HHS's January 2025 proposal to update the HIPAA Security Rule would require covered entities and business associates to obtain written verification from their business associates and to assess the risk of each arrangement. Whether or not that rule is finalized, the direction matches what buyers in every sector already do: they assess their suppliers, and small suppliers feel it first.
What's affected
Any software company that is somebody else's vendor. A typical review asks for a questionnaire, a security report, policies, a list of your subprocessors, and proof for a few controls.
What to do now
Keep one folder, reviewed every quarter, with:
- A company and product overview, hosting locations and subprocessor list.
- Current policies: information security, access control, incident response, vendor management.
- Your latest independent report, if you have one, and the date.
- A recent penetration test summary and your fix status.
- An incident response plan and the date it was last tested.
- MFA and access review evidence.
- Insurance certificate, if the contract asks for it.
- A completed standard questionnaire as the base for new ones.
Name an owner who answers within two business days. Speed signals maturity.
How to avoid this trap
- Do not send different versions of documents to different buyers.
- Do not let evidence go stale. Dates matter.
- Do not forget your own vendors. Buyers ask who your critical suppliers are.
Try it yourself
Ask a colleague to request "everything a buyer would ask for" and time how long it takes to assemble. Anything slower than a day is your work list.
Click through it at your own pace, or open it full screen.
Quick check
What is the cheapest way to speed up vendor reviews?
A standing evidence pack with an owner, reviewed on a schedule, plus a completed base questionnaire.
