Generally no. The Security Rule says a covered entity is not required to obtain satisfactory assurances from a business associate that is a subcontractor. The business associate must get those assurances from its own subcontractors. Your job is to confirm that your vendor does this, and to ask who the subcontractors are.
How the chain is built
The definition of business associate includes a subcontractor that creates, receives, maintains or transmits protected health information on behalf of a business associate. A subcontractor is a person to whom a business associate delegates a function, activity or service, other than as a member of its workforce.
Under the contract rules, the business associate must ensure that subcontractors handling electronic protected health information agree to comply with the applicable requirements. Contracts between a business associate and a subcontractor follow the same requirements as contracts between a covered entity and a business associate.
Who signs with whom
| Relationship | Who obtains assurances | Document |
|---|---|---|
| Hospital to software vendor | Hospital | Business associate agreement |
| Software vendor to cloud host that stores PHI | Software vendor | Subcontractor agreement |
| Cloud host to its own service provider holding PHI | Cloud host | Subcontractor agreement |
| Hospital to vendor's cloud host | Not required of the hospital | None required by the rule |
What to ask your vendor
- Which subcontractors create, receive, maintain or transmit our data?
- Do you have signed agreements with each of them that carry the same terms?
- How do you review them, and how often?
- What happens if one of them has a security incident? Who tells us and when?
- Will you give us notice before adding a new subcontractor that handles our data?
Ask for a list, not a promise. A short subprocessor list with function and location is a good sign. A refusal to share one is worth noting in the file.
A word on infrastructure
Whether a given infrastructure provider counts as a subcontractor depends on whether it maintains protected health information for the vendor. Cloud storage that holds PHI usually fits that description. Provider guidance from HHS discusses cloud computing, but we could not retrieve that page for this post, so read it directly and ask counsel about edge cases.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Should I ask for copies of my vendor's subcontractor agreements?
You can ask for confirmation, a list and the key terms. Many vendors will not share full contracts, so evidence of flow down is often enough for your file.
Is my vendor liable for its subcontractor?
The civil penalty rules refer to agents acting within the scope of agency. Whether a subcontractor is an agent is fact specific, so ask counsel.
Sources
- 45 CFR 160.103, Cornell LII
- 45 CFR 164.308, Cornell LII
- 45 CFR 164.314, Cornell LII
- 45 CFR 164.502, Cornell LII
Last reviewed: 19 October 2026.
