Security Risk Assessment Checklist for Patient Experience Survey Companies

A security risk assessment helps you identify how patient survey information is collected, used, stored, and shared—and where it could be exposed. For a patient experience survey company, the review should cover people, processes, technology, and vendors that handle potentially identifiable health information.

Use this checklist to evaluate risk, document safeguards, and support a practical HIPAA Security Rule risk analysis. Whether HIPAA applies to a particular service depends on the company’s role and the data and services involved; confirm obligations with qualified privacy or legal counsel.

Map Survey Data Flows and Scope

Start by documenting how information moves through the survey process. Include digital and paper workflows, routine operations, and exceptional situations such as exports, support requests, and system outages.

• List each survey product, platform, database, device, and environment that collects, processes, stores, or transmits survey information.
• Map the path from survey invitation and response collection through analysis, reporting, archival, and deletion.
• Identify each party that may handle the data, including the healthcare organization, survey company, hosting provider, messaging service, analytics vendor, and support personnel.
• Record where information is stored, where it can be accessed, and how it is transmitted, including backups and temporary files.
• Include production, test, and development environments, as well as dashboards, spreadsheets, logs, and downloaded reports.
• Document the systems and data that are in scope for the HIPAA Security Rule risk analysis, including electronic protected health information (ePHI) created, received, maintained, or transmitted on behalf of a covered entity or business associate.

Keep the data-flow map current. A new survey channel, integration, analytics feature, or subcontractor can change the scope and introduce risks that were not covered by an earlier assessment.

Classify Vendor Risk and Assess Threats

Classify the survey company and its services according to the sensitivity of the information handled, the level of system access, and the potential effect of a disruption or disclosure. Assess both the company’s own controls and risks introduced by its vendors.

• Determine whether the survey service creates, receives, maintains, or transmits PHI on behalf of a covered entity or business associate.
• Identify likely threats, such as phishing, stolen credentials, misdirected survey invitations, ransomware, insecure integrations, insider misuse, and vendor compromise.
• Identify vulnerabilities, including unsupported software, excessive access, unencrypted transfers, weak authentication, and incomplete logging.
• Estimate the likelihood and potential impact of each relevant threat, considering confidentiality, integrity, and availability of ePHI.
• Document existing safeguards, remaining risk, planned risk-reduction measures, accountable owners, and target completion dates.
• Evaluate how survey interruption, corrupted results, or unauthorized changes could affect patient communication, service improvement, or healthcare operations.

A risk assessment is more useful when it leads to specific decisions. Record why a risk is accepted, reduced, avoided, or transferred, and revisit that decision when systems or operations change.

Review Privacy and Data Handling

Review whether the survey company collects only the information needed for the agreed purpose and handles it consistently with the organization’s privacy requirements. Survey responses may reveal health information even when a question does not ask directly about a diagnosis.

• Inventory direct identifiers, such as names and contact details, and indirect identifiers, such as dates, locations, appointment details, or combinations of response attributes that could identify someone.
• Determine whether survey responses are linked to a patient, a healthcare provider, a visit, or care received. Treat identifiable health information maintained electronically as potentially sensitive ePHI.
• Apply the minimum necessary standard to data collection, user access, reports, and disclosures where it applies. Configure survey fields and reports to avoid exposing unnecessary detail.
• Set rules for data retention, archival, deletion, and secure disposal, including copies in exports, backups, and support systems.
• Review whether data is used for analytics, product improvement, benchmarking, or other secondary purposes, and confirm that those uses are permitted and appropriately documented.
• Assess de-identification claims carefully. Aggregated or de-identified information should not be treated as outside HIPAA protections unless it meets applicable de-identification requirements.
• Check that survey invitations, response pages, notifications, and reports do not disclose sensitive details to unintended recipients.

Document what information is collected, why it is needed, who can access it, and when it will be deleted. Clear rules help staff make consistent decisions and help customers understand how their survey data is handled.

Evaluate Access Controls and Technical Safeguards

Assess the safeguards that protect information in systems and day-to-day operations. The controls should be appropriate to the risks identified and should cover administrative, physical, and technical protections.

• Require unique user accounts, strong authentication, and multifactor authentication for privileged or remote access where appropriate.
• Use role-based access, limit permissions to job responsibilities, and promptly remove access when it is no longer needed.
• Review access logs and administrative activity, and ensure alerts or procedures exist to investigate suspicious behavior.
• Protect information in transit and at rest with appropriate encryption. Review encryption key management, including key access, storage, rotation, recovery, and separation of duties.
• Secure application interfaces and integrations through authentication, authorization, input validation, and monitoring.
• Assess endpoint protection, vulnerability management, patching, secure configuration, and processes for addressing security findings.
• Train personnel on privacy and security responsibilities, phishing, incident reporting, and handling survey information.
• Review physical protections for facilities, devices, and media that could contain ePHI.

Encryption is an important safeguard, but it does not replace access controls, monitoring, secure system design, or recovery planning. Evaluate the whole environment, including how keys and backups are protected.

