Vendor Risk Management for Skilled Nursing Facilities: A HIPAA Compliance Guide

What HIPAA requires of skilled nursing facility vendors

A skilled nursing facility that qualifies as a HIPAA covered entity must protect residents’ protected health information (PHI) and meet applicable HIPAA requirements, even when it hires outside organizations to perform services. Nursing homes are among the health care providers that may be covered entities when they conduct certain standard transactions electronically, such as electronic billing. See the HHS overview of covered entities.

When a vendor performs a function or service on the facility’s behalf that involves PHI, the vendor may be a HIPAA business associate. The facility generally must have a written business associate agreement (BAA) in place before allowing the business associate to create, receive, maintain, or transmit PHI for it. Business associates must follow the applicable HIPAA requirements, including relevant Security Rule requirements for electronic PHI. See HHS guidance on business associates and the HHS summary of the Security Rule.

For a facility and its business associates, the Security Rule calls for appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information. It also requires a documented Security Rule risk analysis and risk management process. A BAA helps establish a vendor’s obligations, but it does not transfer the facility’s own compliance responsibilities to the vendor.

How to identify vendors that handle protected health information

Start with a complete inventory of vendors, services, and information flows—not just vendors that work directly with clinical records. Review procurement records, contracts, department lists, system accounts, and workflows to identify who may create, receive, maintain, transmit, or access residents’ PHI.

For each vendor, record the service it provides, the PHI involved, how it receives or accesses that information, where it is stored, who can access it, how long it is retained, and whether the vendor uses subcontractors. Common examples to review include EHR hosting and support, billing and claims processing, cloud storage, data backup, outsourced coding, IT support, and secure document destruction. These are examples to assess—not an automatic determination that every vendor has a business associate relationship.

Determine the vendor’s role based on what it actually does. A software provider that has no access to the facility’s PHI may not be a business associate solely because it supplies software. By contrast, a vendor that hosts the software with PHI or accesses the information while troubleshooting may qualify. A vendor whose work does not involve PHI may also fall outside the BAA requirement when any access would be merely incidental and reasonable safeguards are in place. See HHS guidance on software vendors and its business associate examples and exceptions.

Check downstream relationships as well. If a business associate uses a subcontractor that will handle PHI for the facility, the business associate generally must obtain the required written assurances from that subcontractor. Document the decision for each vendor, including why a BAA is or is not needed, and revisit it if the service or access changes.

How to conduct and document vendor risk assessments

A vendor risk assessment helps the facility understand how a vendor’s services could affect resident information and operations. It should support—not replace—the facility’s broader Security Rule risk analysis. HHS explains that the Security Rule risk analysis covers potential risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic PHI the organization creates, receives, maintains, or transmits. The process must be documented, although HIPAA does not prescribe a particular format. See HHS guidance on Security Rule risk analysis.

For each vendor, assess the service and information involved, the level and type of access, the vendor’s security controls, relevant threats and vulnerabilities, and the potential likelihood and impact of harm. Consider, as appropriate, access management, workforce training, incident response, backup and recovery, encryption, secure disposal, and subcontractor controls. The right questions depend on the vendor’s role and the risks identified; HIPAA does not prescribe a universal vendor questionnaire or a single checklist for every organization.

Keep a record of the assessment date, reviewer, vendor and service, PHI involved, evidence reviewed, identified risks, risk decisions, required safeguards, corrective actions, owners, and due dates. Vendor questionnaires, security documentation, and independent audit reports can help inform the assessment. HIPAA does not expressly require a business associate to provide security documentation or allow customer audits, but a facility may request additional assurances in its BAA, service-level agreement, or other contract based on its own risk analysis. See HHS guidance on vendor documentation and audits.

What to include in HIPAA business associate agreements

A business associate agreement should match the vendor’s actual services and set clear boundaries for handling PHI. HIPAA requires the agreement to establish the permitted and required uses and disclosures of PHI, restrict other uses and disclosures, and require appropriate safeguards. For electronic PHI, it must address applicable Security Rule obligations and require the business associate to report security incidents as specified by the rule and agreement.

Required BAA provisions generally address the business associate’s obligations to:

• Use or disclose PHI only as permitted by the agreement or required by law, and safeguard it against unauthorized use or disclosure.
• Report impermissible uses or disclosures, breaches of unsecured PHI, and security incidents as required.
• Ensure that subcontractors handling PHI accept the applicable restrictions and conditions.
• Help the facility meet relevant obligations involving individuals’ access, amendments, and accounting of disclosures, when applicable to the services.
• Make relevant records and practices available to HHS for compliance review.
• Return or destroy PHI when the agreement ends, if feasible, and continue protecting it when return or destruction is infeasible.
• Allow the facility to terminate the agreement for a material breach.

