Run the review in six steps: define what data the software touches, tier the vendor, agree the contract terms, collect evidence, do a short technical check and record the decision with an owner and a review date. Skipping the first step is the usual failure, because teams review the vendor instead of the data flow.
Steps 1 to 3: scope, tier and contract
Step 1, scope the data flow.
Draw what PHI goes in, where it is stored, who can see it and where it goes next. If no PHI is involved, the review can be short. If PHI is involved, the vendor is likely a business associate and the Security Rule expects satisfactory assurances documented in a written contract.
Step 2, tier the vendor.
High volume or hard to replace means a deep review. Limited data means a short one. Write down the reason, because the rule lets you vary measures by size, complexity and risk.
Step 3, contract terms.
Insist on the business associate agreement, incident reporting terms with a notice window shorter than the outer limit, subcontractor flow down, access and audit rights where practical, and return or destruction at termination.
Step 4: Evidence
Request the pack: subprocessor list, independent report with scope, risk analysis summary, incident plan, patch policy and backup test record. Read exceptions and dates.
Step 5: Technical check
| Check | Method |
|---|---|
| Component inventory | Ask for an SBOM or scan software you host |
| Known vulnerabilities | Compare components with advisory data and exploit status |
| Authentication | Confirm multi factor authentication and unique user IDs |
| Encryption | Ask about data at rest and in transit |
| Logging | Confirm audit logs are available to you |
Try it yourself
Click through it at your own pace, or open it full screen. Use the inventory view to see what a software package pulls in, then decide which findings you would raise with a vendor.
Step 6: Decide and record
Write a one page decision: approved, approved with conditions or rejected. Include owner, date, conditions and the next review date. Store it with the evidence.
After go live.
Set review triggers: a change of ownership, a new subprocessor, a vendor incident or expiry of the report. Add a calendar check at the interval you chose.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
How long should a review take?
It varies with tier and vendor responsiveness. Set a target for each tier and track it, so purchases do not stall.
Who has final say?
A named owner in security or compliance should approve, with business input. Check your governance rules with counsel.
Sources
- 45 CFR 164.308, Cornell LII
- 45 CFR 164.306, Cornell LII
- 45 CFR 164.314, Cornell LII
- 45 CFR 164.504, Cornell LII
Last reviewed: 19 October 2026.
