How do you answer HIPAA questions on a customer security questionnaire?

Answer with facts you can show: your risk analysis, the safeguards you run, your incident process and whether you sign business associate agreements. Do not say you are "HIPAA certified," because no government body certifies companies. Say what you do, and attach evidence or offer it under NDA.

Why do customers ask HIPAA questions?

A covered entity, such as a provider or health plan, must have a written agreement with any vendor that handles protected health information for it. That vendor is a business associate. Your customer's questionnaire is how they decide whether to sign. The questions are shaped by the Security Rule, which sets safeguards for electronic protected health information.

What do the safeguards look like in the rule text?

The administrative safeguards in 45 CFR 164.308(a) are a useful skeleton for your answers. Required items include risk analysis, risk management, a sanction policy and information system activity review under the security management process, response and reporting for security incidents, and a data backup plan, disaster recovery plan and emergency mode operation plan under contingency planning. Other items, such as workforce clearance and security reminders, are addressable, which means you assess them and document what you chose.

That structure tells you how to organize answers: say what the requirement is, what you do, and where the evidence is.

How should you phrase the answers?

Plain statements beat adjectives. Compare:

Weak: "We take HIPAA very seriously and follow standard industry practice."

Better: "We perform a documented risk analysis annually and after major changes. The latest is dated and available under NDA."

Say "we support HIPAA requirements" only if you can say how. Say "we will sign a business associate agreement" only if your legal team has confirmed you will. If a control is planned, write "planned," with an owner. If you do not know, write that you will confirm.

What about certifications?

Be careful. There is no official HIPAA certification, so any vendor claiming one deserves a second look. If a questionnaire asks about SOC 2 or ISO 27001, state exactly where you stand. For Safeguard, SOC 2 Type II is underway and is not complete, and we make no certification claims beyond that. Never describe an architecture target as a certification.

What to do

1. Keep one master answer set, reviewed by your privacy or legal lead, and reuse it.
2. Map each question to a safeguard in 164.308 or its physical and technical siblings, then cite the matching policy or evidence.
3. Date every document you reference.
4. Maintain a short data flow diagram that shows where protected health information is stored and sent, if you handle any.
5. Decide before the first questionnaire whether you will sign a business associate agreement and who approves it.
6. Record every answer you give, so the next one stays consistent.
7. Have a second person check answers against the evidence before sending.

Can tooling help?

Software supply chain scanning can supply evidence for questions about vulnerability management and dependency inventory, such as an SBOM and a list of findings with remediation status. It does not make you compliant, and Safeguard does not certify anyone for HIPAA. Your risk analysis remains your own.

Quick check

Sources

• eCFR, 45 CFR 164.308 Administrative safeguards
• HHS, HIPAA Security Rule summary
• HHS, Business associates

Last reviewed: 18 October 2026.