These are regulatory provisions, not a substitute for tailoring the contract. The facility should also consider specifying the vendor’s permitted data uses, subcontractor approval or notice process, incident contacts, cooperation during investigations, security documentation, and practical deadlines for routine incident reporting. The HHS sample BAA provisions can help identify required topics, but the agreement should be reviewed for the services and risks involved.

How to monitor vendors and address compliance gaps

Monitoring should be proportionate to the sensitivity of the PHI, the vendor’s access, the service’s importance to resident care, and the risks identified. As a practical risk-management measure, set review points for higher-risk vendors and require updates when there are material changes to services, systems, subcontractors, or security controls. A facility may use questionnaires, review available security reports, discuss open findings with the vendor, and track corrective actions.

Do not confuse prudent oversight with a universal HIPAA requirement to audit every vendor on a fixed schedule. HHS states that the HIPAA Rules do not expressly require a cloud service provider to document its security practices for a customer or permit a customer audit; a facility may negotiate such assurances based on its risk analysis. See HHS guidance on customer audits.

If the facility learns of a material breach or violation of a BAA, it must take reasonable steps to cure the breach or end the violation. If those steps are unsuccessful, the facility must terminate the agreement if feasible; if termination is not feasible, the rule requires reporting the issue to HHS. Document the concern, communications, risk to PHI, remediation plan, deadlines, and decision to continue, restrict, or end the relationship. See HHS guidance on responding to business associate violations.

What breach notification duties apply to vendors

A business associate that discovers a breach of unsecured PHI must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That 60-day period is the federal outside limit, not a reason to wait; the BAA may require faster notice. The business associate should provide, to the extent possible, the identities of affected individuals and other available information the facility needs to assess the incident and prepare notifications. See the HHS Breach Notification Rule guidance.

The facility should make sure its BAA and response procedures explain how the vendor reports suspected incidents and security incidents, not only confirmed reportable breaches. The parties can specify prompt initial notice, follow-up reports, preservation of relevant evidence, cooperation with investigation and mitigation, and a process for sharing newly confirmed facts. HIPAA’s breach rules apply to breaches of unsecured PHI; not every security incident is necessarily a reportable breach.

The facility remains responsible for ensuring required notices to affected individuals, HHS, and—when applicable—the media are made, although it may delegate some notification tasks to the business associate. A breach assessment should be documented, including the decision about whether notification is required and the basis for that decision.

How to review and update vendor risk management practices

HIPAA does not set one universal interval for repeating vendor risk assessments. HHS describes Security Rule risk analysis as an ongoing process and says the rule does not specify how frequently it must be performed; the appropriate frequency depends on the organization’s circumstances. Reassess when a vendor’s services, PHI access, subcontractors, systems, or security controls change, and after a relevant incident or newly identified risk. See HHS guidance on reviewing and updating risk analysis.

At planned reviews, confirm that the vendor inventory is current, BAAs match the services being delivered, identified remediation is complete, and risk ratings still reflect the facility’s environment. Update internal procedures and assign an owner for each unresolved issue. Keep the records together so the facility can explain its decisions and demonstrate how vendor risks were identified and managed.

In short, effective vendor risk management combines accurate vendor identification, documented risk analysis, appropriately tailored BAAs, and risk-based follow-up. Review the process as services and risks change, while distinguishing legal requirements from additional safeguards the facility chooses to adopt.

FAQs

Which vendors need a HIPAA business associate agreement?

A vendor generally needs a BAA when it performs a function or service on behalf of a covered facility that involves creating, receiving, maintaining, or transmitting PHI. Examples may include billing processors, EHR hosts, cloud storage providers, or IT vendors that access PHI while providing support. The role matters: a software provider without PHI access, a vendor whose access is only incidental under applicable conditions, or a transmission-only conduit may not require a BAA. Assess the actual service and information flow, and have the agreement in place before permitting business associate access.

What should a skilled nursing facility include in a vendor risk assessment?

Document the vendor’s service, the PHI involved, access and data flows, storage and transmission arrangements, relevant safeguards, subcontractors, potential threats and vulnerabilities, and the likelihood and impact of harm. Record the evidence reviewed, risk decisions, corrective actions, responsible owners, and due dates. The vendor assessment should feed into the facility’s broader Security Rule risk analysis rather than replace it.

How often should vendors handling protected health information be reassessed?

HIPAA does not set a fixed reassessment interval for vendors. Use a risk-based schedule and reassess sooner when services, access, subcontractors, technology, or security risks change, or after an incident. Keep the timing and reasons for reassessment documented.

What must a vendor do after a suspected HIPAA breach?

The vendor should report the incident to the facility under the BAA, promptly share known facts, preserve relevant evidence, and cooperate with investigation and mitigation. If the event is a breach of unsecured PHI, the business associate must notify the facility without unreasonable delay and no later than 60 calendar days after discovery; the BAA may set a shorter deadline. The facility must ensure required notifications are made, even if it delegates notification tasks to the vendor.