Between annual reviews, watch five signals you can check without asking the vendor: advisories for the products and components it ships, breach news, subprocessor changes, report expiry dates and the vendor's own notices. Put each in a calendar or alert so a change triggers a short review instead of waiting for renewal.
Why annual is not enough
The Security Rule asks for periodic evaluation in response to environmental or operational changes affecting ePHI. A vendor's risk changes whenever it ships code, changes hosts or is hit by a public vulnerability. A once a year form cannot see that.
Five signals
| Signal | Where to look | Action on change |
|---|---|---|
| Public vulnerabilities in the vendor's products or stack | Advisory feeds, vendor security page | Ask whether you are affected and when the fix ships |
| Incident or breach reports | News, regulator notices, vendor email | Request a written summary and start a review |
| New or changed subprocessors | Vendor subprocessor page | Check flow down terms and locations |
| Expiring report or certificate | Your vendor file | Request the new one with scope and exceptions |
| Product or contract change | Release notes, renewal terms | Reassess tier and data flows |
Make it cheap
- Keep a register with product names, versions and component lists where available.
- Subscribe to the vendor's security mailing list and a public advisory feed.
- Set a calendar item for each report expiry.
- Name one owner per tier one vendor.
- Write a one page procedure for what to do when a signal fires.
Technical signals for software you run
If the vendor ships software you host, scan it as you would your own code. Compare its component list across versions. A new dependency, an end of life library or a flaw with a known exploit deserves a question.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a newly disclosed flaw is matched to affected components, and picture the same check running against a vendor product list.
Record the result
Even a negative check is evidence. A note that says we checked advisories on this date and found nothing relevant is useful in a later review.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Can I scan a vendor's systems?
Not without permission. Stick to public information and what the contract allows, such as shared reports and component lists.
Who should own monitoring?
A named person in security or compliance, with a backup, so it does not lapse.
Sources
Last reviewed: 19 October 2026.
