Vendor Risk Management and HIPAA Compliance for GLP-1 Telehealth Companies

Which GLP-1 telehealth vendors may qualify as business associates?

For a GLP-1 telehealth company, HIPAA business associate classification depends on what a vendor does with protected health information (PHI), not on the vendor’s name or industry. A vendor may be a business associate if it performs a service for or on behalf of a HIPAA covered entity and creates, receives, maintains, or transmits PHI as part of that service. The same analysis applies when a business associate hires a subcontractor to handle PHI on its behalf. HHS guidance on business associates

Potential business associates may include telehealth platforms, cloud hosting providers, electronic health record vendors, billing companies, patient-support services, and other vendors that handle PHI to perform contracted services. A vendor that only sells a standard product without accessing PHI may not qualify on that basis alone; assess the actual service, data flows, and access it receives. HHS identifies services such as claims processing, billing, and practice management as examples of business associate functions. HHS business associate examples and guidance

Start by confirming which organization is the covered entity. A telehealth brand is not automatically a covered entity just because it offers virtual care: HIPAA’s covered-entity definition includes health care providers that conduct certain standard transactions electronically. A vendor that meets the business associate definition generally requires a written agreement before it handles PHI for the covered entity. HHS overview of covered entities and business associates

For each vendor, map the service to the information involved: patient identity and contact details, intake responses, medication history, prescriptions, visit notes, and payment or billing information. Record whether the vendor acts for your organization, for a clinician, or independently as a health care provider. That role-based analysis makes your HIPAA business associate classification more reliable than relying on contract labels alone.

When is a pharmacy a treating provider rather than a business associate?

A pharmacy may act as a health care provider when it dispenses medication and provides related care to the patient. HIPAA generally does not require a business associate agreement (BAA) for a covered entity’s disclosure of PHI to another health care provider for treatment. HHS specifically explains that a pharmacy may use information to fill a prescription as a treatment activity. HHS guidance on treatment disclosures and pharmacies HHS guidance on the treatment exception

For example, if your clinician sends a prescription and relevant patient information to a pharmacy that independently dispenses the medication and provides pharmacy care, the pharmacy may be acting as a treating provider rather than as your organization’s business associate. Pharmacies that conduct covered electronic transactions can also be covered entities in their own right. HHS covered-entity guidance

Do not assume that every arrangement with a pharmacy falls within the treatment exception. If the pharmacy also performs administrative, fulfillment, patient-support, or other functions on your organization’s behalf involving PHI, assess that separate role and the information flows. A pharmacy can have different roles in different activities; the relevant facts are what it does, whose work it performs, and why it uses or receives the information.

Document the reasoning for the decision, including the pharmacy’s services, the parties’ responsibilities, and whether it uses the information for its own treatment activities or a delegated function. If the pharmacy is acting as a business associate for a service, put the appropriate BAA in place for that role. If it receives PHI for treatment as a provider, a BAA is generally not required solely for that treatment disclosure.

What must a HIPAA business associate agreement cover?

Business associate agreement requirements include setting clear limits on how the business associate may use and disclose PHI and requiring safeguards to protect it. The BAA must also require the business associate to report impermissible uses or disclosures, including breaches of unsecured PHI, and to ensure that applicable subcontractors agree to the required restrictions and safeguards. HHS sample business associate agreement provisions

A compliant agreement should also address how the business associate will support the covered entity’s obligations involving individuals’ requests for access, amendments, and disclosure accountings when applicable. It must provide for making relevant internal practices, books, and records available to HHS for compliance purposes and, when feasible, returning or destroying PHI when the agreement ends. The contract must authorize termination for a material violation. HHS summary of required BAA provisions

For electronic protected health information (ePHI), the agreement must require appropriate Security Rule safeguards. Specify practical details alongside the required terms, such as permitted data uses, who handles incident notices, response timelines, support during investigations, subcontractor oversight, retention, secure return or destruction, and responsibilities for configuring shared systems. HHS notes that a BAA can clarify the safeguards and specific terms of an information-sharing relationship. HHS guidance on developing BAAs

A signed BAA is not proof that the vendor’s safeguards are adequate or that the telehealth company has met its own Security Rule obligations. Review the contract alongside the vendor’s actual services, access, and security evidence. HHS explains that covered entities and business associates remain responsible for risk analysis and risk management of the ePHI they create, receive, maintain, or transmit. HHS guidance on HIPAA and cloud computing

How should telehealth companies assess vendor security risks?

