Liability after a vendor breach is not all on the vendor. The HIPAA rules put direct duties on business associates, require them to notify the covered entity, and also test whether the covered entity acted when it knew of a pattern of problems. Who pays or answers in a given case is a legal question for counsel.
Duties that sit with the vendor
A business associate that discovers a breach of unsecured protected health information must notify the covered entity. The rule says without unreasonable delay and no later than 60 calendar days after discovery. A breach counts as discovered on the first day it is known, or would have been known with reasonable diligence, to any employee, officer or agent other than the person who committed it.
The notice should identify each affected individual to the extent possible and pass along other information the covered entity needs for its own notices. The vendor must also report security incidents under its contract, and it must make its subcontractors agree to the same terms.
Duties that sit with the buyer
A covered entity is not in compliance if it knew of a pattern of activity or practice by the business associate that was a material breach, unless it took reasonable steps to cure the breach or end the violation and, if that failed, terminated the contract where feasible. In plain terms, knowing about repeated problems and doing nothing is a risk of its own.
Agents and subcontractors
Civil penalty provisions say a covered entity or a business associate is liable for the acts or omissions of an agent acting within the scope of the agency, judged under federal common law of agency. Whether a vendor is your agent depends on how much control you hold over how it does the work. That is fact specific, so do not assume either answer.
| Situation | Who has a notice duty | What the buyer should check |
|---|---|---|
| Vendor discovers a breach | Vendor notifies the covered entity | Contract timing, which is often shorter than 60 days |
| Vendor subcontractor is breached | Subcontractor notifies the vendor, vendor notifies you | That flow down terms exist |
| Buyer learns of repeated vendor failures | Buyer must act on what it knows | Written cure steps and a termination path |
Practical steps before anything goes wrong
- Put a notice deadline in the contract that is shorter than the outer limit, and name a contact.
- Ask for the vendor's incident response summary and contact tree.
- Record each missed deadline or open finding with the date you learned of it.
- Decide in advance what pattern triggers a cure letter.
- Rehearse who calls counsel.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Does the vendor's 60 days start when I find out?
No. The vendor's clock runs from its own discovery. Your own notice clocks are a separate question that depends on your facts, so ask counsel.
Am I off the hook if the contract blames the vendor?
A contract allocates cost between the parties. It does not remove duties the rules place on you, so keep your own records.
Sources
- 45 CFR 164.410, Cornell LII
- 45 CFR 164.504, Cornell LII
- 45 CFR 160.402, Cornell LII
- 45 CFR 164.314, Cornell LII
Last reviewed: 19 October 2026.
