The Security Rule text does not set a fixed review interval for vendors. It requires a periodic technical and nontechnical evaluation, repeated in response to environmental or operational changes that affect ePHI. A practical approach is a yearly refresh for high risk vendors plus event driven reviews when something changes.
What the rule says
The evaluation standard calls for a periodic technical and nontechnical evaluation, based first on the standards in the rule and afterwards in response to environmental or operational changes affecting the security of ePHI. It measures the extent to which the entity's policies and procedures meet the requirements. It does not name a number of months.
Triggers that should start a review
| Trigger | Why it matters |
|---|---|
| Vendor ownership change or acquisition | Teams, subcontractors and priorities often change |
| New data types or volume sent to the vendor | Risk rises with the data |
| A security incident at the vendor | Direct evidence of control failure |
| A public vulnerability in a component the vendor uses | Exposure may be live now |
| New subprocessor or hosting move | The chain you reviewed has changed |
| Expiring report or certificate | Assurance goes stale |
| Your own product or workflow change | New data paths appear |
A cadence you can start from
- Tier one: full refresh yearly, light check twice a year.
- Tier two: refresh every two years.
- Tier three: check at renewal.
Document why you chose them. If your counsel or auditor expects something different, follow that.
Between reviews
Annual questionnaires go stale in weeks. Between them, watch signals you can check without the vendor: security advisories for products it ships, breach news, certificate and domain hygiene, and the dependency inventory it shares with you.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are tracked over time and notice how a status change can trigger a review instead of waiting for a calendar date.
A simple review record
For each vendor, record the tier, last review date, evidence reviewed, open issues, owner and next date. One spreadsheet is fine to start.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Is yearly review required by HIPAA?
Not by the text we reviewed. The rule asks for periodic evaluation in response to change. Yearly is a common choice, so confirm with counsel.
What is the cheapest useful check?
Subscribe to the vendor's security notices and set an alert for its products in public advisory feeds.
Sources
Last reviewed: 19 October 2026.
