Total Body Photography Vendor Security Risk Assessment Checklist

Total body photographs can reveal a patient’s identity and, when connected to health or care information, may be protected health information (PHI). Use this checklist to evaluate how a vendor collects, accesses, transfers, stores, retains, and deletes those images—and to document the safeguards that apply to your specific arrangement.

How should vendors be assessed for HIPAA compliance and business associate obligations?

First determine whether the vendor creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity or business associate. If it does, it will generally be a business associate for that work, and a business associate agreement (BAA) is required before PHI is disclosed. The BAA should define permitted uses and disclosures, required safeguards, incident reporting, subcontractor protections, and what happens to PHI when the relationship ends. See HHS guidance on business associates.

Assess the actual data flow, not just the vendor’s service description. Identify whether images include faces, distinctive features, names, patient numbers, dates, or metadata that can connect them to an individual or to care. HIPAA’s Safe Harbor de-identification method lists full-face photographs and comparable images among identifiers; total body images may also be identifiable through their content or linkage to other information. HHS de-identification guidance explains PHI and image identifiers.

• Confirm the vendor’s role and whether it handles PHI on behalf of your organization.
• Execute a BAA before sharing PHI, and make sure it covers the vendor’s specific photography and image-management services.
• Specify allowed image uses, including whether images may be used for support, analytics, product improvement, or training. Do not assume a use is authorized unless the agreement and applicable HIPAA rules permit it.
• Document the systems, devices, personnel, and locations that may handle the images, then assess risks and how the vendor manages them.

What access controls protect identifiable patient images?

Ask the vendor to show how it limits image access to authorized users who need it for their assigned work. HIPAA’s Security Rule includes access-control requirements and requires unique user identification; the rule also calls for audit controls and person-or-entity authentication. Review HHS’s summary of the HIPAA Security Rule and its explanation of unique user identification.

• Check for role-based access control that limits viewing, editing, downloading, exporting, and deleting images according to job duties.
• Verify that each user has a unique account and that shared credentials are prohibited.
• Ask whether multi-factor authentication is enabled, especially for administrative accounts and remote access. Treat MFA as a risk-reduction criterion in your assessment, rather than assuming HIPAA names it as a specific, universal requirement.
• Review how the vendor approves, changes, and promptly revokes user access when roles change or employment ends.
• Request examples of audit logs showing who accessed or changed image records and when. Ask how the vendor reviews suspicious access and protects the logs from unauthorized alteration.

How are images encrypted during transfer and storage?

Ask the vendor to describe encryption in transit and encryption at rest for every place images may pass through or reside, including capture devices, upload connections, application servers, databases, backups, and exports. Confirm who controls encryption keys and how access to those keys is restricted.

HIPAA treats encryption as an addressable implementation specification, not an unconditional, one-size-fits-all mandate. The organization must assess whether encryption is reasonable and appropriate for its environment; if it is not, the decision and any appropriate alternative measures must be documented. HHS explains the Security Rule’s encryption requirement. Use the vendor’s risk assessment and technical evidence to evaluate whether its controls adequately protect the images.

• Trace the full image-transfer path, including mobile applications, wireless networks, portals, and file-sharing tools.
• Ask for written descriptions of encryption protections for live systems, backups, removable media, and any offline copies.
• Check how encryption keys are generated, stored, restricted, rotated, and revoked.
• Confirm that the vendor’s documented risk analysis addresses image confidentiality, integrity, and availability.

What safeguards govern image retention and secure deletion?

Set a data retention schedule that says what images the vendor may keep, why they are retained, how long they remain, and which copies are included. Cover images on camera cards, workstations, temporary processing areas, production systems, backups, exports, and support systems—not only the main image repository.

HIPAA does not set a general medical-record retention period; other applicable laws, contracts, and operational needs may affect retention. HHS notes that the HIPAA Privacy Rule requires safeguards while PHI is maintained, including through disposal. HHS guidance on medical-record retention explains this distinction.

• Define a retention schedule and require deletion when the approved purpose or retention period ends.
• Ask how the vendor securely removes images from capture devices, active systems, exports, and other working copies after upload and verification.
• Require the vendor to explain how deletion applies to backups and what happens when a backup cannot be changed immediately.
• At contract termination, specify whether PHI will be returned or destroyed and how completion will be confirmed. HIPAA business associate contract provisions generally require return or destruction at termination when feasible; if that is infeasible, protections must continue and further uses must be limited. See HHS sample business associate agreement provisions.
• Request a deletion record or written confirmation identifying the data covered, the deletion date, and any retained copies or exceptions.

How should vendors manage subprocessors and third-party access?