Build a security risk analysis around the ePHI involved in each vendor relationship. Identify what information is created, received, maintained, or transmitted; where it is stored; which systems and people can access it; and how it moves between the telehealth company, clinicians, pharmacies, laboratories, and other vendors. The Security Rule calls for an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. HHS guidance on Security Rule risk analysis

Assess threats and vulnerabilities in context, including the likelihood and potential impact of unauthorized access, service disruption, data loss, incorrect changes to records, and vendor or subcontractor incidents. Consider the vendor’s role, the volume and sensitivity of the data, the extent of its access, and how disruption could affect clinical operations. HHS does not prescribe a single risk-analysis method; the approach should fit the organization and its environment. HHS risk-analysis guidance

Use vendor questionnaires and supporting materials to test the answers, rather than treating a questionnaire as the assessment itself. Depending on the service and risk, review policies, access-control descriptions, incident-response procedures, business continuity plans, vulnerability management, and independent security assessment reports. Ask whether any assessment covers the specific product and environment your company will use, and note exclusions, gaps, and remediation plans.

Penetration testing documentation and vulnerability-scan results can help you understand technical risks, but HIPAA does not prescribe one particular assessment method or make penetration testing a universal standalone requirement. Use evidence that is proportionate to the vendor’s access and risk, and record what you reviewed, what remains uncertain, and what mitigation is needed. HHS describes the Security Rule as flexible and risk-based, and its risk-analysis guidance does not mandate a specific methodology. HHS risk-analysis methodology guidance HHS overview of the Security Rule

Keep HIPAA audit documentation that supports your decisions: the risk analysis, vendor reviews, contracts and BAAs, risk ratings, exceptions, remediation plans, and approvals. The Security Rule requires documentation of relevant policies, procedures, and activities, and sets a six-year retention period for required documentation, measured from the later of its creation or the date it was last in effect. HHS Security Rule documentation overview

What safeguards should vendors use to protect electronic health information?

HIPAA requires reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI. The measures should reflect the organization’s size and capabilities, technical environment, costs, and the probability and criticality of risks. A vendor’s controls should therefore be assessed against its specific service and access, not against a generic claim of being “HIPAA compliant.” HHS summary of the Security Rule

Review vendor access controls, including unique user accounts, role-based permissions, appropriate authentication, timely removal of access when staff leave or change roles, and restrictions on administrative access. HIPAA requires technical access controls and audit controls for systems containing ePHI; the practical design should limit access to authorized users and allow relevant activity to be recorded and examined. HHS overview of technical safeguards

Ask how the vendor protects data in transit and at rest, detects inappropriate access, preserves data integrity, manages vulnerabilities, and maintains secure backups and recovery processes. Encryption is an addressable implementation specification under the current Security Rule: the organization must determine whether it is reasonable and appropriate, implement it when appropriate, and document its decision and any alternative measure where applicable. HHS guidance on Security Rule encryption

For a telehealth service, evaluate the entire service pathway: patient intake, video or messaging, clinical documentation, prescribing, pharmacy coordination, customer support, analytics, and billing. Confirm that vendors and subcontractors only receive the information needed for their assigned functions and that their controls protect it during storage, use, and transmission. A vendor’s certification or report may provide useful evidence, but it does not replace your own risk analysis or establish HIPAA compliance by itself.

What due diligence should companies perform before onboarding a vendor?

Before onboarding, document the service, the vendor’s role, the data involved, and whether the vendor is a business associate or subcontractor. Confirm that your organization has the appropriate contract and, where required, a BAA before the vendor handles PHI. HHS says covered entities must obtain satisfactory assurances that a business associate will appropriately safeguard PHI, typically through a written contract or other written arrangement. HHS guidance on covered entities and business associates

Review the vendor’s security and privacy materials against the risks identified in your assessment. Useful evidence may include a description of the hosting and data-flow environment, access and authentication controls, incident response and notification processes, workforce training and access management, backup and recovery practices, vulnerability management, and relevant audit or assessment reports. Ask follow-up questions where evidence is incomplete, dated, or does not cover the service you plan to use.

