Ask for the business associate agreement, a subprocessor list, a recent independent report with scope and exceptions, a risk analysis summary, an incident response summary, a patch and vulnerability policy and proof of backup testing. Each proves something specific. Together they form an evidence pack for your file.
The evidence pack
| Document | What it proves | What it does not prove |
|---|---|---|
| Business associate agreement | Contract duties accepted | Controls operate |
| Subprocessor list with functions and locations | Who touches your data | That each is vetted |
| Independent report such as SOC 2 | A tester examined defined controls | Coverage of your product or current state |
| Risk analysis summary | The vendor assessed risks and vulnerabilities | That findings were closed |
| Incident response plan summary and contact test | A route exists to reach them | Speed under stress |
| Patch policy with recent examples | Intent and some practice | Every system is current |
| Backup and restore test record | Recovery was tried | That it works today |
| Access model description | Who can see PHI | Actual access logs |
| Component inventory or SBOM | What software is inside | Reachability or fix status |
How to ask
- Send one list, with a due date, and say which items are mandatory for your tier.
- Accept summaries where full documents are confidential, but ask for dates and scope.
- Ask for exceptions and open findings, not just the clean cover page.
- Keep every item with the received date.
Reading the results
- Match report scope to the product you buy.
- Check the dates and period covered.
- Note any control the vendor marked as not applicable and ask why.
- Compare answers against each other. A claim of daily patching with a six month old component list does not add up.
Map it to controls
Map what you receive to the rule's headings: risk analysis, access control, audit controls, integrity, transmission security, contingency plan and incident procedures. Gaps show where to ask follow ups.
Try it yourself
Click through it at your own pace, or open it full screen. Trace one piece of evidence to the controls it supports, and see how a single document can cover several requirements.
Keep it proportionate
A tier three vendor does not need nine documents. The Security Rule allows a flexible approach that weighs size, complexity, cost and risk.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Should I ask for penetration test reports?
Ask for a summary with scope, date and remediation status. Full reports are often shared under agreement.
How long should I keep the evidence?
The rules have documentation retention requirements. Confirm periods with counsel.
Sources
Last reviewed: 19 October 2026.