Obtain a current list of subcontractors and other third parties that may create, receive, maintain, transmit, or access the images or related PHI. For each, identify its service, data access, storage location, and role in the image workflow.

HIPAA requires a business associate to ensure that subcontractors handling PHI agree to applicable restrictions and safeguards through written agreements. HHS describes these downstream obligations in its business associate contract guidance.

• Confirm that the vendor has written agreements with each relevant subprocessor covering the PHI it handles.
• Review how the vendor assesses subcontractor security before granting access and monitors changes to that access.
• Ask for advance notice of material subprocessor changes and define when you may object or require a transition plan.
• Check whether the vendor can identify which subprocessor handled particular images and support an investigation involving that party.
• Clarify who is responsible for access revocation, incident escalation, and secure return or deletion when a subcontractor’s work ends.

What incident response and breach notification procedures are required?

Review the vendor’s written process for detecting, assessing, containing, investigating, and documenting security incidents involving images. The BAA should set a clear process for reporting security incidents and suspected or confirmed breaches, including who receives notice and what information the vendor must provide. HHS states that a business associate must report security incidents to its customer, while the parties may establish incident-reporting details in their agreement. See HHS guidance on security-incident reporting.

For a breach of unsecured PHI, a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is the outer federal limit, not a recommended response target; contract terms can require faster notice. A useful process provides early notice so the covered entity can assess the event and meet its own notification duties. HHS’s Breach Notification Rule guidance describes the applicable reporting requirements.

• Set a prompt contractual notice deadline for suspected incidents, even while facts are still being confirmed.
• Require an initial report with the incident timeline, affected systems, known or suspected image records involved, containment steps, and a vendor contact for follow-up.
• Require updates as the investigation identifies affected individuals, information types, root cause, and mitigation actions.
• Confirm that the vendor preserves relevant logs and evidence and coordinates with your organization during investigation and remediation.
• Clarify which party handles notices to individuals, HHS, or the media when required, and who makes decisions about the scope and timing of those notices.

What evidence should be reviewed during vendor security assessments?

Request evidence that demonstrates how the vendor’s documented safeguards operate in practice. A policy or sales statement alone may not show whether controls apply to the specific photography workflow, devices, staff, and subprocessors covered by your contract.

• Current risk analysis and risk-management materials relevant to image collection, transfer, storage, and access.
• The proposed or executed BAA, security terms, incident-reporting commitments, and subcontractor provisions.
• Access-control policies, role definitions, MFA configuration information, user-access review records, and sample audit logs.
• Technical descriptions of encryption in transit and at rest, key management, backups, and permitted export methods.
• Image retention and deletion procedures, including sample deletion confirmations and the treatment of backup copies.
• Subprocessor inventory and evidence of the agreements and safeguards governing third-party access.
• Incident response procedures, staff training records, and documentation of relevant exercises or past incidents and corrective actions.

Record the evidence reviewed, gaps found, the risk each gap creates, the action required, and the person responsible for resolving it. Reassess when the vendor changes its services, systems, subprocessors, or image-handling practices. A consistent review of contractual duties, technical safeguards, and operational evidence helps you judge whether a vendor’s protections fit the sensitivity of identifiable patient images.

FAQs

Does a total body photography vendor need a business associate agreement?

Generally, yes, when the vendor creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity or another business associate. Whether the images are PHI depends on their relationship to health or care information and whether the person is identifiable. Confirm the vendor’s role and data flow, then put a BAA in place before disclosing PHI. HHS business associate guidance explains when written assurances are required.

How can a vendor protect identifiable patient images from unauthorized access?

A vendor can limit access through role-based permissions, unique user accounts, appropriate authentication such as multi-factor authentication, timely access revocation, and audit logging. It should also assess image-transfer and storage risks, use safeguards such as encryption where reasonable and appropriate, and train personnel on the vendor’s policies. HIPAA requires applicable safeguards, while the specific measures should be assessed for the vendor’s environment.

What should a vendor breach notification process include?

It should identify who must be notified, how quickly notice must be sent, what information the initial report must contain, how updates will be delivered, and how the vendor will support investigation and mitigation. For breaches of unsecured PHI, a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the contract may set a shorter deadline. HHS breach notification guidance provides the federal requirements.

How should stored patient images be securely deleted?

Follow the agreed retention schedule and document a deletion process that covers active systems, capture devices, exports, and other copies. Ask the vendor to describe how it handles backup copies and any data it cannot immediately remove, and request written confirmation of deletion or a clear explanation of any retained PHI. At contract termination, the BAA should address return or destruction of PHI when feasible.