Vendor security questions to ask
A small practice cannot audit a software company, but it can ask good questions and listen carefully to the answers. This questionnaire is built for owners and office managers, not IT departments. Use it before you sign with any vendor that will handle patient information, and keep the answers in your compliance file. It is general information, not legal advice.
- Your practice remains responsible for patient data it shares, and HIPAA requires a risk analysis that should cover your vendors.
- Ask about six areas: the contract, the data, access, incidents, resilience and independent review.
- Specific, written answers are a good sign. Vague reassurance and "HIPAA certified" badges are not.
- Independent audit reports are useful evidence, but HHS does not recognize any certification as proof of HIPAA compliance.
Why a small practice should ask at all
The HIPAA Security Rule requires every covered entity to conduct an accurate and thorough assessment of the risks to the electronic PHI it holds (45 CFR 164.308(a)(1)(ii)(A)). Data you send to a vendor is still your patients' data, and vendors are a common source of incidents. A short, consistent questionnaire is the practical way to fold vendors into that analysis.
Free government resources can help you go further. The HHS 405(d) Program publishes Health Industry Cybersecurity Practices, with guidance sized for small practices, and NIST Special Publication 800-66 Revision 2 maps the Security Rule to practical controls. Federal law also directs HHS to consider whether an organization had recognized security practices in place for the prior 12 months when it decides fines and audits, so documented diligence has value beyond peace of mind.
1. The contract
- Will you sign our Business Associate Agreement, or provide yours, before any patient data is shared? Good answer: yes, for every plan, before any trial or setup. Red flag: only on a premium tier, or after onboarding.
- How quickly will you notify us of a security incident involving our data? HIPAA allows a business associate up to 60 days (45 CFR 164.410). Good answer: a specific, much shorter commitment written into the BAA.
- Which subcontractors will handle our data, and are they bound by the same terms? Good answer: a named list, with written agreements. Red flag: "that's proprietary."
2. The data
- Exactly which data fields do you need from us? Good answer: a short list tied to what the product does. Red flag: "send us everything and we'll sort it out."
- Where is our data stored and processed? Good answer: named countries, ideally U.S. data centers, and the hosting provider.
- Is our data encrypted in transit and at rest, including backups? Good answer: yes, with the TLS version and encryption standard named.
- Do you use our data for anything besides serving our practice, such as product analytics or AI training? Good answer: no, or a clear, limited answer written into the BAA.
- How do we get our data back, and how is it destroyed when we leave? Good answer: a standard export format and written confirmation of destruction.
3. Access
- Does every user get a unique login? The Security Rule requires unique user identification (45 CFR 164.312(a)(2)(i)). Shared logins are a red flag on both sides.
- Is multi-factor authentication available or required? Good answer: required for anyone who can see patient data, including the vendor's own staff.
- Can we limit what each of our staff can see? Good answer: role-based permissions, so a front desk login does not see billing totals, for example.
- Which of your employees can see our data, and why? Good answer: a small, defined group with a business need, with access reviewed regularly.
- Do you keep audit logs, and can we see them? The Security Rule requires audit controls (45 CFR 164.312(b)). Good answer: yes, including who viewed or exported patient data.
4. Incidents and resilience
- Do you have a written incident response plan, and when was it last tested? Good answer: yes, with a recent date.
- Who is our contact if something goes wrong, at any hour? Good answer: a named role and a monitored channel.
- How often do you back up our data, and how fast can you restore it? The Security Rule requires a contingency plan with data backup and disaster recovery (45 CFR 164.308(a)(7)). Good answer: specific backup frequency and recovery targets.
- Have you had a reportable breach in the past few years? What changed afterward? An honest answer with lessons learned is better than an evasive one.
5. Independent review
Ask what outside evidence the vendor can share: a recent third-party security audit report, such as a SOC 2 Type II report or a HITRUST assessment, a penetration test summary, or the results of an independent HIPAA risk assessment. These reports are useful because someone other than the vendor checked the controls.
Keep them in perspective. HHS states in its Security Rule FAQ that it does not endorse or recognize private organizations' certifications, and that such certifications do not absolve a covered entity of its obligations. A vendor that calls itself "HIPAA certified" is describing something that does not exist. Read what any report actually covers, which systems, and which dates.
Scoring the answers
You do not need a perfect vendor. You need one whose answers are specific, written down and consistent with the contract. A simple way to score:
- Deal-breakers: no BAA, no encryption, shared logins, or refusal to name subcontractors. Do not share patient data.
- Fix before signing: slow breach notice, unclear data use rights, no export path. Negotiate them into the BAA or contract.
- Note and monitor: missing independent reports, MFA optional rather than required. Record them in your risk analysis and revisit at renewal.
- Keep the completed questionnaire with the signed BAA and review both at least once a year or whenever the vendor's product changes significantly.
Ask DocsMD every one of these questions
DocsMD signs a Business Associate Agreement with every practice before any patient data moves, encrypts data at rest and in transit, keeps it in U.S. data centers and never uses patient data to train AI. It starts from the schedule export your EHR already produces, with no system access. Review the details on our security overview and HIPAA and BAA page.
Questions
Is a SOC 2 report the same as HIPAA compliance?
No. A SOC 2 report is an independent auditor's review of a company's controls against a defined framework. It can be strong evidence of security practices, but HIPAA compliance depends on the vendor's actual handling of PHI and the BAA. HHS does not recognize any certification as proof of compliance.
How long should this take for a small practice?
For most vendors, an hour of reading and a short call. Send the questions in writing, ask for written answers and file them with the BAA.
What if a vendor won't answer?
Treat silence as a risk in your analysis. A vendor that will not explain how it protects patient data is asking you to accept that risk without knowing its size.
Do I need to send this to vendors that never see patient data?
No. Focus on vendors that create, receive, maintain or transmit PHI for your practice. For others, make sure they truly have no access. This article is general information, not legal advice.