A signed business associate agreement is necessary but it is not a security review. The Security Rule asks the covered entity to obtain satisfactory assurances that the vendor will appropriately safeguard ePHI, and the contract documents them. The contract does not show whether the vendor's controls work.
What the BAA does
It records promises: the vendor will comply with the applicable Security Rule requirements, pass terms to subcontractors and report security incidents. It also sets what happens at termination. Those are real obligations and you should insist on them.
What the BAA does not do
- Prove the vendor performed a risk analysis.
- Show that multi factor authentication is on.
- Confirm that backups restore.
- Reveal which open source components ship in the product.
- Tell you how quickly the vendor patches.
The rule also expects covered entities and business associates to conduct accurate and thorough risk analysis and to perform periodic evaluation. A buyer who accepts a promise with no look behind it has a thin file.
A lightweight review in layers
| Layer | Ask for | Time to review |
|---|---|---|
| Contract | BAA, subprocessor list, incident terms | Short |
| Attestations | Recent independent report with scope and exceptions | Medium |
| Technical | Dependency inventory, patch policy, access model | Medium |
| Operational | Incident contact test, sample notice, backup restore evidence | Short |
| Ongoing | Notice of material changes, annual refresh | Recurring |
Scale it to the data
The rule gives flexibility: factors include size, complexity, infrastructure, cost and the probability and criticality of risks to ePHI. A scheduling widget that never sees PHI does not need the same review as a records platform. Put your vendors in tiers and spend effort where the risk is.
Red flags in vendor answers
- Refusal to say who the subprocessors are.
- A questionnaire answered with links to marketing pages.
- A report whose scope does not match the product you are buying.
- No named security owner.
- A BAA that excludes security incident reporting or caps notice at the maximum window.
A short example
Imagine a scheduling vendor that signs your agreement in a day. The contract is fine. Then you ask for its subprocessor list and learn that call recordings go to a transcription service you never heard of. The agreement did its job, but the follow up question exposed the gap. That is the value of asking for evidence next to the contract: the two answers should agree. When they do not, pause, ask, and write down what you learned before you go live.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Do small clinics need a full review for every vendor?
The rule allows a flexible, risk based approach. Tier vendors by the PHI they touch and review the high tier more deeply.
Who should sign off a vendor?
Name an owner in security or compliance and record the date and decision. Ask counsel about your own obligations.
Sources
Last reviewed: 19 October 2026.
