Patient Education Video Vendor Acceptable Use Policy: A Practical Guide

What should a patient education video vendor acceptable use policy cover?

A patient education video vendor acceptable use policy should explain what services the vendor may provide, what information it may handle, who may access its tools, and how both parties will manage content, security, and incidents. It should apply to the vendor’s employees and subcontractors as well as to the organization’s staff who use the service.

Start by defining the service’s permitted purposes—for example, hosting approved educational videos or delivering them through an authorized patient portal. Specify prohibited uses, such as using the service to publish unapproved clinical claims, disclose patient information outside the agreed service, or add unapproved tracking tools to video pages.

Coordinate the policy with the service contract, privacy and security policies, content-review process, and any HIPAA business associate agreement requirements. A written agreement should clearly describe permitted and required uses of protected health information (PHI), safeguards, incident reporting, subcontractor obligations, and what happens to PHI when the relationship ends.

The policy should distinguish legal requirements from organizational controls. HIPAA duties depend on the parties’ roles and activities; a vendor is not automatically a business associate simply because it provides patient education videos.

How should vendors handle protected health information and patient data?

First, identify what information the vendor actually receives, creates, maintains, or transmits. A library of generic videos may not involve PHI. By contrast, patient-linked video recommendations, portal activity, viewing records, or account details may involve PHI when they identify a patient and relate to care.

If a vendor performs services involving PHI on behalf of a covered entity or business associate, determine whether a business associate agreement is required before allowing the vendor to handle that information. HHS explains that covered entities must obtain appropriate written assurances from business associates and that subcontractors handling PHI must also be covered by suitable agreements. See HHS guidance on business associates.

Set clear limits on collection, use, disclosure, retention, and deletion. Require the vendor to use PHI only as authorized by the agreement and applicable law, and to limit access and use to what is needed for the specified service. The minimum necessary standard generally requires appropriate limits, subject to exceptions under the Privacy Rule.

Do not assume that a vendor can use patient data to train models, improve products, personalize marketing, or create analytics simply because it provides the service. Specify whether any such use is prohibited or permitted, and under what terms. If the vendor will de-identify PHI for another use, the agreement should authorize that activity: HHS states that de-identification itself is a use of PHI. See HHS guidance on de-identification.

Set a retention schedule, require secure return or destruction of PHI at termination when feasible, and define any permitted retention when deletion is not feasible or another law requires retention. HHS lists return or destruction, where feasible, among the provisions to address in a business associate contract. See HHS sample business associate agreement provisions.

What rules govern video content, accessibility, and clinical accuracy?

Define what counts as approved patient education content and prohibit publication or alteration of videos outside the agreed review and approval process. The policy can require clear ownership, a source record for clinical statements, appropriate disclaimers, and a method for reporting suspected errors or outdated material.

Assign clinical content review to qualified reviewers designated by the organization. A practical review process identifies the responsible clinical owner, checks claims against current authoritative evidence and organizational guidance, records approval, and sets a review date. Re-review content when clinical guidance changes, an error is reported, or the video is materially revised. These are governance controls for reliable content, not a substitute for applicable professional or legal standards.

Require accessibility features appropriate to the content and the organization’s obligations, such as accurate synchronized captions, transcripts, and audio description when visual information is needed to understand the video. The W3C Web Content Accessibility Guidelines set out criteria for captions and alternatives for time-based media. Specify the WCAG version and conformance level in the contract rather than assuming that the phrase “accessible video” is precise enough.

Also require the vendor to provide usable caption and transcript files, support keyboard-accessible playback controls, and correct accessibility defects promptly. State who checks conformance, how users can report barriers, and whether translated materials require separate clinical and language review.

How should vendor access, accounts, and security incidents be managed?

Use role-based access control so each vendor and organizational user can access only the functions and information needed for their assigned duties. Require individual accounts rather than shared logins, timely access removal when roles change or work ends, and periodic review of active accounts. HIPAA’s Security Rule includes requirements such as unique user identification, access controls, and audit controls; consult HHS technical safeguards guidance.

Document the security controls expected for the service, including encryption at rest and in transit, audit logging, secure authentication, backups, and vulnerability management. Encryption is a prudent contractual safeguard, but HIPAA treats encryption as an addressable implementation specification rather than an unconditional, standalone requirement; the entity must assess it through its risk analysis and document the relevant decision. See HHS guidance on encryption under the Security Rule.

