Tier vendors by what they can do to your protected health information: how much of it they hold, whether they can change it, and how hard it would be to run without them. Three tiers are enough for most teams, with deep review for tier one and a short form for the rest.
Why tier at all
The Security Rule lets an organisation choose measures based on size, complexity, technical capabilities, cost, and the probability and criticality of risks to ePHI. That flexibility works when you can explain your choices. A tiering model is a written reason for why one vendor got a long review and another a short one.
The three questions
- Does the vendor create, receive, maintain or transmit PHI for you? If yes, it is likely a business associate and needs an agreement.
- How much PHI, and how sensitive is it?
- If it fails or is compromised, can patient care or billing continue?
A decision table
| Tier | Typical profile | Review depth | Refresh |
|---|---|---|---|
| 1 | Holds or processes large volumes of PHI, or is hard to replace | Full questionnaire, evidence, technical review, incident contact test | Yearly and on major changes |
| 2 | Limited PHI or limited access, replaceable | Short questionnaire, report review, subprocessor list | Every two years or on change |
| 3 | No PHI, no network access to PHI systems | Basic security terms, contract check | At renewal |
These intervals are a starting point, not a requirement. Adjust them to your risk analysis.
Edge cases
- A free tool that staff paste PHI into is still a vendor. Find it, then either sign an agreement or block it.
- A vendor with no PHI but a network path into PHI systems belongs in tier two or higher.
- An open source library is not a vendor in the contract sense, but it is part of your supply chain. Track it with an inventory, which is a different process.
Keep it moving
Put the tier in your register, write down the reasoning, and revisit after any breach in the news that touches a similar vendor. A tier that never changes is probably wrong.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Is a three tier model required?
No. The rules require a risk based approach and documentation. Tiers are one practical way to meet that expectation.
Where do contractors go?
Individual contractors under your direct control may be workforce rather than business associates. See our post on that distinction.
Sources
Last reviewed: 19 October 2026.
