Interactive Patient Care System Vendor Security Risk Assessment Checklist

An interactive patient care system may handle information through bedside displays, education tools, surveys, messaging, entertainment features, or connected devices. Before choosing a vendor, assess how the system handles protected health information (PHI), how its safeguards work in your hospital’s environment, and what happens when the contract ends.

Use this checklist alongside your organization’s security risk analysis. HIPAA requires covered entities and business associates to assess risks to electronic PHI and implement reasonable and appropriate safeguards; a vendor review supports that work but does not, by itself, establish that your organization is compliant. See HHS’s Summary of the HIPAA Security Rule and HHS risk analysis guidance.

What patient data does the system collect, process, and store?

Ask the vendor for a data inventory and a clear description of how information moves through the system. Include the patient-facing application, management consoles, cloud services, support tools, analytics, backups, and any subcontractors. Identify what the system collects directly and what it receives from your electronic health record or other hospital systems.

• List the PHI and other data elements handled, such as names, room numbers, medical record numbers, diagnoses, care instructions, language preferences, survey responses, and usage records.
• Ask whether the system captures audio, video, images, voice commands, messages, or free-text responses—and whether those are stored, reviewed, or used for analytics.
• Document where data is processed and stored, including cloud regions, temporary caches, logs, backups, and support environments.
• Find out whether information is used for product analytics, service improvement, advertising, or model training. Require clear limits on secondary use and disclosure.
• Map which vendor employees, subcontractors, and hospital roles can access each data type, and why.

Ask for a data-flow diagram that shows collection, transmission, storage, access, and deletion. HHS recommends accounting for systems and applications that access or hold ePHI as part of a risk analysis; see its Guidance on Risk Analysis.

How does the vendor protect data in transit and at rest?

Request details on encryption at rest and in transit, including which data stores and communication paths are covered, how encryption keys are managed, and who can access them. Ask about safeguards for backups, removable media, local device storage, administrative connections, and data exchanged with hospital systems.

Verify the protocol and configuration in use rather than accepting a general statement that data is “encrypted.” Ask how the vendor detects unauthorized changes, protects secrets and credentials, and manages encryption keys during rotation, recovery, and staff or subcontractor changes.

HIPAA requires technical measures to guard against unauthorized access to ePHI transmitted over a network. Encryption is an addressable implementation specification under the current Security Rule, not an unconditional requirement in every circumstance: an organization must assess whether it is reasonable and appropriate and, if it is not, document its decision and any alternative measure. See HHS’s Summary of the HIPAA Security Rule and HHS’s encryption guidance.

How are user access, authentication, and permissions managed?

Review how the vendor provisions, changes, and removes accounts for patients, clinicians, administrators, support personnel, and automated services. Ask whether the system supports unique user identification, role-based access control, least-privilege permissions, and timely deactivation of accounts when access is no longer needed.

• Confirm that administrative and remote-support access is restricted, approved, and logged.
• Ask whether multifactor authentication is available and required for privileged, remote, and other high-risk access. Treat MFA as a security measure to evaluate based on risk and policy, not as a universal standalone HIPAA requirement.
• Check how the system handles shared bedside devices, automatic session timeouts, screen locking, patient changes, and access to records from previous occupants.
• Request examples of access reports and evidence that permissions can be reviewed and adjusted.
• Confirm that service accounts, API credentials, and other non-human identities are protected and have defined owners and permissions.

The HIPAA Security Rule calls for access controls, audit controls, and procedures to verify the identity of a person or entity seeking access to ePHI. Use the HHS Security Rule summary as a reference when reviewing the vendor’s controls and your organization’s responsibilities.

What are the vendor’s incident response and breach notification procedures?

Ask for the vendor’s written incident response process and clarify how it coordinates with your hospital. Determine how the vendor detects, investigates, contains, and remediates incidents, preserves relevant evidence, restores services, and shares updates during an investigation.

Review the contract and the HIPAA business associate agreement for the definition of a reportable security incident, notification contacts, required information, cooperation obligations, and notification timelines. Set a practical contractual deadline that gives your organization time to assess and meet its own reporting duties; do not rely only on the outer deadline in federal rules.

Under the HIPAA Breach Notification Rule, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. A business associate agreement may specify a shorter period. Ask the vendor how it will provide facts needed to assess the event, including affected individuals and the information involved. See HHS’s Breach Notification Rule guidance and HHS’s sample business associate agreement provisions.