Require vendors to report suspected or confirmed security incidents promptly through named contacts and a defined channel. The contract should set a practical reporting deadline that allows the organization to investigate, contain risk, preserve evidence, and determine whether notifications are required. HHS explains that a business associate must report security incidents under its agreement and must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That 60-day limit is an outside federal deadline for breach notification, not a recommended target for the vendor’s initial incident report. See HHS Breach Notification Rule guidance.

Spell out cooperation duties: preserve relevant logs, provide facts about affected information and individuals as available, support containment and remediation, and assist the organization’s investigation and notification decisions. The organization should retain responsibility for assessing its own legal and regulatory duties rather than treating the vendor’s report as a complete determination.

What review and approval steps should organizations require?

Before onboarding a vendor, identify the service’s data flows, users, subcontractors, and connection points to patient portals or other systems. Have privacy, security, clinical, accessibility, procurement, and legal reviewers examine the parts relevant to their responsibilities. Complete the required agreement and risk review before transferring PHI or enabling access.

Require written approval before the vendor adds a subcontractor that may access PHI, changes how data is used, introduces new tracking or analytics, or materially changes the service. The agreement should identify how the organization will be notified of material changes and how it can assess the risks before they take effect.

For each video, record the content owner, clinical reviewer, accessibility check, approval date, version, and scheduled review date. Define a route for staff to flag incorrect, outdated, inaccessible, or inappropriate content, and give the responsible reviewer authority to pause or remove a video while it is evaluated.

Review the arrangement periodically and when there is a material change, such as a new data type, new integration, security incident, or major clinical update. HHS does not expressly require every customer to audit a business associate’s security practices; customers may instead require documentation or audit rights through the contract based on their own risk analysis. See HHS guidance on vendor security documentation and audits.

What limitations and exceptions should the policy define?

State that vendor use of PHI is limited to the authorized service and agreement, subject to applicable law. Address whether any data may be used for support, service analytics, or product improvement; whether data must first be de-identified; and whether the vendor may share information with a subcontractor. Avoid broad language that could be read as allowing unrelated advertising, resale, or model training with identifiable patient data.

Define exceptions for disclosures required by law and other uses specifically allowed by the agreement or applicable rules. Specify how the vendor must notify the organization about legal demands where permitted, and require disclosure of only the information legally required. For de-identified information, document who may perform de-identification, the permitted methods, and any restrictions on re-identification.

Clarify that the policy does not authorize vendor staff to make clinical decisions, give patient-specific medical advice, or substitute vendor content for clinician judgment. Define what happens during outages, how approved materials remain available where appropriate, and how the organization can suspend access or terminate the service for a material violation.

In summary: A practical policy defines permitted data use, protects PHI through contract and security controls, sets clear expectations for accessible and clinically reviewed content, and establishes approval, incident-response, and termination procedures.

FAQs

Does a patient education video vendor need a business associate agreement?

It depends on the vendor’s role and the information it handles. A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity or business associate generally needs an applicable business associate agreement before that work begins. A vendor that only provides generic content and does not handle PHI may not need one for that service. Assess the actual data flows and services, not just the vendor’s label. See HHS guidance on business associates.

Can vendors use patient data to train or improve their products?

Not automatically. A vendor handling PHI may use or disclose it only as permitted by its agreement and applicable law. The organization should expressly address model training, product improvement, analytics, and other secondary uses in the agreement. If a proposed use relies on de-identification, the agreement should authorize the de-identification process; HHS notes that de-identifying PHI is itself a use of PHI. See HHS de-identification guidance.

Who is responsible for reviewing video content for clinical accuracy?

The organization should designate a qualified clinical reviewer or owner and define that person’s authority and review process. The vendor can provide source information, version history, and change notices, but the organization should specify who approves content for its patients and when re-review is required.

What should an organization do when a vendor reports a security incident?

Follow the organization’s incident-response process: acknowledge and document the report, contact the responsible privacy and security leads, assess what systems and information may be affected, coordinate containment and evidence preservation with the vendor, and determine whether the event is a reportable breach or triggers other duties. Do not wait for the federal outside deadline to begin the assessment. Require prompt vendor reporting in the contract; HHS states that breach notification by a business associate must occur without unreasonable delay and no later than 60 calendar days after discovery. See HHS breach notification guidance.