Vendor Risk Management and HIPAA Compliance for Substance Use Disorder Treatment Programs

Substance use disorder (SUD) treatment programs often rely on outside companies for electronic health records, billing, cloud storage, IT support, laboratories, and other services. When those services involve sensitive patient information, your program must determine which privacy rules apply, limit how vendors can use the information, and oversee the safeguards that protect it.

HIPAA and 42 CFR Part 2 can both apply to the same records. A vendor may also have more than one role—for example, a HIPAA business associate and a Part 2 qualified service organization. Assess each relationship and each proposed disclosure rather than assuming a contract or a vendor’s “HIPAA compliant” claim resolves every obligation.

Which vendors qualify as HIPAA business associates?

A vendor generally qualifies as a business associate when it performs a service or function on behalf of a HIPAA covered entity that involves creating, receiving, maintaining, or transmitting protected health information (PHI). Common examples include billing companies, cloud hosting providers, data processors, and IT vendors who access patient records while troubleshooting. A covered entity must have a written business associate agreement (BAA) in place when a vendor performs work that makes it a business associate. See HHS guidance on business associates.

Not every supplier is a business associate. A software vendor that provides a product but cannot access PHI may not qualify on that basis alone. Similarly, a vendor whose services do not involve PHI and whose access, if any, is only incidental generally does not require a BAA. A delivery service that acts only as a conduit for information, with access limited to what is necessary to transport it, is another exception. These distinctions depend on the vendor’s actual services and access—not just the contract’s label. See HHS guidance on software vendors and HHS guidance on conduits.

Check whether your program is a HIPAA covered entity before applying the business associate rules. A health care provider is generally a covered entity if it transmits health information electronically in connection with a transaction for which HIPAA has adopted a standard. If the program is covered, document which vendors handle PHI on its behalf and ensure BAAs are signed before granting that access.

When does Part 2 apply to vendors handling SUD records?

Part 2 applies to federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment. Its protections cover patient-identifying SUD records created, received, or acquired by a Part 2 program in connection with those services. A vendor does not become subject to Part 2 simply because it serves a health care organization; its obligations depend on how it receives and handles Part 2 records and the role it performs. See HHS’s overview of Part 2.

A vendor that provides services to a Part 2 program involving its patient records may qualify as a qualified service organization (QSO). Examples include data processing, billing, laboratory analysis, legal or accounting services, and medical staffing. A QSO agreement must acknowledge that the organization is bound by Part 2 when handling those records and, if necessary, will resist efforts to obtain them in judicial proceedings except as Part 2 permits. The QSO definition also includes certain HIPAA business associates of a Part 2 program that is itself a covered entity, when the PHI also constitutes a Part 2 record. See 42 CFR § 2.11.

Part 2 may also affect vendors downstream from a lawful holder of records. For certain payment or health care operations disclosures made with the required patient consent, a lawful holder that is not a HIPAA covered entity or business associate may disclose necessary records to contractors or subcontractors. Its written contract or comparable legal instrument must bind the contractor to Part 2, require appropriate safeguards and reporting of unauthorized uses, disclosures, or breaches, and limit the information to what the contractor needs for its work. See 42 CFR § 2.33.

Before sharing records, identify the vendor’s role, the legal basis for disclosure, the applicable patient consent and its scope, and any restrictions on further disclosure. A Part 2 program’s BAA does not, by itself, establish that every disclosure or redisclosure of Part 2 records is permitted.

What should a business associate agreement cover for SUD data?

A HIPAA BAA must set limits on how the business associate may use and disclose PHI, require appropriate safeguards, and require the vendor to report impermissible uses or disclosures, security incidents, and breaches as applicable. It must also address relevant access, amendment, and accounting requests; HHS access to records needed to assess compliance; subcontractor obligations; and return or destruction of PHI when the agreement ends, if feasible. See HHS’s BAA provisions and 45 CFR § 164.504(e).

For SUD information, make the agreement and related contracts reflect the additional Part 2 requirements that apply to the vendor’s role. Address, as appropriate:

• Permitted use and disclosure: Identify the services and purposes for which the vendor may handle Part 2 records. Prohibit unrelated use, unauthorized redisclosure, and uses or disclosures for proceedings against a patient that Part 2 does not permit.
• Consent and notices: Set procedures for transmitting and respecting the patient’s consent and for providing the required Part 2 notice or explanation of consent scope when records are disclosed.
• Safeguards and incident reporting: Specify safeguards for identifying information and require prompt reporting of unauthorized access, use, disclosure, or breach so the program can assess and respond.
• Subcontractors: Require approval or documented oversight of downstream vendors, appropriate written agreements, and controls on further disclosure.
• End of service: Set out how records will be returned, securely destroyed, or retained only when permitted and necessary.

HIPAA and Part 2 obligations can overlap, but they are not identical. Document both the BAA relationship and any applicable QSO or downstream contractor requirements. A single combined instrument may be workable if it contains all terms required for the parties’ roles; do not assume that signing a standard BAA alone satisfies Part 2. See 42 CFR § 2.33 and HHS’s BAA guidance.

How to conduct and document vendor security risk analyses

The HIPAA Security Rule requires a covered entity or business associate to conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic PHI it holds. HHS does not prescribe one required methodology. Include vendor systems and services in your analysis when they create, receive, maintain, or transmit your electronic PHI. A vendor questionnaire can inform your review, but it does not replace an analysis of your organization’s risks. See HHS guidance on risk analysis and 45 CFR § 164.308(a)(1).