Check subcontractor arrangements and data handling terms. Identify which other parties may receive or maintain the information, how the vendor flows down required protections, and what happens to PHI at contract termination. Clarify how your company will receive incident notices and cooperate with response, how access will be removed, and how data will be returned or securely destroyed when feasible. HHS BAA provisions concerning subcontractors and termination

Document the decision to approve, conditionally approve, or reject the vendor. Record unresolved risks, required safeguards, remediation deadlines, and the person responsible for follow-up. HIPAA does not prescribe a particular vendor questionnaire or procurement workflow, but keeping a clear record supports the ongoing risk-management process and makes your reasoning easier to review.

When should vendor risk assessments be repeated?

HIPAA does not set a universal fixed interval—such as annual—for every vendor reassessment. Instead, organizations must review and update security measures as needed, periodically evaluate their security environment, and revisit risk when changes or new information could affect ePHI. HHS says the Security Rule does not specify how frequently to perform risk analysis; frequency depends on the organization’s circumstances. HHS guidance on ongoing risk analysis HHS guidance on periodic evaluations

Reassess when a vendor changes its service, hosting environment, subcontractors, data access, or security controls; when your company changes how it uses or shares data; or after a security incident, significant vulnerability, or other material change. Also revisit open remediation items and evidence on a schedule appropriate to the vendor’s risk. A high-access platform that supports clinical operations may warrant more frequent review than a vendor with limited or incidental exposure to PHI.

Set a documented review cadence based on risk, then define triggers for an earlier review. Keep the updated assessment, decisions, and mitigation steps with your other HIPAA audit documentation. This approach connects reassessment to real changes in the vendor relationship rather than treating a calendar date as a substitute for risk analysis. HHS guidance on ongoing risk analysis and documentation

In summary: Classify vendors by their actual role and access to PHI, distinguish pharmacy treatment disclosures from delegated business associate services, and use written agreements when HIPAA requires them. Pair those agreements with a documented, risk-based security review, appropriate safeguards, and reassessment when the service or risk changes.

FAQs.

Do GLP-1 telehealth companies need a business associate agreement with every vendor?

No. A BAA is generally required when a vendor meets HIPAA’s business associate definition—for example, when it handles PHI to perform a service on behalf of a covered entity or business associate. A BAA is not required for every vendor relationship, such as a disclosure to a health care provider for treatment or a service that does not involve PHI beyond incidental access with reasonable safeguards. Assess each vendor’s role and data access individually. HHS guidance on business associates and exceptions

Does a pharmacy dispensing GLP-1 medication directly to a patient qualify as a business associate?

Not necessarily. When the pharmacy acts as a health care provider and receives information to dispense medication or provide related treatment, the treatment exception generally means a BAA is not required solely for that disclosure. If the pharmacy separately performs a service involving PHI on behalf of the telehealth company, evaluate that separate role to determine whether a BAA is needed. HHS guidance on pharmacy treatment activities HHS guidance on business associate exceptions

What should a HIPAA vendor risk assessment include?

It should identify the ePHI involved, where it is stored and transmitted, who can access it, relevant threats and vulnerabilities, and the likelihood and potential impact of harm. It should also evaluate the vendor’s safeguards, document identified risks and mitigation decisions, and retain supporting evidence such as contracts, assessment materials, and remediation plans. HHS requires an accurate and thorough risk analysis but does not prescribe a single methodology. HHS Security Rule risk-analysis guidance

When should a telehealth company reassess vendor security risks?

Reassess periodically at a cadence suited to the vendor’s risk, and sooner when a significant change or incident could affect ePHI. Triggers may include changes to the vendor’s service, systems, subcontractors, data access, or security controls, as well as security incidents and newly identified vulnerabilities. HIPAA does not prescribe one reassessment frequency for all vendors. HHS guidance on periodic and ongoing risk analysis