Define Business Associate Agreement Requirements

A survey company may be a business associate when it performs services on behalf of a covered entity or another business associate that involve creating, receiving, maintaining, or transmitting PHI. The parties should assess the actual services and data flows rather than relying on the vendor’s job title or product description alone.

When a business associate relationship applies, review the business associate agreement (BAA) alongside the security assessment. Confirm that the written agreement clearly addresses:

• Permitted and required uses and disclosures of PHI, limited to the purposes of the services and applicable legal requirements.
• Appropriate safeguards for PHI and compliance with applicable Security Rule requirements for ePHI.
• Reporting of impermissible uses or disclosures, security incidents, and breaches, with a process and timeline that support the covered entity’s response.
• Subcontractor obligations to apply required protections when they handle PHI.
• Assistance, where applicable, with individual rights and other obligations the covered entity has assigned to the business associate.
• Return or destruction of PHI at termination when feasible, and procedures for information that cannot reasonably be returned or destroyed.
• Cooperation with appropriate compliance reviews and a defined process for addressing material contract violations.

Align the BAA with the service agreement, security commitments, incident escalation process, and data-retention terms. A contract should reflect how the service actually works, including any approved analytics or data aggregation activities.

Assess Subcontractors and Incident Response

Survey services often depend on cloud hosting, email or text messaging, customer support, analytics, and other external providers. Identify which subcontractors may access or maintain PHI and verify that the survey company manages those relationships appropriately.

• Request a current list of subcontractors that may handle PHI, their services, and the types of data they can access.
• Check whether required written agreements and safeguards flow down to subcontractors with PHI access.
• Review how the survey company approves new subcontractors, assesses their security, and notifies customers of relevant changes.
• Ask for the incident response plan, including roles, escalation paths, investigation steps, containment, recovery, and customer communications.
• Confirm that the company can promptly notify the customer of suspected or confirmed incidents and provide information needed to assess the event.
• Review how the response process supports applicable breach notification obligations, including the covered entity’s need to determine whether notification is required.
• Check that incident procedures are exercised and that lessons learned lead to corrective actions.

Make incident notification expectations operational: identify contacts, after-hours channels, required details, and escalation steps before an incident occurs. Contract language and incident plans should work together rather than conflict.

Verify Continuity Evidence and Ongoing Monitoring

Request evidence that the survey company’s controls are implemented and that the service can recover from disruption. Evidence should be relevant to the systems and services in scope, current enough to support the decision, and accompanied by an explanation of any limitations or exceptions.

• Review an independent security assessment or audit report, including scope, coverage period, exceptions, and remediation status.
• Request summaries of penetration tests, vulnerability assessments, and follow-up on significant findings.
• Review policies and procedures for risk analysis, access control, encryption, incident response, and workforce training.
• Assess backup practices, recovery objectives, contingency procedures, and disaster recovery testing results.
• Confirm that disaster recovery testing includes relevant systems and data, that results are documented, and that identified gaps are tracked through resolution.
• Monitor security incidents, material service changes, audit findings, subcontractor changes, and corrective actions throughout the relationship.
• Schedule periodic reassessments and trigger an additional review after significant changes, such as a new platform, major incident, acquisition, or material change in data use.

Use the evidence review to identify gaps, not just to collect documents. Record what was reviewed, what remains unverified, who owns follow-up, and when the next reassessment is due. In short, a strong checklist connects data-flow knowledge, risk treatment, privacy safeguards, contracts, vendor oversight, and tested recovery plans.

FAQs

When does a patient experience survey company need a business associate agreement?

A BAA is generally needed when the survey company performs services on behalf of a HIPAA covered entity or business associate and those services involve creating, receiving, maintaining, or transmitting PHI. The specific relationship depends on what the company does and what information it handles; a vendor that does not handle PHI on behalf of a regulated organization may not have the same business associate relationship.

What survey data counts as electronic protected health information?

Survey data may be ePHI when it is individually identifiable health information maintained or transmitted electronically. For example, an identifiable response linked to a patient, a visit, or care received may qualify. Names are not the only identifiers to consider: appointment details, contact information, and combinations of indirect details may also make a response identifiable. Properly de-identified information may fall outside the definition of PHI.

What security evidence should a survey company provide?

Ask for evidence relevant to the service and its risks, such as an independent assessment report, penetration-test summary, vulnerability remediation status, security policies, access-control and encryption practices, incident response procedures, subcontractor information, and backup and recovery test results. Review each item’s scope, date, exceptions, and remediation status rather than relying on a certification or questionnaire alone.

How often should survey vendors undergo a security risk reassessment?

Set a reassessment schedule based on the sensitivity of the data, the vendor’s access, and the risk level of the service. Reassess periodically and whenever a significant change could affect security, such as a new system or subcontractor, a material change in data handling, a serious incident, or a major finding that remains unresolved. Document the schedule and the reasons for any change to it.