For each vendor relationship, document enough information to understand and manage the risks, such as:

• What PHI or Part 2 records the vendor handles, why it needs them, and whether it stores, transmits, or can access them.
• Which systems, locations, users, subcontractors, and interfaces are involved, including how access is authorized and removed.
• Relevant threats and vulnerabilities, existing safeguards, the likelihood and potential impact of a compromise, and any remaining risk.
• Risk decisions, mitigation steps, responsible owners, target dates, and follow-up reviews.
• Material changes to the service, data, access, or vendor that could change the risk profile.

Keep supporting evidence—such as data-flow diagrams, vendor responses, contract reviews, and security documentation—alongside your analysis and decisions. HHS does not expressly require customers to audit every vendor’s security practices; however, you can negotiate for evidence, assessments, or audit rights when appropriate to your risk management. The vendor’s own HIPAA duties remain separate: a business associate must meet applicable Security Rule requirements for the electronic PHI it handles.

What safeguards and staff training should vendor oversight include?

Choose safeguards based on the risks, the systems involved, and the sensitivity of the information. Oversight may include role-based access, strong authentication, encryption where appropriate, logging and monitoring, secure transmission, tested backup and recovery, vulnerability management, and secure disposal. For Part 2 records, also establish formal policies and procedures to reasonably protect patient-identifying information from unauthorized use or disclosure and anticipated security threats. See 42 CFR § 2.16 and HHS’s Security Rule summary.

Train your own workforce on the privacy and security policies relevant to their roles, including how to recognize and report suspected incidents involving vendors. Require vendors to train and supervise their personnel who handle your information, and confirm that contracts assign responsibility for access controls, incident response, and subcontractor oversight. HIPAA requires specified workforce training, but it does not impose a universal annual certificate-renewal requirement. Set refresher training based on your policies, staff roles, changes in systems or rules, and identified risks. See 45 CFR § 164.308(a)(5) and 45 CFR § 164.530(b).

Review vendor performance throughout the relationship, not only during procurement. Revisit access, subcontractors, incidents, and security evidence when services change or concerns arise. HIPAA does not prescribe a specific vendor-audit schedule, so set monitoring frequency and depth according to the risks and your documented oversight process.

How do Part 2 breach reporting and enforcement requirements affect vendors?

Part 2’s 2024 final rule took effect on April 16, 2024, and its compliance date was February 16, 2026. Part 2 programs must now follow the HIPAA Breach Notification Rule for breaches of unsecured Part 2 records, including notifying affected individuals and HHS and, in certain circumstances, the media. See HHS’s Part 2 Final Rule fact sheet and HHS’s Part 2 overview.

When a HIPAA business associate discovers a breach of unsecured PHI, it must notify the covered entity without unreasonable delay and no later than 60 days after discovery. The covered entity remains responsible for required notifications, although it may delegate notice tasks to the business associate. The HIPAA deadline is an outer limit, not necessarily a suitable contract deadline: require vendors to notify your program promptly enough for you to investigate, mitigate harm, and meet your own reporting duties. Specify what the vendor must provide, including known facts about the incident and affected individuals. See HHS’s Breach Notification Rule guidance and 45 CFR § 164.410.

Part 2 also requires certain lawful holders’ contracts with downstream contractors to require reporting of unauthorized uses, disclosures, or breaches. Put incident escalation and cooperation duties into vendor agreements, and keep records of the investigation, risk assessment, mitigation, and notifications—or the basis for determining that notification was not required.

The HHS Office for Civil Rights (OCR) enforces Part 2 and can investigate complaints and conduct compliance reviews. HIPAA business associates are also directly liable for certain HIPAA violations. A vendor’s failure to comply can therefore create regulatory exposure as well as operational and reputational harm for your program. See HHS information on Part 2 enforcement and HHS guidance on business associate liability.

In practice, effective vendor risk management means identifying the vendor’s role, confirming the legal basis for sharing records, documenting risk and safeguards, and setting clear contract and incident-response duties. Reassess those controls as vendors, services, and information flows change.

FAQs

Do SUD treatment programs need a business associate agreement with every vendor?

No. A BAA is generally required when a HIPAA covered entity engages a vendor to perform services on its behalf that involve PHI. A vendor that cannot access PHI, whose access is only incidental, or that acts only as a conduit may not require a BAA. A Part 2 program may still need a QSO agreement or another written agreement that meets Part 2 requirements, depending on the vendor’s role and how it receives records.

When does Part 2 apply to a vendor that receives SUD records?

Part 2 may apply when the vendor receives records from a federally assisted SUD diagnosis, treatment, or referral program in a role covered by the regulation—for example, as a QSO or as a contractor receiving records from a lawful holder under a permitted disclosure. The vendor’s obligations depend on the disclosure basis, its role, and any required consent or written agreement.

What must a vendor risk analysis document under HIPAA?

HIPAA requires an accurate and thorough analysis of risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI. Document the vendor-related data and systems, relevant threats and vulnerabilities, existing safeguards, risk decisions, and mitigation actions. HIPAA does not mandate a particular template or methodology.

What are the breach notification requirements for vendors handling Part 2 records?

A HIPAA business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. Part 2 programs must follow the HIPAA Breach Notification Rule for breaches of unsecured Part 2 records, including notices to affected individuals and HHS and, when applicable, the media. Agreements should require vendors to report incidents promptly and provide enough information for the program to meet its obligations.