHI flows change.

FAQs

Does every vendor serving a physician practice need a business associate agreement?

No. A BAA is generally required when a vendor performs services on behalf of the practice that involve PHI, but not simply because a company sells a product or serves the practice. Vendors with no PHI access and certain providers receiving information for treatment may not require a BAA. Assess each relationship based on its actual function and access.

What vendor records should be reviewed before acquiring a physician practice?

Review the vendor inventory, service contracts, applicable BAAs, data-flow and access information, identified subcontractors, available security assessments, incident records, and open remediation plans. Also check contract terms for renewal, assignment, data retention, incident reporting, and PHI return or destruction. The specific records available will vary by practice.

How soon should vendor security risks be reassessed after an acquisition?

Begin reassessment as part of acquisition diligence and integration, prioritizing risks before new or expanded PHI access is granted. HIPAA does not specify a universal number of days or a fixed reassessment interval. HHS guidance identifies a change in ownership as a circumstance that can prompt a risk analysis and says the frequency depends on the organization’s circumstances.

Does selling software alone make a vendor a HIPAA business associate?

No. A software seller generally is not a business associate if it has no access to the practice’s PHI. Hosting the software or providing support that involves PHI access may create a business associate relationship, so evaluate the vendor’s actual service and access before deciding whether a BAA is needed.