Free tools Windows power users keep installed
One-click scans. No signup required.
Evaluate the vendor’s actual data access, uses, disclosures, safeguards, and de-identification method—not its “HIPAA compliant” marketing alone. Start by mapping the information flow, determine whether the vendor handles protected health information (PHI) on a covered entity’s behalf, and then verify that any claimed de-identification is supported for the specific dataset and its intended recipients. This U.S.-focused guide reflects HHS and FTC guidance available as of October 7, 2026; it cannot determine a particular vendor’s legal status without the facts of the arrangement.
What information will the vendor receive and what will it do with it?
Before reviewing a privacy notice or security questionnaire, establish what the service actually handles. Include identifiable records, data the vendor creates from them, and information it can access while providing support. Ask the vendor to describe each data source, purpose, recipient, retention period, and deletion process. HHS recommends examining those practices and checking whether they match what the company tells consumers.
As an Amazon Associate I earn from qualifying purchases.
A practical way to make the review concrete is to draw the data flow from collection through final deletion. Include ingestion, processing, analytics, support access, subcontractors, exports, backups, and any return of data to the customer. For each step, record what information is present, who can access it, why they need it, and whether it is sent onward.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Collection and source: What fields, files, notes, or derived information enter the service, and who supplies them?
- Access and purpose: Which vendor personnel or systems can see the data, including during troubleshooting, and for what service function?
- Disclosure: Which subcontractors, customers, researchers, or other recipients receive data, and what do they receive?
- Retention and deletion: How long does each copy remain, including in backups, and how does the vendor carry out deletion or return?
- Secondary use: Can the vendor use information for its own analytics, product development, advertising, or other purposes beyond the service?
Compare the answers with the vendor’s privacy notice, sales materials, consent screens, and deletion promises. A claim is useful only if it describes actual practices rather than an aspiration.
#1 Best Overall
Is the vendor a HIPAA business associate?
The answer depends on the vendor’s function and access to PHI, not simply on whether it sells healthcare software. HIPAA applies to covered entities and business associates as defined by the rules. HHS says that providing software to a covered entity does not by itself create a business-associate relationship if the vendor has no access to the covered entity’s PHI. A vendor that hosts patient information or accesses it to troubleshoot a service may have a different role.
- Identify the customer’s status. Determine whether the customer is a HIPAA covered entity and whether the information involved is PHI.
- Identify the vendor’s function. Establish whether it performs a service or function involving PHI on the customer’s behalf.
- Verify actual access. Ask whether the vendor can view, maintain, or otherwise access PHI, including through hosting, support, or subcontractors.
- Resolve the contract requirement. If the vendor is a business associate, a covered entity generally needs a written business-associate contract describing the engagement and requiring safeguards.
Review whether the contract’s permitted uses and disclosures, access protections, subcontractor terms, incident reporting, cooperation duties, and return or destruction requirements fit the actual service. The exact provisions depend on the parties, data, and arrangement; a label in the contract does not substitute for understanding the vendor’s real access.
Rank #2
How does the vendor de-identify health data?
HIPAA recognizes two methods: Safe Harbor and Expert Determination. Ask the vendor to name the method it relies on, identify the dataset and disclosure context covered by the assessment, and provide supporting documentation. HHS does not establish one universal numerical threshold for the “very small” identification risk required under Expert Determination.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| HIPAA method | What the method requires | What to request from the vendor |
|---|---|---|
| Safe Harbor | Remove the specified identifiers and satisfy the condition that the organization has no actual knowledge the remaining information could identify a person, alone or in combination. | An explanation of how each applicable identifier is found and removed, how remaining details are reviewed for combinations that could identify someone, and how the vendor addresses information it actually knows presents a risk. |
| Expert Determination | A qualified person applies accepted statistical and scientific principles to determine that the risk of identification is very small in the anticipated recipient context, and documents the methods and results. | The expert’s relevant experience, analysis scope, anticipated recipients and available auxiliary information considered, mitigation steps, and documentation of the methods and results. |
For Expert Determination, ask whether the analysis reflects the recipient’s capabilities and other reasonably available information that could be linked to the dataset. HHS describes an assessment process that can include mitigation and evaluation of the resulting data, sometimes over several iterations. A generic certificate does not establish that every dataset is suitable for every recipient or use; confirm that the assessment matches the proposed disclosure.