How are integrations, devices, and network connections secured?

Include every connection in the assessment: EHR interfaces, identity services, nurse-call systems, bedside devices, wireless networks, vendor support tools, and third-party services. Ask for an architecture diagram, an inventory of connected devices, and a clear account of which party secures each part.

• For each interface, identify the data exchanged, the direction of flow, the authentication method, and the permissions granted.
• Ask how APIs and service credentials are stored, rotated, restricted, and monitored.
• Review network segmentation, remote access controls, and protections against unauthorized devices or connections.
• Find out how the vendor identifies vulnerabilities, prioritizes patches, communicates product security advisories, and supports devices that have reached end of life.
• Clarify how configuration changes, software updates, and emergency maintenance are tested, approved, and recorded.

HIPAA risk analysis covers risks and vulnerabilities to ePHI the organization creates, receives, maintains, or transmits, including through relevant systems and applications. Ask how the vendor’s vulnerability management process supports your own risk assessment. See HHS risk analysis guidance.

What security documentation and independent assessments should you review?

Request evidence that matches the system, service, deployment, and data in scope. Useful materials may include the vendor’s security policies, data-flow and architecture diagrams, risk assessment summary, penetration-test executive summary, vulnerability management process, incident response plan, business continuity materials, and access-control documentation.

When reviewing an independent assessment, check its date, scope, testing method, exclusions, and whether it covers the services and hosting environment your hospital will use. Ask how material findings were addressed and whether the vendor can provide an updated report or remediation evidence. A certificate, audit report, or vendor statement is evidence to evaluate—not proof, by itself, that your organization or the product is “HIPAA certified.”

HIPAA does not expressly require a business associate to provide security documentation or allow customer audits. HHS notes, however, that customers may seek additional assurances—such as documentation or audits—through a business associate agreement, service-level agreement, or other contract based on their risk analysis and risk management. See HHS’s guidance on cloud service provider documentation and audits.

What are the system’s data retention, deletion, and exit procedures?

Ask the vendor to define how long each category of data is kept, including PHI, audit logs, temporary files, support records, and backups. Confirm how retention periods are set, how legal holds or other preservation needs are handled, and whether your organization can export its data in a usable format before service ends.

Get written details about termination and deletion: what the vendor will return, what it will destroy, when deletion occurs, how backups and subcontractor-held data are addressed, and what evidence of completion it can provide. Clarify how the vendor protects any PHI it cannot feasibly return or destroy and restricts any continued use or disclosure.

If the vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity as a business associate, the business associate agreement must address return or destruction of PHI at termination when feasible. HHS also explains that protections must continue when return or destruction is infeasible. See HHS’s business associate contract guidance.

Before approval, make sure you can account for the system’s data flows, safeguards, access, connected components, incident obligations, evidence, and exit terms. Document unresolved risks, assign owners, and confirm that contractual commitments and technical controls align with your hospital’s security risk analysis.

FAQs

What should a vendor security assessment cover for an interactive patient care system?

It should cover the system’s data inventory and flows, safeguards for data at rest and in transit, user and service-account access, authentication, audit logging, incident response, integrations, connected devices, vulnerability management, backup and recovery, subcontractors, documentation, and data deletion at exit. Assess controls in the context of your hospital’s environment and responsibilities.

Does the vendor need to sign a HIPAA business associate agreement?

If the vendor meets the definition of a business associate by creating, receiving, maintaining, or transmitting PHI on behalf of a covered entity, a written business associate agreement is generally required. Determine the vendor’s role based on the actual services and data handling, then document permitted uses, safeguards, incident reporting, subcontractor obligations, and termination terms. See HHS’s guidance on covered entities and business associates and HHS’s business associate contract provisions.

How should hospitals assess connected devices and system integrations?

Inventory devices, interfaces, APIs, network paths, and remote-support connections. For each, document what data is exchanged, why it is needed, who can access it, how credentials and connections are protected, and who manages updates and vulnerabilities. Include the relationships among the hospital, vendor, hosting provider, and any subcontractors in the assessment.

What security evidence should a vendor provide?

Request relevant policies and diagrams, a description of access and encryption controls, incident response and recovery plans, vulnerability management information, and independent assessment summaries that identify their scope and date. Ask about open findings and remediation. HIPAA does not itself expressly require vendors to provide audit documentation, so specify the evidence and review rights you need in the applicable contracts.