The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A hospital CISO evaluating a healthcare fintech vendor should start with three questions: What protected health information (PHI) can the vendor access? How does it identify and manage security risks to electronic PHI (ePHI)? What does the contract require, and what evidence of controls can the hospital obtain? The answers determine the vendor’s HIPAA role, the safeguards and agreements needed, and whether cloud responsibilities and recovery commitments are clear.
1. What PHI does the vendor handle, and can it access it?
Ask the vendor to map the PHI it creates, receives, maintains, or transmits, and trace the data flows involved in delivering the service. Include hosting, customer support, troubleshooting, and administrative access—not just the data entered into the product during routine use.
As an Amazon Associate I earn from qualifying purchases.
Then establish the vendor’s role under HIPAA based on what it actually does. HHS explains that selling or providing software alone does not make a vendor a business associate if it has no access to PHI. By contrast, a vendor may be a business associate if it needs access to PHI to provide the service, such as hosting software containing patient information or accessing that information during troubleshooting. The hospital should resolve the role and whether a business associate agreement (BAA) is needed before permitting access. HHS guidance on cloud services and business associates and HHS guidance on software providers and PHI access
2. How does the vendor identify and manage security risks?
Ask how the vendor analyzes risks to the ePHI it handles and manages those risks over time. The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. HHS describes risk analysis as the first step in identifying and implementing safeguards, and says effective risk management supports both Security Rule compliance and broader cybersecurity preparedness. HHS: HIPAA Security Rule HHS: Guidance on risk analysis
#1 Best Overall
Make the discussion specific to the service and the PHI identified in the first question. Ask who is responsible for each relevant safeguard, how risks are prioritized and addressed, and how the vendor can explain the controls that protect the ePHI it handles. For a cloud service, do not assume that the provider owns every control: HHS advises customers to understand the particular environment and conduct their own risk analysis, while access controls and other safeguards may be divided between customer and provider. HHS: What customers should consider when using a cloud provider
3. What does the contract promise, and what evidence can the hospital obtain?
Review the BAA and related service documents together. The written agreement should establish the business associate engagement and require protection of PHI. Check its permitted uses and disclosures, safeguarding obligations, terms for subcontractors, and allocation of security duties. HHS guidance on cloud services and business associates
Ask what assurance is available
Ask what security documentation, assessments, or other evidence the vendor can provide, and whether the hospital has contractual rights to obtain it. HIPAA does not expressly require a cloud provider to provide security documentation or permit customer audits. A hospital can seek additional assurances based on its own risk analysis and risk management, and specify them in a BAA, service-level agreement (SLA), or other contract documents. HHS: Cloud-provider security documentation and customer audits
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSet cloud resilience expectations
For cloud services, address availability, reliability, backup, and data recovery in the SLA. HHS identifies these as examples of issues an SLA may cover, including preparedness for ransomware and other emergencies. Define the expectations that fit the hospital’s risk analysis rather than relying on general assurances that the service is resilient. HHS: Cloud-provider responsibilities and service-level agreements
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to compare vendors
Use the same diligence questions for each vendor, but assess answers against the service’s actual data flows and risks. These comparison points are a practical diligence framework, not a scored certification scheme:
Quick Recap
Best Value
- PHI access and role: What PHI does the vendor create, receive, maintain, or transmit, and does its work require access?
- Agreement: Are the BAA’s permitted uses, safeguards, subcontractor terms, and security responsibilities clear?
- Risk management: Can the vendor explain its risk analysis and safeguards for the ePHI it handles?
- Assurance: What evidence can the hospital obtain, and which evidence or audit rights are contractually available?
- Cloud control allocation: Is it clear which safeguards belong to the hospital and which to the provider?
- Resilience: Are availability, backup, and recovery expectations addressed in the SLA where relevant?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