Can de-identified health data be re-identified?
Yes, some risk can remain. HHS states that both properly applied HIPAA methods can yield de-identified data that retains some risk of identification. The relevant question is not whether a vendor can promise zero risk, but whether it can explain and document how the risk was assessed for the dataset and disclosure in question.
Check free text and unusual combinations
Safe Harbor does not distinguish structured fields from free text: a recognizable specified identifier must be removed wherever it appears. Ask how the vendor examines clinical notes, narratives, and derived fields, not just database columns. Contextual details, rare events, unusual occupations, and combinations of dates or procedures may also make a record recognizable and should be considered when evaluating the actual-knowledge condition or an expert’s risk analysis.
Ask about residual-risk controls and linkage
Request details about review for residual risk, suppression or generalization of data, recipient access restrictions, and whether a linkage key or other means of re-identification exists. HHS guidance discusses circumstances in which an Expert Determination may permit a derived code when the re-identification key is not disclosed. A data use agreement can add recipient safeguards, but it does not replace the technical and documentation requirements of either HIPAA de-identification method.
What privacy, security, and incident controls should you verify?
Ask the vendor for evidence about the controls relevant to the service rather than relying on a broad compliance claim. HHS lists risk assessment, access controls, workforce training, audit controls, contingency planning, and encryption practices as examples of HIPAA Security Rule safeguards for electronic PHI (ePHI). Match the requested evidence to the data flow and the vendor’s access.
Best Value
- No more exposed information in unprotected notary journals. This product shields clients' confidential information from prying eyes. It allows the Notary Public to keep the journal open during the transaction, as NO prior client information is viewable.
- Shields clients' AND Notaries Public' confidential information
- GLBA and HIPAA require strict confidentiality policies and procedures. Notary Privacy Guard is a compliance tool for the professional Notary Public.
- Decreases Notary Public's liability from exposing client information
- Journal column headers are printed on the Notary Privacy Guard, no having to peek underneath to complete the journal entry. Becomes part of the journal and also acts as a place marker.
- How does the vendor limit and review workforce access to the data?
- What audit records show who accessed information and when?
- How are subcontractors assessed and bound to relevant protections?
- How does the vendor prepare for service disruption and restore operations?
- How does its incident-response process identify, investigate, and communicate a potential breach?
Agree on who detects and reports an incident, what information the vendor must provide, and the contractual notification timeline. Under HIPAA, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. Covered entities have their own notification duties, and regulated parties have documentation responsibilities. The FTC Health Breach Notification Rule may create separate obligations for certain personal health record vendors and related entities that are not covered by HIPAA.
Does HIPAA cover every health-data vendor?
No. HIPAA’s coverage depends on whether the organization and its role meet the rules’ definitions. HHS also identifies obligations under the FTC Act for companies handling health information, including some companies that are not subject to HIPAA. The FTC Health Breach Notification Rule applies to certain personal health record vendors and related entities; it is not a blanket rule for every technology company handling health information.
Check which federal rules apply to the actual parties and service, and assess other potentially relevant requirements separately. State privacy laws, international rules, research requirements, contractual duties, and sector-specific restrictions may also affect a proposed data use or disclosure.
How should you compare vendors?
Use the same questions and evidence requests for each candidate. The following is a buyer’s comparison framework synthesized from HHS and FTC guidance, not an official government scoring rubric.
| Comparison area | Evidence to compare |
|---|---|
| Legal role and PHI access | Service functions, hosting and support access, relevant subcontractors, and whether the arrangement requires a business-associate contract. |
| Data handling | Data minimization, purposes, onward disclosures, retention, deletion, and consistency with consumer-facing statements. |
| De-identification | Method, dataset and recipient scope, supporting documentation, and treatment of residual risk. |
| Complex records | How the vendor handles free text, rare events, unusual details, and combinations of information. |
| Safeguards and incidents | Access controls, auditability, security operations, subcontractor protections, and incident readiness. |
| Contracts and transparency | Permitted uses, disclosure limits, cooperation duties, deletion terms, and whether public claims match practice. |
When a particular dataset or legal arrangement is difficult to assess, a qualified privacy lawyer or statistical de-identification expert can help evaluate the facts and the documentation. The decision remains specific to the information, service, recipient, and intended use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
